Michael.mast: Created page with "==Purpose== We already know that anything legacy and unsupported should be removed. But recently I learned about LLMNR from an article titled "Gain domain admin from outside a..."

2018-03-12T17:35:10Z

Created page with "==Purpose== We already know that anything legacy and unsupported should be removed. But recently I learned about LLMNR from an article titled "Gain domain admin from outside a..."

New page

==Purpose==
We already know that anything legacy and unsupported should be removed. But recently I learned about LLMNR from an article titled "Gain domain admin from outside active directory".<ref>https://markitzeroday.com/pass-the-hash/crack-map-exec/2018/03/04/da-from-outside-the-domain.html?lipi=urn%3Ali%3Apage%3Ad_flagship3_profile_view_base_recent_activity_details_all%3B512zHgY%2FSL6oMdonsOyiHQ%3D%3D</ref> Yet another dangerous service enabled by default. Though my ignorance is showing since I have seen LLMNR in action when looking through packet captures. I thought it was a little odd systems would ask each other for domain names, but I had to troublehsoot a SIP issue damnit!
 
 
Regardless, it seemed to be a good idea to disable these features in an environment with strong DNS.

==LLMNR==
This one is simple using either LGPO or a domain controller.
<ref>http://woshub.com/how-to-disable-netbios-over-tcpip-and-llmnr-using-gpo/</ref>
Computer Configuration -> Administrative Templates -> Network -> DNS Client
 
Enable "Turn Off Multicast Name Resolution"
==NetBIOS==
Of course Microsoft would be a pain and not have an explicit policy for NetBIOS. Yet they leave it enabled bu default on their operating systems....
 
 
A startup script with the following appears to do the trick<ref>https://www.youtube.com/watch?v=1Dm87ivLXr0</ref>
<pre>
wmic nicconfig where (TcpipNetbiosOptions!=Null and TcpipNetbiosOptions!=2) call SetTcpipNetbios 2
</pre>

Disable LLMNR and NetBIOS using GPO - Revision history

Michael.mast: Created page with "==Purpose== We already know that anything legacy and unsupported should be removed. But recently I learned about LLMNR from an article titled "Gain domain admin from outside a..."