Abusing LLMNR/NBT-NS Poisoning for Initial Active Directory Foothold

Introduction

In many Active Directory environments, legacy name resolution protocols such as:

• LLMNR
• NBT-NS

remain enabled by default.

These protocols are designed to assist systems when DNS resolution fails, but they also introduce an interesting attack surface that attackers can abuse to capture authentication hashes and gain an initial foothold inside the domain.

In this walkthrough, we explore:

• LLMNR/NBT-NS Poisoning
• Responder
• Inveigh
• NetNTLMv2 Hash Capture
• Offline Password Cracking
• Initial Active Directory Access

Understanding LLMNR & NBT-NS

When a Windows host cannot resolve a hostname through DNS, it may fall back to:

• LLMNR (Link-Local Multicast Name Resolution)
• NBT-NS (NetBIOS Name Service)

The problem is:

Any host on the local network can respond

This allows attackers to spoof responses and trick victims into authenticating to the attacker’s machine.

Attack Flow

The attack works like this:

Victim requests unknown hostname
        ↓
DNS resolution fails
        ↓
Victim broadcasts LLMNR/NBT-NS request
        ↓
Attacker responds pretending to be target host
        ↓
Victim sends NTLM authentication
        ↓
Attacker captures NetNTLMv2 hash

Starting Responder

Responder is one of the most commonly used tools for LLMNR/NBT-NS poisoning.

Starting Responder:

sudo responder -I ens224

Responder begins listening for:

• LLMNR requests
• NBT-NS requests
• mDNS traffic

and responds as a rogue name resolution source.

Capturing NetNTLMv2 Hashes

After some time, Responder captures authentication requests from hosts on the network.

Example captured hashes:

SMB-NTLMv2-SSP-172.16.5.25.txt
HTTP-NTLMv2-172.16.5.200.txt

These hashes are stored automatically inside:

/usr/share/responder/logs

Understanding NetNTLMv2

The captured value is:

NetNTLMv2

which is used during NTLM authentication.

Important distinction:

NetNTLMv2 ≠ NTLM Hash

NetNTLMv2 hashes cannot be directly used for:

• Pass-the-Hash

Instead, they must first be:

Cracked Offline

Cracking the Hash

Using Hashcat:

hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

Hash mode:

5600 = NetNTLMv2

Successful crack:

FOREND : Klmcargo2

At this point we successfully recover:

Cleartext Domain Credentials

Initial Foothold

This becomes the first foothold inside the Active Directory environment.

The attack chain becomes:

LLMNR/NBT-NS Poisoning
        ↓
NetNTLMv2 Capture
        ↓
Offline Cracking
        ↓
Valid Domain Credentials
        ↓
Initial AD Access

Using Inveigh on Windows

The same attack can also be performed from a Windows host using:

Inveigh

Starting Inveigh PowerShell version:

Import-Module .\Inveigh.ps1

Launching the attack:

Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y

Inveigh Features

Inveigh supports poisoning and spoofing for:

• LLMNR
• NBNS
• DNS
• HTTP
• SMB
• LDAP
• WebDAV
• Proxy Authentication

Captured hashes can be viewed directly from the interactive console.

Viewing Captured Hashes

Inside Inveigh:

GET NTLMV2UNIQUE

Example:

backupagent::INLANEFREIGHT
forend::INLANEFREIGHT
svc_qualys::INLANEFREIGHT

Why This Attack Works

The root cause is:

Insecure Name Resolution Protocols

combined with:

• Weak passwords
• NTLM authentication
• Lack of SMB signing

Important AD Concepts

This attack demonstrates several important Active Directory concepts:

ConceptPurposeLLMNR/NBT-NSAlternative name resolutionNTLMWindows authentication protocolNetNTLMv2Challenge-response authenticationResponderRogue responder/spooferInveighWindows-based poisoning toolOffline CrackingRecover cleartext passwords

Common Attack Goals

Captured hashes may lead to:

• Initial foothold
• Lateral movement
• SMB relay
• Privilege escalation
• Domain compromise

depending on:

• Account privileges
• Password strength
• SMB signing configuration

Mitigation

Several mitigations help reduce the risk:

Disable LLMNR

Through Group Policy:

Turn Off Multicast Name Resolution

Disable NBT-NS

Disable:

NetBIOS over TCP/IP

on hosts.

Enable SMB Signing

SMB signing helps prevent:

NTLM Relay AttacNetwork Monitoring

Monitor:

• UDP 5355
• UDP 137
• Suspicious LLMNR responses
• Responder/Inveigh activity

Full Attack Flow

Victim hostname resolution fails
        ↓
LLMNR/NBT-NS broadcast
        ↓
Responder/Inveigh spoofing
        ↓
NetNTLMv2 capture
        ↓
Offline password cracking
        ↓
Credential recovery
        ↓
Initial Active Directory foothold

Conclusion

LLMNR/NBT-NS poisoning remains one of the most effective techniques for obtaining initial credentials during internal Active Directory assessments.

The attack requires:

• No exploit
• No malware
• No code execution
• Network access and weak operational security

This makes it extremely effective in real-world enterprise environments where legacy protocols remain enabled.