Link-Local Multicast Name Resolution (LLMNR)
Summary
LLMNR stands for Link-Local Multicast Name Resolution and it is a Windows name resolution protocol used to find devices on the local network when normal DNS resolution fails.
With this attack we are going to demonstrate how insecure local name resolution protocols (LLMNR) can be abused by an attacker (in the same network segment) to capture authentication data and to gain further access.
This whole scenario was done for Active Directory pentesting and educational purposes
Requirements
- Operating system: Kali linux (in our pentesting session the version was 2025.4)
- Tools: Responder (sudo apt install responder)(in our pentesting session the version was: 3.2.2.0)
- Second PC (not attacker): Windows 11
- Architecture: for pentesting purposes connect the attacker PC to the network where the Windows Client machines contained and a Windows Server in the same local network.
Description
We assume you have already set up your virtual lab and done reconnaissance.
For the Attacker side:
Install Responder
Install responder for LLMNR poisoning
sudo apt install responder
check responder:
responder --version
if you see any version you successfully installed responder
Check IP and interface
You will need the interface to start basic poisoning
ip a
Starting basic poisoning in responder
start responder, you can configure the responder protocols etc. with the "responder.conf" but we are going to use the default configurations.
Basic Poisoning:
sudo responder -I eth0 -v
If you noticed, you see some Poisoners and Servers that we are going to "respond" to if an event is triggered. To make our work easier we are going to use the File explorer in Windows but for this step complete step 3.
Last check-up
Check and write the generic options RESPONDER NIC and RESPONDER IP down, this information will help you to trigger an event on Windows 11 device which is in the same network with the Windows Server and the attacker.
For the Windows 11 Client side:
Login in Windows 11 device
Login
Open Explorer
Open File explorer named "Explorer" on your Windows 11 machine
Trigger an event in Explorer (not Browser)
Type into the Address bar/Path bar (not the search bar mostly it is close to the refresh button or you will see in it: Home>Start>)
Delete the text of the Address bar, and type
\\<Responder IP you got from Responder>
for example if you have responder IP 123.456.789.10
\\123.456.789.10
A login page will pop up, no need to login, close the login pop up.
Back to the Attacker side:
Look up for results
Below "Listening for events..." you will see the captured Hash of the Windows 11 Client
Copy the hast and store the hash into a nano file for example
sudo nano ntlmhash.txt
paste hash and save (we will use ntlmhash.txt while cracking the hash)
Crack the hash
Install hashcat
sudo install hashcat
or another tool could be john (is the kali version of John the Ripper)
sudo install john
Lets use hashcat for this example
hashcat -m 5600 ntlmhash.txt rockyou.txt
If you dont have the rockyou.txt you can install it too on kali:
sudo apt install wordlists
you have to un-zip it now
gunzip -c <path of rockyou.txt>
run the hashcat command again, it should work now
With the cracked hash, you have now the information of the username that was in the hash itself and the cracked password with hashcat in clear text format. Now you can use the username and password to login on the Windows 11 PC.
Used Hardware
PC with Virtual Machines - Kali Linux, Windows Server and Windows 11 Client PC
Courses
References
Tools:
- https://www.kali.org/tools/responder/
- https://www.kali.org/tools/john/
- https://www.kali.org/tools/hashcat/
Instructions: