ADNET-005: LLMNR deshabilitado por directiva de dominio
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- High
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Link-Local Multicast Name Resolution es un mecanismo de reserva basado en difusión que cualquier host del segmento local puede responder. Responder.py y herramientas similares suplantan la respuesta, recolectan los desafíos-respuesta NTLMv2 y los descifran sin conexión o los retransmiten. Deshabilitar LLMNR en todo el dominio es el refuerzo de estación de trabajo de mayor impacto que puede realizar para una postura frente a pruebas de intrusión internas.
Por qué importa
LLMNR poisoning is the most reliable initial-access primitive on a flat AD network. The attacker does not need credentials, does not need a domain account, and does not need to send a single packet to a domain controller. They join the broadcast segment, run Responder in default mode, and within minutes harvest NetNTLMv2 hashes from every user whose machine mistypes a share path, references a stale print server, or autocompletes a non-existent hostname. The harvested hashes are either cracked offline (hashcat mode 5600 against a 14-character password completes overnight on a single GPU for any password that is not random) or relayed in real time with ntlmrelayx to SMB targets that lack SMB signing (ADNET-001), to LDAP without LDAP signing or channel binding (ADNET-002, ADNET-003), to ADCS HTTP enrollment endpoints (ESC8, PetitPotam, CVE-2021-36942), or to MSSQL. A single relayed authentication from a Domain Admin or a privileged service account compromises the target. Because LLMNR is enabled by default on every supported Windows client and server, and because the GPO setting that disables it ships in every modern Windows ADMX template, leaving LLMNR on across the domain is treated by every red team and incident responder as a foregone conclusion that the network will be owned. Disabling LLMNR domain-wide breaks the broadcast leg of name-resolution poisoning and forces the attacker to fall back to NBT-NS or mDNS, both of which are covered by sibling checks and are easier to monitor.
Ruta de ataque
1. The attacker gains a foothold on the local LAN (rogue device, compromised workstation, evil-twin Wi-Fi, or a contractor laptop). No domain credentials are required. 2. They start Responder.py with default settings: responder -I eth0 -wrf. LLMNR, NBT-NS, and MDNS poisoners are on by default. 3. A victim workstation issues a single-label name request that DNS does not resolve (a mistyped share, a stale GPP drive map, a print server that no longer exists, browser proxy autodetection through wpad). The Windows client broadcasts an LLMNR query on UDP 5355. 4. Responder answers with its own IP. The victim opens an SMB or HTTP session to the attacker, and Windows automatically sends the users NetNTLMv2 challenge-response. 5. Offline path: Responder writes the hash to /usr/share/responder/logs/. The attacker runs hashcat -m 5600 hashes.txt rockyou.txt -r OneRuleToRuleThemAll.rule and recovers cleartext passwords for the weakest accounts in minutes. 6. Relay path: instead of cracking, the attacker pipes the authentication into impackets ntlmrelayx (ntlmrelayx.py -tf targets.txt -smb2support). The relay lands on any reachable host that does not enforce SMB signing, granting code execution as the relayed user. If the relay lands on an ADCS HTTP enrollment endpoint, the attacker requests a certificate as the victim and converts it into a TGT (PKINIT) for full impersonation (ESC8). 7. Coercion combo: the attacker pairs LLMNR poisoning with PetitPotam (MS-EFSRPC) or PrinterBug (MS-RPRN) coercion against a Domain Controller, relays the DC machine account to ADCS HTTPS, and pulls a DC certificate. This is the canonical unauthenticated-to-Domain-Admin chain on networks where LLMNR (or any other coercion-friendly path) is still alive. 8. Persistence: once Domain Admin equivalence is achieved, the attacker drops Golden Ticket / Silver Ticket persistence (krbtgt hash via DCSync) and the original LLMNR poison is no longer needed.
Cómo lo evalúa Guerrilla
Guerrilla resolves the Default Domain Policy GUID (31B2F340-016D-11D2-945F-00C04FB984F9) and every other linked GPO via Get-GPO -All, then reads each Registry.pol from \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\Registry.pol using Parse-PolFile (or the equivalent .NET binary reader). For each GPO it looks for the value HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast and reports the value, the GPO that sets it, the link locations, and the link state. The check walks every container with a gPLink attribute to compute precedence so a policy that is overridden by an OU-level GPO setting EnableMulticast = 1 surfaces as a fail even if the Default Domain Policy sets it to 0. The optional live-validation pass uses Test-NetConnection plus Get-ItemProperty against a configurable sample of online computers to confirm the effective registry value matches the policy. Output includes the GPO display name and GUID, the policy state (Enabled / Disabled / NotConfigured), the scoped containers, the effective registry value, and any computer sampled where the live value disagrees with the policy.
Valor recomendado
La directiva Default Domain Policy habilita 'Desactivar la resolución de nombres de multidifusión' (directiva DnsClient EnableMulticast = 0)
Remediación
Edite la directiva Default Domain Policy: Configuración del equipo > Directivas > Plantillas administrativas > Red > Cliente DNS > 'Desactivar la resolución de nombres de multidifusión' = Habilitado. Registro: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast = 0.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8
- CIS AD Benchmark
- 6.3.1
- MITRE ATT&CK
- T1557.001