LLMNR Poisoning
Last updated
Last updated
Link-Local Multicast Name Resolution (LLMNR) is used to identify hosts when DNS does not work properly. This was previously known as NetBIOS (NBT-NS).
LLMNR is vulnerable because the services require a username and NTLMv2 hash in order to function, an attacker can poison the network to capture the hash of the computer as you can see in the following image.
2 Windows 10 Enterprise (Target 192.168.1.11)
1 Domain Controller 2019 (DC 192.168.1.7)
This attack is easy to deploy, just this will run it.
To understand better here is what the victim will be doing and seeing.
Here is the famous authentication that LLMNR does, now we respond to that broadcast packet using the Responder and have capture the NTLMv2 hash.
Below we see the hashes !! now we proceed to cracking them.
