Name Resolution Poisoning and SMB Relay

Responding to LLMNR, NBT-NS, or mDNS name-resolution traffic with a forged mapping can cause a client to contact an adversary-controlled system. The authentication exchange may expose NTLM challenge-response material, which can be collected or relayed only where the authentication path and target protections permit. A captured NetNTLM challenge-response is not a reusable NTLM password hash. Relay protection is protocol-specific: SMB signing protects SMB sessions; LDAP signing applies to non-TLS SASL LDAP binds, while channel binding ties applicable SASL authentication to its TLS session. Simple binds are not protected by channel binding and require TLS to protect credentials in transit.