LLMNR/NBT-NS Poisoning and Relay
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name.  
Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords. In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it. 
|Empire||Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.  |
|Impacket||Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution. |
|PoshC2||PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks. |
|Pupy||Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services. |
|Responder||Responder is used to poison name services to gather hashes and credentials from systems within a local network. |
|Disable or Remove Feature or Program||Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment.|
|Filter Network Traffic||Use host-based security software to block LLMNR/NetBIOS traffic. Enabling SMB Signing can stop NTLMv2 relay attacks.|
HKLM\Software\Policies\Microsoft\Windows NT\DNSClient for changes to the "EnableMulticast" DWORD value. A value of "0" indicates LLMNR is disabled. 
Monitor for traffic on ports UDP 5355 and UDP 137 if LLMNR/NetBIOS is disabled by security policy.
- Wikipedia. (2016, July 7). Link-Local Multicast Name Resolution. Retrieved November 17, 2017.
- Microsoft. (n.d.). NetBIOS Name Resolution. Retrieved November 17, 2017.
- Salvati, M. (2017, June 2). Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes). Retrieved February 7, 2019.
- Kuehn, E. (2018, April 11). Ever Run a Relay? Why SMB Relays Should Be On Your Mind. Retrieved February 7, 2019.
- Nomex. (2014, February 7). NBNSpoof. Retrieved November 17, 2017.
- Francois, R. (n.d.). LLMNR Spoofer. Retrieved November 17, 2017.
- Gaffie, L. (2016, August 25). Responder. Retrieved November 17, 2017.
- Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
- SecureAuth. (n.d.). Retrieved January 15, 2019.
- Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
- Robertson, K. (2015, April 2). Inveigh: Windows PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool. Retrieved March 11, 2019.
- Nettitude. (2016, June 8). PoshC2: Powershell C2 Server and Implants. Retrieved April 23, 2019.
- Sternstein, J. (2013, November). Local Network Attacks: LLMNR and NBT-NS Poisoning. Retrieved November 17, 2017.
- Robertson, K. (2016, August 28). Conveigh. Retrieved November 17, 2017.