Which technique involves poisoning LLMNR/NBT-NS to capture credentials on a network?

Which technique involves poisoning LLMNR/NBT-NS to capture credentials on a network?

• A. AS-REP Roasting
• B. LLMNR/NBT-NS Poisoning
• C. Pass the Ticket Attack
• D. Syllable Attack

Answer: (B)

LLMNR/NBT-NS poisoning tricks the network’s name resolution flow. When a computer on a local network needs to resolve a host name and DNS isn’t available, it may broadcast requests using Link-Local Multicast Name Resolution or NetBIOS Name Service. An attacker on the same segment can quickly reply to those requests with forged answers, pretending to be the requested host. When the client believes the attacker is the legitimate destination, it will try to authenticate to that host, sending NTLM credentials or hashes over the network. The attacker captures these credentials, which can then be cracked offline or used to access other services, giving a foothold in the network. This is why the option named for poisoning LLMNR/NBT-NS is the correct one. The other techniques involve different attack vectors: AS-REP Roasting targets Kerberos pre-authentication data, not local name-resolution poisoning; Pass the Ticket uses stolen Kerberos tickets to authenticate elsewhere instead of tricking a client into sending credentials; and Syllable Attack isn’t a standard technique related to credential capture via name resolution.

LLMNR/NBT-NS poisoning tricks the network’s name resolution flow. When a computer on a local network needs to resolve a host name and DNS isn’t available, it may broadcast requests using Link-Local Multicast Name Resolution or NetBIOS Name Service. An attacker on the same segment can quickly reply to those requests with forged answers, pretending to be the requested host. When the client believes the attacker is the legitimate destination, it will try to authenticate to that host, sending NTLM credentials or hashes over the network. The attacker captures these credentials, which can then be cracked offline or used to access other services, giving a foothold in the network.

This is why the option named for poisoning LLMNR/NBT-NS is the correct one. The other techniques involve different attack vectors: AS-REP Roasting targets Kerberos pre-authentication data, not local name-resolution poisoning; Pass the Ticket uses stolen Kerberos tickets to authenticate elsewhere instead of tricking a client into sending credentials; and Syllable Attack isn’t a standard technique related to credential capture via name resolution.