Detecting Responder via LLMNR Honey Tasks on User Workstations

Name: Detecting Responder via LLMNR Honey Tasks on User Workstations
Uploaded: 2022-09-19T14:34:02Z
Channel: IppSec
Description: 00:00 - Intro 00:15 - Talking about how the attack works and why NetBIOS/LLMNR should be disabled 01:30 - Running Responder on a linux host and then att...

IppSec · Beginner ·🧠 Large Language Models ·3y ago

00:00 - Intro 00:15 - Talking about how the attack works and why NetBIOS/LLMNR should be disabled 01:30 - Running Responder on a linux host and then attempting to browse a file share on a Windows Host and grabbing the Hash 02:45 - Cracking the hashes our computer provided to show how easy it is to steal passwords on a network 04:30 - Showing how we can perform an LLMNR request in PowerShell 06:15 - Combining the Powershell LLMNR Request with our Slack WebMessage hook to send notifications to slack 07:50 - Testing the powershell code out and seeing it send a message to Slack 09:00 - Creating Sc…

Watch on YouTube ↗ (saves to browser)

Chapters (11)

Intro

0:15 Talking about how the attack works and why NetBIOS/LLMNR should be disabled

1:30 Running Responder on a linux host and then attempting to browse a file share o

2:45 Cracking the hashes our computer provided to show how easy it is to steal pass

4:30 Showing how we can perform an LLMNR request in PowerShell

6:15 Combining the Powershell LLMNR Request with our Slack WebMessage hook to send

7:50 Testing the powershell code out and seeing it send a message to Slack

9:00 Creating Scheduled Task to run this powershell code every 5 minutes

11:00 Converting the powershell to powershell friendly (UTF-16LE) Base64

12:30 Changing our scheduled task to write to EventLogs instead of Slack, which is b

18:15 Showing the schedueld task runs every 5 minutes.

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →