LLMNR/NBT-NS poisoning with Responder

July 7, 2025 · 1 min read · #network #windows #responder

If DNS resolution fails, Windows falls back to LLMNR and NBT-NS: it broadcasts "who has this hostname?". Anyone can answer "me".

The attack

A typo in a network path (\\fileserver1 instead of fileserver01) triggers the query. Responder answers, the client attempts NTLM auth and sends the NTLMv2 challenge-response hash, which is cracked offline or relayed.

responder -I eth0 -wF
hashcat -m 5600 ntlmv2.txt wordlist.txt

Defence

Disable LLMNR and NBT-NS via GPO (the single most effective defence in many Windows networks). SMB signing to block relay. Long passwords against offline cracking. Monitor anomalous LLMNR responses.

« back to home