Lion Cipher Lab

Poison LLMNR/NBT-NS and relay NTLM in your own lab (Responder)

• Penetration Testing / Red Team
• Intermediate
• ~60 min
• Free · no account required

Why it matters

On almost every internal penetration test of a Windows/Active Directory network, the very first foothold comes not from an exploit but from a design behavior: when a Windows machine cannot resolve a name through DNS, it FALLS BACK to shouting the question to the whole local network segment and trusting whichever host answers first. An attacker who is simply present on that segment answers 'that's me', and the victim machine authenticates to the attacker -- handing over a NetNTLMv2 response, a cryptographic proof of the user's identity. From there the attacker either cracks that response…

What you'll learn

• understanding fallback name resolution (LLMNR, NBT-NS, mDNS) and why any host on the segment can answer a broadcast lookup
• installing and running Responder on a Kali/Linux attacker VM against the correct lab interface
• triggering a name-resolution lookup from a Windows client (a mistyped UNC path) and capturing the resulting NetNTLMv2 authentication
• reading a captured NetNTLMv2 hash and cracking it offline with hashcat mode 5600 (or john) at a high level
• relaying NTLM authentication with Impacket ntlmrelayx.py to a target that does NOT require SMB signing -- no password cracking needed
• knowing exactly when the relay works and when it fails (SMB signing required, LLMNR/NBT-NS disabled)
• hardening against all of it: disabling LLMNR (GPO Turn off Multicast Name Resolution) and NBT-NS, requiring SMB and LDAP signing, and detecting the poisoning
• the authorization discipline that separates authorized testing from a federal crime

Steps in this lab

1. Read this first: your own lab only -- the authorization firewall
2. Why LLMNR, NBT-NS, and mDNS are poisonable in the first place
3. Get the attacker VM and install Responder
4. Run Responder and capture a NetNTLMv2 hash
5. Two ways to use the capture: crack it offline, or RELAY it live
6. Now shut it down: disable LLMNR/NBT-NS, require signing, detect it
7. When it works, when it doesn't, and when NOT to use it
8. What you did, and the one sentence to keep

Open the full interactive lab →