Video není dostupné.
Omlouváme se.
Detecting Responder via LLMNR Honey Tasks on User Workstations
Vložit
- čas přidán 18. 08. 2024
- 00:00 - Intro
00:15 - Talking about how the attack works and why NetBIOS/LLMNR should be disabled
01:30 - Running Responder on a linux host and then attempting to browse a file share on a Windows Host and grabbing the Hash
02:45 - Cracking the hashes our computer provided to show how easy it is to steal passwords on a network
04:30 - Showing how we can perform an LLMNR request in PowerShell
06:15 - Combining the Powershell LLMNR Request with our Slack WebMessage hook to send notifications to slack
07:50 - Testing the powershell code out and seeing it send a message to Slack
09:00 - Creating Scheduled Task to run this powershell code every 5 minutes
11:00 - Converting the powershell to powershell friendly (UTF-16LE) Base64
12:30 - Changing our scheduled task to write to EventLogs instead of Slack, which is better networks that have Centralized Logging
18:15 - Showing the schedueld task runs every 5 minutes.
3:52 "This is what alot of junior pentesters would do"
I felt that on a personal level ;-;
Love the cyber deception approach! It is missing in today's cyber industry
Thank you ippsec!
Great content my man, always love these videos that aren't just htb boxes. Keep it up!
Quote of the video "Memory of a gold fish".
Excellent!!!
Very nice
I like your style very much
Superb!!
I made a python script and docker image a couple of months back that does something very similar and can write out to a remote syslog server when it detects responder running. It's all open source if anyone is interested, there is a video demo on my youtube.
Was able to copy and paste the Curl command from the WebHooks example page without any syntax errors. Did this from Android Kali Nethunter. So many tid bits of learning! Will start encoding PowerShell commands. Using quotes without encoding is so problematic. Use GPOs to block LLMNR.
Awesome idea! Do you think you'd need to just place this task on different hosts for each VLAN you want to monitor? Some networks can get really segmented with many broadcast domains. LLMNR GPO will prevent the honeypot requests so you'd have to use a non domain joined computer for each vlan?
Also, What do you generally do about mdns requests. Netbios and llmnr are easy to disable domain wide but as far as I know, the only way to prevent mdns poisoning is to implement inbound host based firewall rules. Is there a specific approach you take when defending against mDNS poisoning?
nice..... I noticed how that the Responded already detected dc03 it probably because of the cached (that you entered previously?).
So going back to some of your prior retired CTF boxes on hackthebox. Trying to work through them at times python has to be used but since python3 is now the default, could you go through a video of how to convert a python 2 script to python3?
he is the definition of a cyber guru
i wish i found him earlier thx @ippsec for solid security approach
If Responder is for junior pentesters, what do senior pentesters use?
Typically I would expect senior Pentesters to not throw their Hail Mary’s right away and poison every request they see. Setup things in capture only, while they test for other specific things and pick their targets carefully.
Hello, do you have a video about cracking hashes?
Hello ippsex, thanks alot fpr what u doin for the community.
Can you build active directory playlist??! From your old videos too, for sake of noob like mehaha.thanks
Resolve-DnsName -LlmnrOnly doesn't work if LLMNR is blocked via GPO (checked in Wireshark).
Great idea though, maybe through a scheduled task we could flip the registry key temporarily until the GPO reapplies the LLMNR block.
Could also just put a non-domain joined machine on the network to do it. Or use Respounder from a raspberry pi or something.
To bypass this detection, can the attacker first just sniff the network for such script running (pattern of every few minutes asking to resolve same hostname) and block that ip with ufw?
What if it’s every workstation doing it and with random dns names? You’d have to configure responder to only respond to specific things and not any Llmnr request it see’s
I would have to whitelist this task, as I have detections on tasks containing powershell with "nop, enc and b64 starting with JAB" ;)
\o/
Brother IppSec, it would be great if you could add a way to read each piece in text! It can help people like me who don't speak English very well to learn and understand. I wish you luck in life.
CZcams provides auto captions. Works pretty well.
You are running Windows as Administrator there, right?
I mean, an unpriviledged explorer window doesn't just send the Administrator's hash out to the network - does it?! 😳
It sends the hash of the logged in user. I was running as administrator
IppSec = "I have a memory of a gold fish"
ME = 🥲🙃