Analyze network traffic for LLMNR/NBT-NS poisoning attacks using Wireshark to identify the rogue machine, compromised accounts, and affected systems.
Your organization's security team has detected a surge in suspicious network activity. There are concerns that LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) poisoning attacks may be occurring within your network. These attacks are known for exploiting these protocols to intercept network traffic and potentially compromise user credentials. Your task is to investigate the network logs and examine captured network traffic.
Easy - Network Forensics | Completion Achievement
In the lab, we are provided with a .pcap file. Let's progress through this lab.
- In the context of the incident described in the scenario, the attacker initiated their actions by taking advantage of benign network traffic from legitimate machines. Can you identify the specific mistyped query made by the machine with the IP address 192.168.232.162?
Setting up the display filter ip.src == 192.168.232.162, we can see a name query with a potentially mistyped name under the NBNS protocol on packet 47. What follows is a series of LLMNR communications with this mistyped query:
- We are investigating a network security incident. To conduct a thorough investigation, We need to determine the IP address of the rogue machine. What is the IP address of the machine acting as the rogue entity?
After removing the filter, let's look for any responses to the queries done by 192.168.232.162. An IP address has been successfully responding back to the attacker IP address:
- As part of our investigation, identifying all affected machines is essential. What is the IP address of the second machine that received poisoned responses from the rogue machine?
Let's check what other packets has the rogue machine been sending. Using the ip.src == 192.168.232.215 display filter will reveal that the machine communicated with a second IP address afterwards:
- We suspect that user accounts may have been compromised. To assess this, we must determine the username associated with the compromised account. What is the username of the account that the attacker compromised?
Using the same display filter as before and scrolling to the bottom of the packet list, we can find some SMB packets showing a username in cleartext, which corresponds to the compromised account accessed from the rogue machine:
- As part of our investigation, we aim to understand the extent of the attacker's activities. What is the hostname of the machine that the attacker accessed via SMB?
Let's use the smb2 filter to read all SMB traffic. Let's open packet 241 since it is targeting the rouge machine. Opening the packet details > Session Setup Response > Security Blob > gss-api > Simple Protected Negotiation > negTokenTarg > NTLM Secure Service Provider > Target Info will show the computer name that the attacker attempted to access.
