Hey there.
Welcome to Pluralsight.
I'm Ricardo. In this course, you'll learn how to get valid
credentials using the Responder tool. In here, we'll exploit the
famous LLMNR attack to post a request and get credentials from
users on internal network.
So imagine that you go to your office in the morning, it is 9 AM,
you get your coffee, and you start to work.
So then you try to access an internal shared folder.
Once you try to access it, you note that a misspelled internal share name.
So then you fix it and it works fine.
You get access to your shared file server.
Pretty normal, right?
Nothing wrong here, except that by now I could have erased all the
credentials. We want here more details later in this course, but
basically what happened is that when you typed your wrong address for the
shared folder, we pretended to be the server.
Then your computer sent your hash credentials to the attacker,
which is then is able to crack it and get a plain text password
and this is called the LLMNR and NBT‑NS poisoning attack. Pretty
interesting, right? And the scary part is that you would never
know that this happened.
In my opinion,
the best tool to perform this poisoning attack is the
responder. This tool automates the whole poisoning process
and supports several protocols.
Responder was developed by Laurent Gaffie, and thanks to him,
my job as a Red team specialist is way easier.
Laurent is an active member of the cybersecurity community and I do
recommend you checking his blog and his other work.
So thanks, Laurent.
According to documentation,
the responder is an LLMNR, an NBT‑NS, and MDNS poisoner that's able to
capture hashes and passwords from several protocols, such as SMB,
Microsoft SQL, HTTP, LDAP, FTP, and much more.
What I love about responder is that it's fully open source under the GNU
3 license. You can download the code from GitHub and even customize it if
you want to. As you've seen this course,
installing and using responder is really simple, and also, I love
the fact that the hashes generated by Responder tool are fully
compatible with Hashcat and John the Ripper.
And this means that you can easily brute for the hashes offline. And as I
mentioned in the previous slide, responder supports several protocols such
as SMB ,FTP, HTTP, Microsoft SQL, and much more.
And this means that using this poisoning attack, we're able to get
credentials not only from domain credentials, but also from all
those protocols, such as FTP and SQL.
If you're familiar with the Red team kill chain, we can map
the Responder tool to right after the exploitation phase.
This means that to use responder, you do need access to the internal network,
which you may have done by exporting availability or even
phishing some credentials via email.
Once you're in the network,
you can use the Responder tool to escalate privileges and move laterally.
The idea is getting as much credentials as you can, so then you can
try to get access to another account or even admin account if
you're lucky. If we map the techniques that we learn in this course
to the MITRE ATT&CK framework, we see that we're focusing in one main area,
which is credential access. Inside of credential
access, we covered two main techniques.
The main 1 is the T1557, which is man‑in‑the‑middle. And
more specific, we'll be covering the same attack called
LLMNR, NBT‑NS poisoning, and relay,
and this one is the main technique that responder covers.
The MITRE ATT&CK framework also map this attack to the
technique t1040 which is network sniffing.
And that's because we we're basically listening for LLMNR
requests and we were poisoning them.
As you can see, we combine two techniques into one attack.
But before getting to the technical part of this course,
I want you to keep in mind that performing this attack without
authorization is illegal in most of the countries. This means
that if use this attack in a library on any other place with
intent of stealing credentials, you may go to jail,
and that's not cool.
So it is important to stay legal. First, if you're working on Red team project,
make sure you have a letter of engagement from the client
detailing the dates that a test will be executed, as well the
type of attack that are in scope.
Also,
it is important to have a formal document signed by the client detailing
and authorizing the test that it'll be performing and this if the
document differentiates a criminal from professional Red team
specialist. And, as a personal recommendation,
always consult a client before executing any attack that may impact the network.
So the bottom line is, don't be a criminal.
Before we go to our demo,
I want you to understand how this attack works. And in my opinion,
the easiest way of understanding a complex concept is using a diagram.
So what you see on your screen is internal network of Globomantics,
which is a medium‑sized consultants company.
It has few services in the data center, an internal
network in which few users are connected to.
So imagine you already got access internal network,
and this could be done by exploring vulnerability, by phishing a user,
or even if you got physical access to the building and
plug your laptop on an Ethernet port.
Once you're inside of the network,
your computer can listen to all the packets in there.
So imagine that Bob tried to access a shared folder that does not exist.
In this case, he misspelled the name of the shared drive.
So then Bob's computer would try to query the DNS for this host name.
The DNS would not recognize the host name because of the misspelling.
So then Bob's computer would send a message to the multicast network
asking if anyone knows who is the host name,
and this is sent using the LLMNR or NBT‑NS protocols.
Then,
as we're running the Responder tool or machine, we'll see this
message and answer it saying that we are the server. And right after,
Responder also sends a message asking for Bob's credentials. As Bob's
laptop think we're the real server, it sends its hashed NTLM
credentials to our machine.
We then can take those hashes offline and crack that
hash to get a plain text password.
Pretty cool, right? And, believe it or not,
this attack has been around for years,
and it's still one of the most effective attacks in the Red team engagement.
From my experience,
I would say that 80% of the company is still having those protocols enabled,
making it really easy for us to get valid credentials.
To follow the demos on this course, you need two things.
The first one is a laptop or a virtual machine with Kali Linux.
In theory, you can use any Linux distribution you want,
as long as you install all the pre‑reqs on it.
However,
I do like to use Kali Linux because all the dependencies are already
installed and it already also comes with the responder pre‑installed and
ready to use. In here, I'm using the Kali Linux version 2020.1, but you
can use any Kali Linux version you want.
Also, I do recommend you have an up‑to‑date operational system.
And for that, just open the terminal and run apt‑get update and apt‑get upgrade.
Also, if you want to follow a demo,
I do recommend you having a small lab environment.
So then you can practice your skills and see how the
attack works with your own hands.
In my case, I'm using a Windows 2019 domain,
including a Windows 2010 domain controller, a Windows 10
Workstation, and a Windows 2008 server.
You don't have to have exactly the same machines,
but I do recommend you have at least domain controller
and a workstation connect to it.
So if you're ready,
let's go through Kali Linux and see how to harvest with some credentials.