Check out the results from our first round of ATT&CK Evaluations at attackevals.mitre.org!

LLMNR/NBT-NS Poisoning

Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. [1] [2]

Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords.

Several tools exist that can be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder. [3] [4] [5]

ID: T1171

Tactic: Credential Access

Platform:  Windows

Permissions Required:  User

Data Sources:  Windows Registry, Packet capture, Netflow/Enclave netflow

Contributors:  Matthew Demaske, Adaptforward

Version: 1.0

Examples

NameDescription
Pupy

Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.[6]

Responder

Responder is used to poison name services to gather hashes and credentials from systems within a local network.[5]

Mitigation

Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment. [7]

Use host-based security software to block LLMNR/NetBIOS traffic.

Detection

Monitor HKLM\Software\Policies\Microsoft\Windows NT\DNSClient for changes to the "EnableMulticast" DWORD value. A value of "0" indicates LLMNR is disabled. [8]

Monitor for traffic on ports UDP 5355 and UDP 137 if LLMNR/NetBIOS is disabled by security policy.

Deploy an LLMNR/NBT-NS spoofing detection tool. [9]

References