LLMNR POISONING

Question 1

Qu’est-ce que LLMNR ?

Answer 1

• LLMNR: Link-Local Multicast Name Resolution
• Utiliser pour identifier les hôtes quand le DNS échou
• Descendant de NBT-NS
• This service use user’s username and NTLMv2 hash if correctly asked to do so

Question 2

Qu’est-ce que le LLMNR Poisoning ?

Answer 2

Question 3

Quel outil utiliser pour faire du LLMNR ?

Answer 3

Responder from Impacket

Question 4

What is best time to run responder ?

Answer 4

• On the morning when people connect to AD
• After the lunch when people reconnect to AD

Question 5

How crack password NTLM hash retrieved by responder ?

Answer 5

hashcat -m 5600 hashes.txt rockyou.txt -O

Question 6

How run responder ?

Answer 6

python Responder.py -I INTERFACE -rdw

Question 7

What are steps of basic Responder attack ?

Answer 7

1. Run responder
2. En event occurs
3. Get Dem hash
4. Crack Dem hashes

Question 8

What is the best defense against default Responder attack ?

Answer 8

1. Disable LLMNR and NBT-NS
2. If not possible
   - Require Network Access Control
   - Require strong user password (> 14 char.) and limit common word usage.