Welcome to our Kali Linux virtual machine.
Before getting started, let me show you the machines that I have in this network.
First, I have the domain controller, which is a Windows server.
Then I have a Windows 10 workstation,
and I even installed the antivirus on it so we can see that
_____ not detected. Then we have two servers.
The first one is the SQL server 1, and then the SQL server 2.
All those machines are in this 192.168.10 network.
Now, back to our Kali Linux,
as you can see on the same network than the other machines,
which is exactly what we need.
To run Responder,
I could simply use the Responder that comes out‑of‑the‑box with Kali Linux.
However, I do like to download the latest version from GitHub,
just to make sure that I'm using the latest attacks.
For that, let me go to my desktop folder,
and then use the common git clone and then the URL for the responder GitHub.
In a few seconds, this git comment will download all the code to our desktop.
Once that's done,
we can enter in the folder and take a look at what is inside there.
In here we have the Responder.py, which is the main file that we need.
If you run this file, we see that is a version 3.0,
which is newer than the one on Kali Linux.
So let's start by checking the Responder help page.
We will see here that we have a lot of options,
and I will leave for you to explore each one of those.
The ones that we use here are the ‑r and ‑f options.
Those two options will allow us to capture the netbios hashes,
as well as fingerprinting the machines that are on network.
So let's run Responder.
For that I'll type Responder, then ‑I, and the name of my network interface,
which is eth0.
And then I'll put it in two flags that I want to use, which is ‑r and ‑f.
And that's it.
All we have to do now is press enter.
As we can see, Responder is now started.
It has all the Poisoners active, including the LLMNR and the NBT‑NS poisoners.
It also has tons of servers running,
which will try to capture credentials for each of those protocols.
As you can see,
Responder is already trying to poison tons of things on my network.
But let's go to our Windows workstation and see how the attack works.
In here, if you go to the search bar and type run hosting,
the work station will send an LLMNR message to the
network asking who is the server.
And note that I don't even need to press enter,
I just have to type something wrong.
Now, let's go back to Responder.
Now, take a look.
A lot of stuff happened in here.
So let's scroll up.
In here, the moment we tried the wrong address,
the Responder got the LLMNR message and poisoned the answer.
In this way, we're able to get a hashes from the work station.
And that was pretty easy, right?
And again,
the work station is fully up to date and has both
Windows Defender and an antivirus enabled.
So now that we have the hash, we can stop the Responder by using ctrl+C.
Awesome.
The hashes are now saved in the Responder database here,
but it's also saved on the logs folder.
In this logs folder,
Responder will create one file for each machine that we attacked.
As you can see, I have one file regarding the SMB hash for the work station.
In this file, we have the NTLM hash for the user.
From here, all we have to do is crack it using a hash cracker.
To do that, first, we need a password list to perform a dictionary attack.
And the good thing about Kali Linux is it already comes
with a few password lists in this folder,
usr/share/wordlists.
In here, I'll use this rockyou password list.
As this file is compressed,
I will uncompress it using the gzip with the option ‑d.
Once the file is uncompressed, we're ready to crack the password.
In here, we can use any hash cracking tool, such as Hashcat or John the Ripper.
For this demo, I'll be using the John the Ripper.
So then I type john, then ‑wordlist, and the path for my password list,
then space,
and the path for the file containing the hashes that Responder created.
Awesome.
That's it.
Now all we have to do is press enter and wait,
and this process may take a while, depending on the size of your password list.
But, I will speed up this video so we can save some time.
Then amazing.
Take a look.
We have the password for the account rreimao.
We see multiple lines because it captures several hashes for the same user.
As you can see,
in less than 10 minutes we were able to get a user's
credentials with the Responder.
Now I can use those credentials anywhere into the main.