1

I know that LLMNR is the "new version" of NetBIOS and both of them are basically for resolving names to IP addresses

I also know some exploits based on them, like a MiTM attack that the attacker sends a malicious response to the victim when the victim asks the IP address of a machine

But I don't understand their rules in the wannacry attack?

I have a PCAP capture file that I am assuming is doing the WannaCry attack, and In a video I was watching the guy says if you see a lot of llmnr in a capture its a red flag for eternal blue/wannacry

And indeed in this capture there is a LOT of LLMNR, NBSS and NBNS packets, and NetworkMiner says it suspects the eternal blue exploit as well and points to these NBSS packets, but I cant understand the content of them

I see a lot Name Query NB WPAD, Refresh NB and registration NB

also all of the llmnr packets are standard query "a hex number" A or something similar (like A wpad, ANY "a VM name", A isatap)

but I don't understand what they are doing?

can someone ELI5 what is their role in the attack without getting into too much detail?

I watched a lot of videos regarding this but non of them really answered this

Basically What I'm asking is this:

How these protocols are used in the WannaCry attack? why there are a lot of these packets in a pcap file of a network that was attacked by WannaCry?

(I did watch a lot of videos and articles about this attack and about these protocols but i still dont get the connection!)

Improve this question
3
  • The video is wrong. All the LLMNR packets are for WPAD. Wannacry uses SMB. SMB uses NBSS and NBNS. And you can look up what those do on any networking basics site or wikipedia.
    – schroeder ♦
    Commented Oct 8 at 16:34
  • I’m voting to close this question because it is based on a faulty premise.
    – schroeder ♦
    Commented Oct 8 at 16:35
  • I don't understand their rules in the wannacry attack? Why? You say only a few moments later that you don't want too much detail. The real problem is there are too many people that don't detail. That leads to organizations failing due to enabling features such as this that have known critical vulnerabilities. Broadcast name resolution is not needed by a single business or user. Yet it remains one of the most valuable and quickest ways to compromise an organization. That's legendary persistence, where topics like this will still be discussed in 2030...
    – Greg Askew
    Commented Oct 8 at 20:38

1 Answer 1

Reset to default
0

LLMNR is used to help spread the ransomware to other devices within the network. It basically "pings" other devices within the network and attempts to spread to them if they are also vulnerable. I do not know whether it can check whether a device is vulnerable or not, to be honest.

Once spread to that device it starts sending similar packages from there. The best feature of this is that we you disconnect an infected device and connect it to another network, it will start sending the same packages through the new network and start spreading once again.

I do not know much about other packages but one thing not to forget is that WannaCry was constantly attempting to ping an unregistered domain as a backdoor for the attacker (just in case if they accidentally infect themselves) which was how the epidemic was prevented. What I mean is not every package sent needs to be directly connected to the ransomware itself but could be used for hiding, not getting blocked, spreading, etc.

Improve this answer
1
  • And the other traffic? Can you explain how Wannacry used LLMNR since it appears to have used SMB? It propgates by connecting to all IPs in a subdomain. So, where does LLMNR come in? You don't actually explain how it works or answer the question. In fact, I can find zero link between Wannacry and LLMNR Except for this person asking about it (here and on Reddit). And in the video, where all this comes from, the LLMNR is about WPAD, not about Wannacry (even though the video host misinterprets it...). So .... "citation needed".
    – schroeder ♦
    Commented Oct 8 at 16:20

Not the answer you're looking for? Browse other questions tagged .