Skip to content
attack.paths
Anmelden
← RegistryDossier · 8 steps · 7 edges

No creds → Domain Admin via LLMNR poisoning and NTLM relay

Unauthenticated attacker on the LAN poisons name resolution, relays the captured NetNTLMv2 to a host with SMB signing disabled, then escalates to Domain Admin.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: attacker has a foothold on the internal LAN (e.g. a rogue device, VLAN hop, or compromised low-trust host) but no domain credentials. SMB signing is not enforced on at least one host, and LLMNR/NBT-NS broadcast resolution is enabled.

§ Steps

  1. 01
    Dump LSASSCredential Access
    T1003.001— LSASS Memory

    Recover cached domain creds / Kerberos tickets from the foothold.

  2. 02
    Network reconDiscovery
    T1018— Remote System Discovery

    Identify hosts, DCs, MS-SQL servers, file shares.

  3. 03
    Lateral movement to high-value hostLateral Movement
    T1550.002— Pass the Hash
  4. 04
    Code execution as relayed userLateral Movement
    T1021.002— SMB/Windows Admin Shares

    If the coerced principal is a local admin on the target, get a SYSTEM shell via SMB exec.

  5. 05
    BloodHound enumerationDiscovery
    AD-BLOODHOUND— BloodHound / SharpHound Enumeration

    Find a path from the harvested principal to Domain Admin.

  6. 06
    DCSync to recover krbtgtCredential Access
    T1003.006— DCSync

    secretsdump.py -just-dc <DA>@<dc>

  7. 07
    NTLM relay to SMBCredential Access
    T1557.001— LLMNR/NBT-NS Poisoning and SMB Relay

    ntlmrelayx.py -tf targets.txt -smb2support — relay to any host without SMB signing.

  8. 08
    LLMNR/NBT-NS/mDNS poisoningCredential Access
    T1557.001— LLMNR/NBT-NS Poisoning and SMB Relay

    Responder -I eth0 — answer name-resolution broadcasts to receive NetNTLMv2 challenges.

§ References

§ Frequently asked

What is the "No creds → Domain Admin via LLMNR poisoning and NTLM relay" attack path?
Unauthenticated attacker on the LAN poisons name resolution, relays the captured NetNTLMv2 to a host with SMB signing disabled, then escalates to Domain Admin. It chains 8 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Dump LSASS (T1003.001) — a credential access primitive. Assumed environment: attacker has a foothold on the internal LAN (e.
What is the final impact of this kill-chain?
The final step lands on LLMNR/NBT-NS/mDNS poisoning (T1557.001), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers