👨‍💻 LLMNR Poisoning with Responder.

• LLMNR Poisoning;
- Getting onto the Network (Example for Context);
• LLMNR Poisoning (SMB);
- How Responder works to poison SMB;
- Setting up Responder for the Attack;
- Capturing a User’s Hash with Responder: Mistyped Share;
• LLMNR Poisoning (WPAD);
- How Responder works to poison WPAD;
- Setting up Responder for the Attack;
- Capturing a User’s Hash with Responder: Mistyped URL;
- Why not grab plaintext?
• LLMNR Poisoning (DHCP);
- How Responder works to poison DHCP;
- Setting up Responder for the Attack;
- Capturing the Computer Hash with Responder: DHCP Lease Renewal;
• Cracking NetNTLMv2 Hashes with Hashcat;
• Bonus: CTF’ish Use-Cases for Responder;
- Getting an NetNTLMv2 Hash from MS-SQL (port 1433);
- Getting an NetNTLMv2 Hash from an SSRF Vulnerability;
• Want to stay up to date with the latest hacks?

• In this post we will go over the concept of LLMNR poisoning. To perform LLMNR poisoning we will execute a MITM (man-in-the-middle) attack using a tool called Responder. Using this tool we will see how we can get in-between user requests for SMB, WPAD, and DHCP to gather NetNTLMv2 hashes. After that, we will see how we can crack the NetNTLMv2 hash-type using hashcat.

🧷 https://juggernaut-sec.com/llmnr-poisoning-responder/,

#hashcat #LLMNR #MITM #Responder