Question

During an internal network penetration test, you have no valid domain credentials. You notice that hosts on the local subnet frequently broadcast LLMNR and NBT-NS name resolution requests for mistyped or unresolved hostnames. You want to capture credential material and then use it to authenticate to another host that has SMB signing disabled. Which combination of techniques best achieves this?

Accepted Answer

Use Responder to poison LLMNR/NBT-NS responses and capture NetNTLMv2 hashes, then relay them with ntlmrelayx to the target with SMB signing disabled

Answer

Use Responder to capture NetNTLMv2 hashes, then pass-the-hash directly with the captured NetNTLMv2 value using CrackMapExec

Answer

Run an ARP spoofing attack with Ettercap to intercept Kerberos tickets and replay them against the target host

Answer

Perform a DNS cache poisoning attack to redirect SMB traffic, then extract cleartext NTLM credentials from the captured packets