search

🪟LLMNR/NBT-NS Poisoning from Windows

hashtag
📋 Overview

LLMNR and NBT-NS poisoning attacks can also be performed from Windows hosts using Inveigh, a PowerShell and C# tool that functions similarly to Responder but is designed for Windows environments. This technique is particularly useful when you have compromised a Windows host or are provided with a Windows attack box.

hashtag
🛠️ Inveigh Tool Overview

Inveigh is a Windows-based LLMNR/NBT-NS poisoning tool available in both PowerShell and C# versions:

hashtag
📍 Key Features

  • Multi-Protocol Support: IPv4, IPv6, LLMNR, DNS, mDNS, NBNS, DHCPv6, ICMPv6

  • Service Poisoning: HTTP, HTTPS, SMB, LDAP, WebDAV, Proxy Auth

  • Interactive Console: Real-time hash viewing and management

  • File Output: Automatic logging of captured credentials

  • Stealth Options: Various configuration options for evasion

hashtag
📂 Tool Locations

  • PowerShell Version: C:\Tools\Inveigh.ps1 (original, no longer updated)

  • C# Version: C:\Tools\Inveigh.exe (actively maintained)

hashtag
🔧 PowerShell Inveigh

hashtag
📥 Loading the Module

hashtag
⚡ Basic Usage

hashtag
📊 Example Output

hashtag
🚀 C# Inveigh (InveighZero)

hashtag
⚡ Basic Execution

hashtag
📊 C# Output Example

hashtag
🎯 Service Status Legend

  • [+] = Enabled by default

  • [ ] = Disabled by default

hashtag
🖥️ Interactive Console

hashtag
🔑 Accessing Console

Press ESC while Inveigh is running to enter interactive mode.

hashtag
📋 Available Commands

hashtag
🏆 Viewing Captured Hashes

hashtag
📊 Example Hash Output

hashtag
👥 Username Overview

hashtag
🔒 Remediation

hashtag
🚫 Disabling LLMNR

Method 1: Group Policy

  1. Navigate to: Computer Configuration → Administrative Templates → Network → DNS Client

  2. Enable: "Turn OFF Multicast Name Resolution"

hashtag
🚫 Disabling NBT-NS

Method 1: Local Configuration

  1. Open Network and Sharing Center

  2. Click Change adapter settings

  3. Right-click adapter → Properties

  4. Select Internet Protocol Version 4 (TCP/IPv4) → Properties

  5. Click Advanced → WINS tab

  6. Select Disable NetBIOS over TCP/IP

Method 2: PowerShell Script (GPO)

GPO Deployment Steps:

  1. Create script in Computer Configuration → Windows Settings → Script (Startup/Shutdown) → Startup

  2. Choose PowerShell Scripts tab

  3. Set to Run Windows PowerShell scripts first

  4. Host script on SYSVOL: \\domain.local\SYSVOL\DOMAIN.LOCAL\scripts

hashtag
🛡️ Additional Mitigations

  • Network Filtering: Block LLMNR/NetBIOS traffic

  • SMB Signing: Enable to prevent NTLM relay attacks

  • NIDS/NIPS: Deploy network intrusion detection systems

  • Network Segmentation: Isolate critical hosts

hashtag
🔍 Detection

hashtag
📊 Detection Methods

1. Honeypot Technique

  • Inject LLMNR/NBT-NS requests for non-existent hosts

  • Alert on any responses (indicates spoofing activity)

2. Network Monitoring

  • Monitor traffic on ports UDP 5355 and 137

  • Track unusual name resolution patterns

3. Event Log Monitoring

  • Monitor Event IDs: 4697 and 7045

  • Track new service installations

4. Registry Monitoring

  • Key: HKLM\Software\Policies\Microsoft\Windows NT\DNSClient

  • Monitor EnableMulticast DWORD value

  • Value of 0 = LLMNR disabled

hashtag
🚨 IOCs (Indicators of Compromise)

  • Unusual LLMNR/NBT-NS response patterns

  • Multiple authentication failures from single IP

  • Unexpected SMB connections

  • Non-existent hostname resolution attempts

hashtag
🎯 HTB Academy Lab Walkthrough

hashtag
📝 Question

"Run Inveigh and capture the NTLMv2 hash for the svc_qualys account. Crack and submit the cleartext password as the answer."

hashtag
🚀 Step-by-Step Solution

hashtag
1️⃣ Connect to Target

hashtag
2️⃣ Import and Start Inveigh

hashtag
3️⃣ Wait for Hash Capture (5+ minutes)

hashtag
4️⃣ Extract Hash from File

hashtag
5️⃣ Transfer to Linux for Cracking

hashtag
6️⃣ Crack with Hashcat

hashtag
✅ Answer: security#1

hashtag
🔑 Key Takeaways

hashtag
✅ Advantages of Inveigh

  • Native Windows tool - blends with environment

  • Interactive console - real-time hash management

  • Multiple protocols - comprehensive attack coverage

  • File logging - persistent hash storage

hashtag
⚠️ Considerations

  • Requires elevated privileges on Windows

  • May trigger AV detection (especially C# version)

  • Network noise - generates visible traffic

  • HTTP listener conflicts - check port availability

hashtag
🎯 Best Practices

  • Use file output for hash persistence

  • Monitor console output for real-time feedback

  • Combine with BloodHound for target prioritization

  • Understand network topology before attacking

hashtag
🔗 Additional Resources

  • Inveigh GitHub: https://github.com/Kevin-Robertson/Inveigh

  • Inveigh Wiki: https://github.com/Kevin-Robertson/Inveigh/wiki

  • MITRE ATT&CK: T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay

  • Detection Blog: Using honeypots for LLMNR/NBT-NS detection

This attack is effective when LLMNR/NBT-NS protocols are enabled and demonstrates the importance of proper network configuration and monitoring.

PreviousLLMNR/NBT-NS Poisoning from LinuxNextPassword Policy Enumeration

Last updated