[HIGH] LLMNR enabled on hosts — vulnerable to MITM/credential harvesting #32

New issue

Open

opened 2026-05-05 17:51:43 -05:00 by pjennings · 0 comments

pjennings commented

2026-05-05 17:51:43 -05:00

Owner

Description

Link-Local Multicast Name Resolution (LLMNR) is enabled on ai1/cortex (10.1.11.9), listening on port 5355/udp.

Finding Details

Host: ai1/cortex (10.1.11.9)
Port: 5355/udp
Service: systemd-resolved (LLMNR)
Discovered by: nmap network scan (2026-05-05)

Risk

LLMNR is a legacy name resolution protocol that can be exploited for:

MITM attacks — tools like Responder can poison LLMNR responses
Credential harvesting — NTLM relay attacks via LLMNR
Network reconnaissance — reveals host information

Recommendation

Disable LLMNR on all hosts — DNS and mDNS are sufficient for name resolution.

NixOS Configuration

services.resolved = {
  enable = true;
  llmnr = "false"; # Disable LLMNR
  # Keep mDNS if needed for local discovery
  mdns = "resolve"; 
};

Or via systemd-resolved config:

[Resolve]
LLMNR=no
MDNS=resolve

References

Microsoft LLMNR Deprecation
Responder Tool
Related: docs/network-scan-2026-05-05.md (Finding F6)

## Description Link-Local Multicast Name Resolution (LLMNR) is enabled on ai1/cortex (10.1.11.9), listening on port 5355/udp. ## Finding Details - **Host:** ai1/cortex (10.1.11.9) - **Port:** 5355/udp - **Service:** systemd-resolved (LLMNR) - **Discovered by:** nmap network scan (2026-05-05) ## Risk LLMNR is a legacy name resolution protocol that can be exploited for: - **MITM attacks** — tools like Responder can poison LLMNR responses - **Credential harvesting** — NTLM relay attacks via LLMNR - **Network reconnaissance** — reveals host information ## Recommendation Disable LLMNR on all hosts — DNS and mDNS are sufficient for name resolution. ### NixOS Configuration ```nix services.resolved = { enable = true; llmnr = "false"; # Disable LLMNR # Keep mDNS if needed for local discovery mdns = "resolve"; }; ``` Or via systemd-resolved config: ```ini [Resolve] LLMNR=no MDNS=resolve ``` ## References - [Microsoft LLMNR Deprecation](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2022-r2/dd197552(v=ws.10)) - [Responder Tool](https://github.com/lgandx/Responder) - Related: docs/network-scan-2026-05-05.md (Finding F6)