📖 What is LLMNR/NBT-NS Poisoning?
LLMNR/NBT-NS Poisoning involves spoofing Link-Local Multicast Name Resolution or NetBIOS Name Service responses to capture user credentials. When a client fails to resolve a hostname via DNS, the attacker responds, tricking the client into sending an NTLM hash.
"The tool 'Responder' is the gold standard here. If you see Responder in a scenario, think LLMNR/NBT-NS poisoning immediately."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of LLMNR/NBT-NS Poisoning?
- ▸ The attack exploits the fallback mechanism where Windows clients use LLMNR or NetBIOS Name Service after a DNS lookup fails to resolve a hostname.
- ▸ Attackers use tools like Responder to listen for these broadcast requests and send spoofed responses, claiming to be the requested resource.
- ▸ The victim client, believing the attacker is the legitimate host, attempts to authenticate and sends an NTLMv2 challenge-response hash to the attacker.
- ▸ Captured NTLMv2 hashes are not plaintext passwords; they must be cracked offline using tools like Hashcat or John the Ripper to recover the password.
- ▸ The primary mitigation is disabling LLMNR and NBT-NS via Group Policy Objects (GPO) to force clients to rely solely on DNS for name resolution.
🎯 How does LLMNR/NBT-NS Poisoning appear on the PT0-002 Exam?
You may be asked to identify the most effective tool for capturing credentials on a local network when users frequently mistype internal server names.
A scenario might describe a penetration tester observing broadcast traffic on a subnet and using a tool to spoof responses to capture NTLMv2 hashes.
Expect questions asking for the best remediation strategy to prevent credential harvesting via legacy name resolution protocols in a corporate Windows environment.
❓ Frequently Asked Questions
What is the difference between LLMNR and NBT-NS poisoning?
While both target fallback name resolution, LLMNR uses multicast (UDP 5355) and is newer, while NBT-NS uses broadcast (UDP 137) and is a legacy NetBIOS protocol. Attackers typically target both simultaneously using Responder.
Can the captured hashes be used without cracking them?
Yes, through an SMB Relay attack. If SMB signing is disabled on the target system, an attacker can relay the captured NTLM hash in real-time to authenticate as the victim without ever knowing the plaintext password.
Why doesn't a functioning DNS server prevent this attack?
The attack triggers specifically when DNS fails. If a user mistypes a hostname (e.g., 'fileserverr' instead of 'fileserver'), the DNS server returns a 'not found' error, prompting the client to try LLMNR and NBT-NS.