LLMNR/NBT-NS Poisoning and SMB Relay

§ Where this technique fits

§ Dossiers chaining this technique

• WSUS over HTTP → push code to managed clients

  Clients using an HTTP WSUS server can be MITM'd to receive an attacker-signed (but Microsoft-trusted) auxiliary update that executes arbitrary commands as SYSTEM.

  step 2 / 4

• No creds → Domain Admin via LLMNR poisoning and NTLM relay

  Unauthenticated attacker on the LAN poisons name resolution, relays the captured NetNTLMv2 to a host with SMB signing disabled, then escalates to Domain Admin.

  step 2 / 8

• PetitPotam + ADCS ESC8 → Domain Controller takeover

  Coerce a DC's machine account to authenticate to the attacker, relay that NTLM to the ADCS HTTP web-enrollment endpoint, and obtain a DC certificate for full domain compromise.

  step 2 / 6

• SCCM site takeover via NTLM relay (Takeover-1)

  Coerce the SCCM site server to authenticate, relay to MSSQL on the site database, and grant yourself Full Administrator inside SCCM.

  step 3 / 7

• mitm6 IPv6 SLAAC → NTLM relay → DA

  Even when IPv4 is hardened, Windows clients prefer IPv6 with default DHCPv6. mitm6 makes the attacker the IPv6 DNS server, advertises wpad, and relays the captured NTLM to LDAPS for RBCD.

  step 4 / 7

• Rogue DHCP → DNS poisoning → MITM

  Bring up a faster DHCP server on the segment; new clients get attacker as gateway + DNS — strip HTTPS, capture creds, inject payloads.

  step 4 / 5

• 802.1X NAC bypass via printer MAC spoof

  Plug into the LAN, sniff a printer / IP-phone MAC, clone it on your laptop, get full LAN access via MAC-Auth-Bypass — bypass NAC entirely.

  step 6 / 6

§ What commonly comes next

1. 01
   Authentication Coercion

   AD-COERCE · Initial Access
   seen 1×
2. 02
   Brute Force

   T1110 · Credential Access
   seen 1×
3. 03
   Resource-Based Constrained Delegation (RBCD) Abuse

   AD-RBCD · Lateral Movement
   seen 1×
4. 04
   SCCM Client Push Installation Abuse

   AD-SCCM-CLIENTPUSH · Privilege Escalation
   seen 1×
5. 05
   SMB/Windows Admin Shares

   T1021.002 · Lateral Movement
   seen 1×
6. 06
   WSUS Update Injection (HTTP)

   AD-WSUS · Privilege Escalation
   seen 1×