top of page
Writer's pictureTenaka

Disable LLMNR, IPv6 and Other Network Services

The following tweaks are for disabling network features that are either legacy but still enabled or not required.

Each setting can be applied by running an elevated PowerShell directly or deployed from MDT or ConfigMgr.


<# .Synopsis

.Description

If IPv6 isnt deployed on the network should be disabled correctly via the Registry and not by unchecking the IPv6 component in network connections.

.Version

#>

#Disable IPv6 by setting 0xff, do not set fffffff as it slows down bootup

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters' -Name DisabledComponents -PropertyType DWORD -Value 0xff -Force

<# .Synopsis

Disable LLMNR

.Description

LLMNR or Responder should be actively disabled as it broadcasts the password hash and account name of the user or service account. Open Run and type '\\server\share' as this is very unlikely to exist the client will query the network by broadcasting on port 5355 containing your account with the password hash. Kali running Responder will pick this up and feed it into 'John the Ripper',

Block ports TCP\UDP 5355 both InBound and OutBound

Or set 'Turn on Responder (RSPNDR) Driver' to 'Disable' in GPO 'Computer > Policies > Administrative Templates > Network > Link-Layer Topology Discovery'

.Version

#>

#Disabled LLMNR

New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT" -Name DNSClient -ForceNew-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name EnableMultiCast -Value 0 -PropertyType DWORD -Force


<# .Synopsis

Disable both LMHosts and NetBios

.Description

LMHosts is the legacy file used for name resolution.

NetBios is often enabled by default on Windows system but is legacy for SMB and Printer traffic, it can be abused leading to the system being exploited.


Port 139 is used by Nbtstat to query for Windows devices.

Block ports UDP 137-138 both InBound and OutBound

Block ports TCP 139 both InBound and OutBound

.Version

#>

#Disable LMHOSTS File in Network Settings $lmhost = @{ { DNSEnabledForWINSResolution = $false WINSEnableLMHostsLookup = $false } Invoke-CimMethod -ClassName win32_networkadapterconfiguration -methodName enableWins -Arguments $lmhost


#Disable NetBios in Network Settings

$netbios = Get-ChildItem -Recurse "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces" | where {$_.property -eq "NetBiosOptions"}

foreach ($op in $netbios) { cd hklm:

$opPath = $op.Name.Replace("HKEY_LOCAL_MACHINE","HKLM:") Set-ItemProperty $opPath -name NetBiosOptions -Value 2 -Force

}

<# .Synopsis

Disable Universal Plug and Play for network devices

.Description

uPnP allows devices to discover and share data with other network devices, there is a small risk of this service being abused. Its a small but potential risk, more importantly it's a service that isn't needed, so it's disabled

Block port TCP 5000 Inbound

Block port UDP 1901 Inbound

Stopping 'UPnP Device Host' Windows Service

.Version

#>

#Disable uPnP (Network Discovery)

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" -name AllowLLTDIOOnDomain -Value 0 -Force Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" -name AllowLLTDIOOnPublicNet -Value 0 -Force Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" -name AllowRspndrOnDomain -Value 0 -Force Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" -name AllowRspndrOnPublicNet -Value 0 -Force Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" -name EnableLLTDIO -Value 0 -Force Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" -name EnableRspndr -Value 0 -Force Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" -name ProhibitLLTDIOOnPrivateNet -Value 1 -Force Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" -name ProhibitRspndrOnPrivateNet -Value 1 -Force


38 views0 comments

Comments

Rated 0 out of 5 stars.
No ratings yet

Add a rating
bottom of page