LLMNR Name Poisoning

Active Directory Pentest

Active Directory (AD) is a Microsoft technology that provides a centralized location for managing users, computers, and other resources within a network. As AD is a critical component of many enterprise networks, it is a common target for attackers looking to gain unauthorized access. An Active Directory Pentest, short for Penetration Test, is a security assessment that focuses on identifying and exploiting vulnerabilities within an AD environment. The goal of an AD Pentest is to simulate an attack from a malicious actor and identify weaknesses that could be exploited to compromise the security of the network. The results of an AD Pentest can provide valuable insight into the security posture of an organization and help inform decisions regarding security controls and risk management.

 

LLMNR Name Poisoning

Link-Local Multicast Name Resolution (LLMNR) is a protocol used in modern Windows operating systems to resolve the IP addresses of nearby computers when Domain Name System (DNS) resolution fails. LLMNR poisoning, also known as LLMNR spoofing, is a network attack that exploits the LLMNR protocol to trick computers on a network into sending sensitive information to a malicious attacker.

In LLMNR poisoning attacks, the attacker sends malicious LLMNR packets to a victim computer, impersonating another computer on the network. The victim computer may then send sensitive information, such as login credentials, to the attacker instead of the intended computer. This type of attack can be particularly effective in environments with weak security controls and a high level of network traffic.

For Archive LLMNR Poisoning we are using a tool call “Responder”.

What is “Responder” ?

Responder is a powerful open-source tool used for network analysis and penetration testing, particularly in Windows environments. Developed by Laurent Gaffie, Responder is included in the Kali Linux distribution of penetration testing tools and you can get the tool from “https://github.com/lgandx/Responder ”.

The tool is designed to take advantage of several network protocols and services, including Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Service (NBT-NS), and Web Proxy Auto-Discovery (WPAD). Responder can be used to capture sensitive network traffic, such as usernames and passwords, by spoofing legitimate network services.

Responder can be used to perform various types of attacks, including LLMNR poisoning, NetBIOS Name Service (NBT-NS) poisoning, and WPAD spoofing. The tool can be used to capture credentials and hashes, escalate privileges, and perform lateral movement within a network.

Guide to Proceed

It is important to note that using Responder for LLMNR poisoning can be illegal and unethical unless you have explicit permission to do so. This guide is for educational purposes only.

Here is a step-by-step guide to using Responder for LLMNR poisoning:

0101.   Install Responder: Responder is included in the Kali Linux distribution of penetration testing tools,         so it should already be installed. If not, you can install it using the following command in the                   terminal:

sudo apt-get install responder

0202.  Start Responder: Open a terminal and type the following command to start Responder:

sudo responder -I eth0 -w -d -v

     Replace "eth0" with the name of your network interface.

0303. Wait for Responses: Responder will start listening for LLMNR requests on the network. Wait for a           victim computer to send a request. (Try to access network share with wrong path)

0404. Capture Credentials: When a victim computer sends an LLMNR request, Responder will respond         with a spoofed response. If the victim computer sends its credentials in plaintext, Responder will           capture them and display them in the terminal.

   You will receive HASH as below

0505.  Perform Post-Exploitation: After capturing credentials, HASH you can use tool as HASHCAT to            decrypt the HASH and retrieve the password of the account.

 

Disclaimer: This article is for educational purposes only. LLMNR poisoning and other network attacks can be illegal and unethical unless you have explicit permission from the system owners to perform them. It is important to use Responder and other penetration testing tools only with explicit permission from the network owner and in controlled environments to avoid causing harm or violating laws and regulations. It is crucial to follow ethical guidelines and legal regulations when conducting any form of security testing or penetration testing. The use of Responder or any other network tool without proper authorization or permission can result in legal consequences. We do not condone or encourage the use of any security tool or technique for illegal or unethical purposes.