Inveigh

Inveigh can listen for authentication and spoof name-resolution replies. The report combines an outbound SMB trigger with capture on a Windows pivot. A capture is NetNTLMv2 challenge-response material, not a directly reusable NT hash.

Inspect the C# build first

.\Inveigh.exe -?
.\Inveigh.exe -Inspect Y -RunTime 1 -FileOutput N

The maintained C# executable and legacy PowerShell function have different switches. Inspect mode reviews traffic without intentional spoofing. Confirm actual listeners in startup output: on Windows, SMB capture can use packet sniffing around the existing SMB service and require elevation.

Scope a capture to one lab client

.\Inveigh.exe -ReplyToIPs 192.0.2.25 -IPv6 N -DNS N -MDNS N -NBNS N -LLMNR Y -DHCPv6 N -ICMPv6 N -HTTP N -HTTPS N -LDAP N -SMB Y -RunCount 1 -RunTime 2 -FileOutput Y

Check the shipped version’s help and output before using this listener configuration. Direct UNC authentication is a different trigger from LLMNR spoofing. Ensure the selected address and port are reachable through your pivot.

Analyse the evidence

hashcat -m 5600 Inveigh-NTLMv2.txt lab-candidates.txt
hashcat -m 5600 --show Inveigh-NTLMv2.txt

Success: one attributable challenge-response is captured; cracking success is a separate result. Relay requires a suitable live destination and protocol protections to be absent. Remove the trigger file and stop listeners after the test. Reduce unnecessary outbound NTLM and unneeded name-resolution fallbacks.

Map the trigger, listener and route

lab client → selected name-resolution response or explicit UNC path
           → reachable pivot listener/sniffer
           → NTLM negotiation captured by Inveigh
           → restricted evidence file

An explicit \\pivot\share trigger can reach SMB without any LLMNR query. In contrast, a failed name lookup may never leave the client’s multicast segment. A routed tunnel does not automatically carry link-local multicast broadcasts to another network.

Inspect bindings before starting capture

Get-NetIPAddress -AddressFamily IPv4
Get-NetTCPConnection -State Listen | Where-Object LocalPort -In 80,443,445,389
Get-NetUDPEndpoint | Where-Object LocalPort -In 53,137,5353,5355

These commands describe the local pivot. On Windows, SMB capture can use sniffing around the running SMB service; a separate SMB listener on another platform may need an available TCP/445 bind. Verify the startup output rather than assuming the same model on every OS.

Keep output in a known directory

New-Item -ItemType Directory -Path 'C:\Lab\InveighEvidence' -Force
.\Inveigh.exe -Inspect Y -RunTime 1 -FileOutput Y -LogOutput Y -FileDirectory 'C:\Lab\InveighEvidence'

Inspect mode is useful for seeing queries before choosing spoofing options. When switching to the earlier scoped capture recipe, keep the output-directory option, disable unnecessary protocol features and check the actual selected interface. ReplyToIPs limits spoofing replies; it is not a universal source-IP filter for every incoming listener connection.

Use the C# console deliberately

After entering the interactive console (Enter during real-time output), these documented commands inspect state:

HELP
GET NTLMV2USERNAMES
GET NTLMV2UNIQUE
GET LOG
RESUME
STOP

GET NTLMV2UNIQUE displays sensitive verification material. Keep it in restricted evidence rather than general notes. STOP ends the process; RESUME returns to real-time output.

Separate NTLM material and outcomes

Material/result	Usable for
NTLMv2 challenge-response	Offline candidate verification with mode 5600
NT hash	NTLM authentication where the protocol accepts it
Recovered plaintext password	Authentication subject to account policy and service rights
Live relay session	Access to the particular destination and accepted protocol

A saved challenge-response is not an NT hash and cannot simply be placed in nxc -H. Capture alone also does not prove relay to a signing-protected SMB service is possible.

Troubleshooting

Observation	Next check
No queries in inspect mode	Client segment, enabled fallback protocols and interface
Spoof reply logged, no capture	Advertised address, client route and blocked outbound authentication
Listener cannot bind	Existing service, address or insufficient privilege
Machine account ending in `$`	The trigger ran in machine/service context
Capture does not crack	Record integrity, mode, candidates and account password strength

After the test, stop Inveigh and remove the trigger. Keep source client, destination, UTC time and mechanism in the finding. For listener direction through a tunnel see Ligolo-ng.

How attacks work. Examples use fictional lab values; replace placeholders only with values from the system you are testing.