LLMNR/NBT-NS/mDNS Poisoning ¶

Inside an internal windows network, when a DNS request fails or a DNS server is not available, LLMNR and NBT-NS may be used to send a local query to machines within the subnet.

• 🐲 LLMNR uses UDP port 5355
• 🐲 NBT-NS uses UDP port 137
• ☠️ NBT-NS may be used in older Windows-based networks
• ☠️ NBT-NS may be used when LLMNR fails to find a host
• ☠️ mDNS may be used when both LLMNR and NBT-NS failed

Both protocols are vulnerable to multiple attacks such as spoofing.

• You can use responder

$ sudo responder -i IP -I tun0
$ sudo responder -I tun0

• Refer to M-I-T-M for more tools and attacks

The best remediation is to disable both protocols, but in some environments, it may not be possible without impacting existing tools.

We can try to send fake LLMNR or NBT-NS requests, and if an host respond, then it's most malicious and we need to investigate.

We must ensure that both stay disabled, such as by monitoring HKLM\Software\Policies\Microsoft\Windows NT\DNSClient.

We can try to implement Network Access Control (NAC).