LLMNR Poisoning (Active Directory Attack)

LLMNR Poisoning is a network attack where an attacker tricks Windows computers into sending their NTLM authentication hashes to the attacker. It is commonly seen in Active Directory / Windows network penetration testing.

Think of it like this:

_A Windows computer asks the network: _"Where is FILESERVER?"

_The attacker replies: _"I am FILESERVER."

Windows trusts the response and tries to authenticate.

The attacker captures the authentication exchange.

Normal LLMNR Flow

What is LLMNR?

LLMNR stands for Link-Local Multicast Name Resolution. Windows normally uses DNS to translate a name into an IP address. For example:

\\fileserver\share

\\fileserver\share

Windows asks DNS:

What is the IP address of "fileserver"?

What is the IP address of "fileserver"?

Suppose DNS doesn't know. Windows may then use LLMNR to ask other computers on the local network:

Who is fileserver?

Who is fileserver?

This request is sent to the local network using multicast. The important problem is:

LLMNR does not strongly authenticate the computer that responds.

So an attacker can answer:

Windows: Who is fileserver?
Attacker: I am fileserver!

Windows: Who is fileserver?
Attacker: I am fileserver!

What happens next?

This is the important part. Windows may attempt NTLM authentication to the machine it believes is the requested server. The authentication doesn't simply send:

Password = MyPassword123

Password = MyPassword123

Instead, Windows performs an NTLM challenge-response authentication.

Simplified:

Victim → Attacker:
        "I want to authenticate."
Attacker → Victim:
        "Here is a challenge."
Victim → Attacker:
        "Here is my NTLM response."
Attacker:
        Captures the response

Victim → Attacker:
        "I want to authenticate."
Attacker → Victim:
        "Here is a challenge."
Victim → Attacker:
        "Here is my NTLM response."
Attacker:
        Captures the response

The attacker doesn't necessarily receive the user's plaintext password. They receive an NTLM challenge-response that may potentially be subjected to offline password-cracking. NTLM is a Microsoft authentication protocol.

Client                  Server
  |                       |
  | ---- Username ------> |
  |                       |
  | <---- Challenge ----- |
  |                       |
  | ---- Response ------> |
  |                       |

Client                  Server
  |                       |
  | ---- Username ------> |
  |                       |
  | <---- Challenge ----- |
  |                       |
  | ---- Response ------> |
  |                       |

The server uses the response to verify that the client knows the password without directly sending the plaintext password over the network. With NTLMv2 network authentication, the attacker commonly captures a challenge-response exchange, not simply a static NTLM password hash.

Attack Flow

Step 1: Run Responder

sudo responder -I eth0 -dv

sudo responder -I eth0 -dv

Step 2: An Event Occurs

\\10.8.0.2

\\10.8.0.2

Step 3: Get DEM Hashes

Step 4: Crack the Hashes

hashcat -m 5600 hashes.txt /usr/share/wordlist/rockyou.txt

hashcat -m 5600 hashes.txt /usr/share/wordlist/rockyou.txt

we got the password…