Online Demo: LLMNR Poisoning

On June 24, Toreon gave an online seminar on LLMNR poisoning through an online demo.
During this seminar we went into detail on what LLMNR actually is and how a poisoning attack works.

In order to provide a clear understanding on the subject, we showcased a demo of a poisoning attack. The demo starts with the attacker having access to the network and uses a responder to listen for a LLMNR request. A victim searches for one word in a browser search bar, triggering the LLMNR request, resulting in the attacker capturing the hash and proceeding to hack it.

The attacker then ends up sending their commands including malware to the victim’s PC. That malware automatically goes to infect the domain controller as well. In the end we log on to the domain controller to verify the effect of the malware on the domain controller.

If you missed this seminar or would like to take another look at the presentation, you can download the slides and the demo here.