LLMNR & NBT-NS Poisoning

LLMNR & NBT-NS Poisoning

What is LMNR & NBT-NS

⇒ Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are two name services used by windows for resolving hostnames to IP addresses when a DNS request fails in a network.

⇒ if the machine fails to resolve the DNS request . then the machine will communicate with other machines in the network using LLMNR

⇒ Utilizes NTLM/NTLMv2 hash, which can be exploited and can be cracked offline

---

Explaining The Attack

• In this victim tries to connect to the shared name \\hackme but instead he typed \\hackm and hackm doesnt exists in the DNS record

• So the victim sends the broadcast message to everyone in the network that anyone know how to connect to \\hackm

• So us the attacker will act as the man-in-the-middle and says that i sure do know how to connect to that , you just send me over your hash or credentials and i will connect to it for you

• so will just capture the ntlm hash using the tool Responder

---

Performing The Attack

• Setting up responder

We will need to setup responder answer to unanswered LLMNR request using the following syntax

python3 Responder.py -w --lm -v -I <interface>

• A user makes a mistake…..

• The user wants to connect to share Client06 but instead he types Client07

• And we capture the hash

---

Cracking NTLMv2 Hash

• You can use the hashcat

hashcat -m 5600 ntlmv2 /usr/share/wordlists/rockyou.txt  --force

---

Defenses

⇒ The best defense in this case is to disable LLMNR and NBT-NS

• Disable LLMNR, select Turn OFF Multicast Name Resolution under Local Computer Policy > Computer Configuration > Administrative Templates > Network > DNS Client in GPO Editor

• Disable NBT-NS, navigate to Network Connections > Network Adapter Properties > TCP/IPv4 Properties > Advanced Tab > WINS tab and select "Disable NetBIOS over TCP/IP"

⇒ If a company must use or cannot disable LLMNR /NBT-NS, the best course of action is to

• Require Network Access Control. if an attacker cannot get onto the network, the attack cannot be performed.

• Best is to require strong user passwords (e.g, >12 characters in length with complex word special characters).