arsenal/responder

responder

LLMNR/NBT-NS poisoner · GPL-3.0

Answers LLMNR, NBT-NS, and mDNS requests to capture NetNTLM hashes on a local network. A classic internal first move.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Poisoning name resolution

When a Windows machine cannot resolve a name through DNS, it shouts on the local network: has anyone heard of this host, using the old LLMNR, NBT-NS, and mDNS protocols. Responder answers every such shout with yes, that is me, and the asking machine then tries to authenticate to it, handing over the user's NetNTLM hash. No credentials are needed to start; you just listen and reply. A typo in a share path or a stale drive mapping is enough to make a machine ask, which is why responder so often catches hashes within minutes on a real network.

↑ contents

02Install

$ sudo apt install responder # Debian / Kali

$ # Gentoo / Fedora / any: git clone https://github.com/lgandx/Responder

03Listening and answering

Point responder at your interface and it starts answering poisoned responses and running its own fake auth servers to collect hashes. -w and analysis options exist, but the base run is simple. It prints captured hashes to the screen and saves them under its logs directory.

$ sudo responder -I eth0

04Analyze mode: look before you poison

Analyze mode (-A) listens without answering, so you can see which machines are asking and what protocols are in use before you actively poison anything. On a real engagement this is the responsible first step, and on your own network it shows you how much vulnerable name resolution is happening.

$ sudo responder -I eth0 -A

05Cracking what you catch

The captured NetNTLMv2 hashes are not usable directly (you cannot pass-the-hash with them), but they crack offline with hashcat mode 5600. A user with a weak password falls quickly; a strong one does not, which is again the whole defensive point.

$ hashcat -m 5600 responder-hashes.txt rockyou.txt

» NetNTLMv2 cracks to the plaintext password, which then works everywhere that user does. That is the path from a stray broadcast to a real credential.

06Relaying instead of cracking

Stronger than cracking: relay the captured authentication straight to another machine that accepts it, authenticating as the victim without ever knowing their password. This pairs responder (turn off its own SMB/HTTP servers) with impacket's ntlmrelayx. It works where SMB signing is not enforced, which is the key defensive setting.

$ # responder.conf: set SMB and HTTP to Off, then:

$ impacket-ntlmrelayx -tf targets.txt -smb2support

↑ contents

07Closing the name-resolution hole

Responder works because of legacy protocols that almost no network actually needs. Turning them off removes the attack entirely, and it is one of the highest-value, lowest-cost hardening steps in a Windows environment.

» Disable LLMNR and NBT-NS via Group Policy across the domain; almost nothing legitimate needs them, and their absence makes responder deaf.

» Enforce SMB signing everywhere; it does not stop capture but it defeats the far more dangerous relay attack.

» Strong passwords mean captured NetNTLMv2 hashes do not crack; this is the same length lesson as the whole credentials group.

» Detect it: a host answering LLMNR/NBT-NS for many names, or authentications to an unexpected machine, is the signature. Kismet-style vigilance applies on the wire here too.

» Run responder in analyze mode on your own network first; the volume of LLMNR and NBT-NS traffic you see is the argument for turning them off.

↑ contents