Skip to content

T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay

By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.

Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. 94

Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords.

In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv1/v2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it.73 Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various protocols, such as LDAP, SMB, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response. 

Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder.512

Item Value
ID T1557.001
Sub-techniques T1557.001, T1557.002, T1557.003
Tactics TA0006, TA0009
Platforms Windows
Version 1.4
Created 11 February 2020
Last Modified 25 October 2022

Procedure Examples

ID Name Description
S0363 Empire Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.1213
S0357 Impacket Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.16
G0032 Lazarus Group Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.17
S0378 PoshC2 PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.14
S0192 Pupy Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.15
S0174 Responder Responder is used to poison name services to gather hashes and credentials from systems within a local network.2
G0102 Wizard Spider Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.18

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment. 10
M1037 Filter Network Traffic Use host-based security software to block LLMNR/NetBIOS traffic. Enabling SMB Signing can stop NTLMv2 relay attacks.7311
M1031 Network Intrusion Prevention Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.
M1030 Network Segmentation Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.

Detection

ID Data Source Data Component
DS0029 Network Traffic Network Traffic Content
DS0019 Service Service Creation
DS0024 Windows Registry Windows Registry Key Modification

References


  1. Francois, R. (n.d.). LLMNR Spoofer. Retrieved November 17, 2017. 

  2. Gaffie, L. (2016, August 25). Responder. Retrieved November 17, 2017. 

  3. Kuehn, E. (2018, April 11). Ever Run a Relay? Why SMB Relays Should Be On Your Mind. Retrieved February 7, 2019. 

  4. Microsoft. (n.d.). NetBIOS Name Resolution. Retrieved November 17, 2017. 

  5. Nomex. (2014, February 7). NBNSpoof. Retrieved November 17, 2017. 

  6. Robertson, K. (2016, August 28). Conveigh. Retrieved November 17, 2017. 

  7. Salvati, M. (2017, June 2). Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes). Retrieved February 7, 2019. 

  8. Sternstein, J. (2013, November). Local Network Attacks: LLMNR and NBT-NS Poisoning. Retrieved November 17, 2017. 

  9. Wikipedia. (2016, July 7). Link-Local Multicast Name Resolution. Retrieved November 17, 2017. 

  10. Metcalf, S. (2016, October 21). Securing Windows Workstations: Developing a Secure Baseline. Retrieved November 17, 2017. 

  11. Microsoft. (2008, September 10). Using SMB Packet Signing. Retrieved February 7, 2019. 

  12. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. 

  13. Robertson, K. (2015, April 2). Inveigh: Windows PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool. Retrieved March 11, 2019. 

  14. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. 

  15. Nicolas Verdier. (n.d.). Retrieved January 29, 2018. 

  16. SecureAuth. (n.d.). Retrieved January 15, 2019. 

  17. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021. 

  18. Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.