Home > Network Pentesting

LLMNR/NBT-NS Poisoning

LLMNR/NBT-NS poisoning exploits Windows name-resolution fallback mechanisms to trick hosts into sending NTLM authentication to the attacker. When a Windows machine cannot resolve a hostname through DNS, it broadcasts LLMNR or NBT-NS queries across the LAN. Any device on the network can reply — and if an attacker responds first, the victim will send NTLM authentication to the attacker. This makes LLMNR/NBT-NS poisoning one of the most effective internal network exploitation techniques.

How LLMNR and NBT-NS Work

Windows uses multiple steps to resolve hostnames:

  1. Checks local cache

  2. Queries DNS

  3. If DNS fails → sends LLMNR multicast query

  4. If still unresolved → sends NBT-NS broadcast query

These queries ask: “Who has HOSTNAME?”
Any host can reply — there is no authentication.

Attackers exploit this by sending fake replies and forcing victims to authenticate to the attacker’s machine.

Why These Protocols Are Vulnerable

LLMNR and NBT-NS are inherently insecure because:

  • They trust any device on the LAN

  • They do not validate responses

  • They allow unauthenticated fallback name resolution

  • They trigger NTLM authentication automatically

This makes interception extremely easy in flat networks.

Identifying LLMNR/NBT-NS Traffic

Before poisoning, inspect whether hosts are sending broadcast or multicast name-resolution requests.

Capturing LLMNR Traffic

sudo tcpdump -i eth0 port 5355

Capturing NBT-NS Traffic

sudo tcpdump -i eth0 port 137

If you see frequent multicast/broadcast queries, the network is vulnerable.

Performing LLMNR/NBT-NS Poisoning with Responder

Responder is the primary tool for poisoning and capturing NTLM hashes.

Running Responder

sudo responder -I eth0

Responder listens for:

  • LLMNR queries

  • NBT-NS broadcasts

  • MDNS queries

When a victim requests a non-existent hostname, Responder:

  • Replies pretending to be that host

  • Forces the victim to authenticate

  • Captures NTLMv2 hashes

Captured hashes are saved in the Responder/logs directory.

Capturing NTLM Hashes

Typical captured fields include:

  • Username

  • Domain

  • NTLMv2 hash

  • Challenge/response values

Hashes can be cracked offline using Hashcat.

Cracking NTLMv2 Hashes

hashcat -m 5600 hash.txt wordlist.txt

If the password is weak, cracking succeeds quickly.

Upgrading to SMB Relay Attacks

If SMB signing is not required, NTLM authentication captured from LLMNR poisoning can be relayed to another internal host.

Checking SMB Signing

nmap --script smb-security-mode -p445 10.10.10.5

If signing is not required → relay is possible.

Running NTLM RelayX

ntlmrelayx.py -tf targets.txt -smb2support

This may allow:

  • Command execution

  • File system access

  • Dumping SAM/NTDS

  • Lateral movement

LLMNR poisoning is often the first step toward domain compromise.

Exploiting WPAD

If WPAD (Web Proxy Auto Discovery) is enabled, Responder exploits it automatically.

Effects include:

  • Intercepting HTTP/HTTPS traffic

  • Proxying victim traffic

  • Capturing additional credentials

This significantly expands the attack impact.

Manual LLMNR/NBT-NS Poisoning with Bettercap

Bettercap provides another poisoning method.

Starting Bettercap

sudo bettercap -iface eth0

Enabling Poisoning

net.probe on
net.recon on
llmnr.spoof on
nbns.spoof on

Bettercap then injects rogue LLMNR/NBT-NS responses, capturing NTLM hashes.

Indicators of LLMNR/NBT-NS Poisoning

During testing, pentesters look for:

  • Broadcast name resolution

  • Absence of DNS for internal systems

  • Repeated queries for the same host

  • WPAD lookups

  • Lack of segmentation

Networks using these fallback protocols are highly vulnerable.

Post-Exploitation After Hash Capture

Once NTLM hashes are captured or cracked, pentesters can:

  • Attempt password spraying

  • Perform pass-the-hash

  • Access file shares

  • Move laterally

  • Enumerate domain structure

LLMNR/NBT-NS poisoning often leads to full Active Directory compromise.

Why LLMNR/NBT-NS Poisoning Matters

These legacy protocols allow silent credential interception on almost any Windows network that lacks proper defenses. Poisoning provides:

  • NTLMv2 hashes

  • Relay opportunities

  • Lateral movement paths

  • Domain footholds

It remains one of the highest-impact internal pentesting techniques.

Intel Dump

  • LLMNR/NBT-NS allow unauthenticated name-resolution replies

  • Tools: Responder, Bettercap, ntlmrelayx

  • Captured NTLM hashes enable cracking and pass-the-hash

  • SMB signing determines whether relay attacks are possible

  • These attacks often lead to domain compromise

HOME LEARN COMMUNITY DASHBOARD