ADNET-005: LLMNR Disabled by Domain Policy
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- High
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates every Group Policy Object in the domain and inspects the Administrative Templates DnsClient policy. For each GPO it reads: - The Registry.pol file under \\domain\SYSVOL\<domain>\Policies\{GUID}\Machine\Registry.pol - The DWORD value HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast - The GPOs link locations (gPLink) to confirm the policy is linked at the Domain Root or at every OU that contains computer objects - The link enabled flag and enforced flag - The Authenticated Users / Domain Computers entries in the GPOs security filtering so the policy actually applies A passing configuration requires EnableMulticast = 0 in a GPO that is linked and enabled with a scope that covers every workstation and member server. The check also walks the Domain Root and the Computers and workstation OUs and produces the effective resultant value by applying GPO precedence, so a policy that exists but is filtered, disabled, or scoped only to a single OU is reported as a partial fail. As a secondary signal, the check optionally reads the registry on a sample of online computers (HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast) via remote registry or WinRM to confirm the policy applied. NetBIOS over TCP/IP (NBT-NS, UDP 137) and the mDNS service are not in scope for ADNET-005, they are covered by sibling checks in the ADNET category.
Por qué importa
LLMNR poisoning is the most reliable initial-access primitive on a flat AD network. The attacker does not need credentials, does not need a domain account, and does not need to send a single packet to a domain controller. They join the broadcast segment, run Responder in default mode, and within minutes harvest NetNTLMv2 hashes from every user whose machine mistypes a share path, references a stale print server, or autocompletes a non-existent hostname. The harvested hashes are either cracked offline (hashcat mode 5600 against a 14-character password completes overnight on a single GPU for any password that is not random) or relayed in real time with ntlmrelayx to SMB targets that lack SMB signing (ADNET-001), to LDAP without LDAP signing or channel binding (ADNET-002, ADNET-003), to ADCS HTTP enrollment endpoints (ESC8, PetitPotam, CVE-2021-36942), or to MSSQL. A single relayed authentication from a Domain Admin or a privileged service account compromises the target. Because LLMNR is enabled by default on every supported Windows client and server, and because the GPO setting that disables it ships in every modern Windows ADMX template, leaving LLMNR on across the domain is treated by every red team and incident responder as a foregone conclusion that the network will be owned. Disabling LLMNR domain-wide breaks the broadcast leg of name-resolution poisoning and forces the attacker to fall back to NBT-NS or mDNS, both of which are covered by sibling checks and are easier to monitor.
Ruta de ataque
1. The attacker gains a foothold on the local LAN (rogue device, compromised workstation, evil-twin Wi-Fi, or a contractor laptop). No domain credentials are required. 2. They start Responder.py with default settings: responder -I eth0 -wrf. LLMNR, NBT-NS, and MDNS poisoners are on by default. 3. A victim workstation issues a single-label name request that DNS does not resolve (a mistyped share, a stale GPP drive map, a print server that no longer exists, browser proxy autodetection through wpad). The Windows client broadcasts an LLMNR query on UDP 5355. 4. Responder answers with its own IP. The victim opens an SMB or HTTP session to the attacker, and Windows automatically sends the users NetNTLMv2 challenge-response. 5. Offline path: Responder writes the hash to /usr/share/responder/logs/. The attacker runs hashcat -m 5600 hashes.txt rockyou.txt -r OneRuleToRuleThemAll.rule and recovers cleartext passwords for the weakest accounts in minutes. 6. Relay path: instead of cracking, the attacker pipes the authentication into impackets ntlmrelayx (ntlmrelayx.py -tf targets.txt -smb2support). The relay lands on any reachable host that does not enforce SMB signing, granting code execution as the relayed user. If the relay lands on an ADCS HTTP enrollment endpoint, the attacker requests a certificate as the victim and converts it into a TGT (PKINIT) for full impersonation (ESC8). 7. Coercion combo: the attacker pairs LLMNR poisoning with PetitPotam (MS-EFSRPC) or PrinterBug (MS-RPRN) coercion against a Domain Controller, relays the DC machine account to ADCS HTTPS, and pulls a DC certificate. This is the canonical unauthenticated-to-Domain-Admin chain on networks where LLMNR (or any other coercion-friendly path) is still alive. 8. Persistence: once Domain Admin equivalence is achieved, the attacker drops Golden Ticket / Silver Ticket persistence (krbtgt hash via DCSync) and the original LLMNR poison is no longer needed.
Cómo lo evalúa Guerrilla
Guerrilla resolves the Default Domain Policy GUID (31B2F340-016D-11D2-945F-00C04FB984F9) and every other linked GPO via Get-GPO -All, then reads each Registry.pol from \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\Registry.pol using Parse-PolFile (or the equivalent .NET binary reader). For each GPO it looks for the value HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast and reports the value, the GPO that sets it, the link locations, and the link state. The check walks every container with a gPLink attribute to compute precedence so a policy that is overridden by an OU-level GPO setting EnableMulticast = 1 surfaces as a fail even if the Default Domain Policy sets it to 0. The optional live-validation pass uses Test-NetConnection plus Get-ItemProperty against a configurable sample of online computers to confirm the effective registry value matches the policy. Output includes the GPO display name and GUID, the policy state (Enabled / Disabled / NotConfigured), the scoped containers, the effective registry value, and any computer sampled where the live value disagrees with the policy.
Valor recomendado
Default Domain Policy enables 'Turn off multicast name resolution' (DnsClient policy EnableMulticast = 0)
Remediación
Edit the Default Domain Policy: Computer Configuration > Policies > Administrative Templates > Network > DNS Client > 'Turn off multicast name resolution' = Enabled. Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast = 0.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8
- CIS AD Benchmark
- 6.3.1
- MITRE ATT&CK
- T1557.001