Before we go,
I want to show you one more interesting attack that it
can do using the Responder tool.
Sometimes we're not able to crack the user password.
Maybe the person has a really strong password or we
just don't have time to crack it.
So, we can try to relay the hashes to authenticate against another server.
For example, imagine that we have two servers in a network.
In the first server the user sql‑admin‑1 is logged on.
So then we'll perform the same poisoning attack with the Responder,
but instead of cracking the password we'll forward
the NTLM hash to the second server.
And this will allow us to connect to the second
server as we're the sql‑admin‑1 user.
And then, if the user has the same privilege on that server,
we'll get a shell to the second server,
meaning that we can do whatever we want there.
Pretty interesting, right?
The thing to keep in mind is that this attack may not
work in the latest Windows versions,
but it's still worth trying to attack in legacy servers.
So, let's go to Kali Linux and see how to perform this attack.
Awesome, we are back to Kali Linux.
So first, let's go through folder tools inside of the Responder folder.
In here there's a tool called MultiRelay.
And this is the tool that is responsible for relaying the
NTLM credentials to another server.
As you can see, the first argument of this command is your target server,
which means the server that it will try to connect to.
And the second argument is the user that we want to impersonate.
In our case, we want to use the flag ALL so it poisons any user that we can.
For this attack to work we have to find servers in the
network that do not require SMB signing.
For that,
we can use this tool called RunFinger.py to map out the servers in the network.
We just have to run this command with the option ‑i and
the network that we want to scan.
In my case it's 192.168.1.0/24.
So, let's run this command.
Perfect.
As you can see, one of our servers require SMB signing,
which means that we cannot attack it.
But we have two other servers that do not require SMB signing,
so then they're good candidates for this attack.
In this scenario,
I'll select the SQL‑SERVER‑02 as our target, and this will be
the server that it will try to log into.
So, let's run the MultiRelay tool.
I type MultiRelay, then ‑t to define the target IP,
and then ‑u to define the user that I want to impersonate.
In my case, I'm putting ALL so then we're trying to impersonate all the users.
Now let's run this.
Awesome.
Now, we have to run the Responder, which should do the poisoning part.
As you can see, MultiRelay gives us some tips on how we should run Responder.
For example, here it says that we should run Responder with the options r and v.
It also says that this tool uses the ports 80 and 445.
So, we need to ensure Responder will not use these ports too.
So, let's open a new tab to deal with the Responder.
In here, I'll start by editing the Responder configuration file.
In this file, I'll turn off the HTTP and SMB servers.
For that, I just replace the word On by Off in both protocols.
Then, we can save and close the file.
Awesome.
Now attempt to run the Responder.
In here, I'll run Responder exactly as the MultiRelay tool taught us to do.
I type Responder, then ‑I, and the Ethernet port that I'm using,
and then the options rv.
Then Responder is now running.
It is important to note that the HTTP server is now
off and the SMB server is also off.
As you can see,
Responder is waiting for a LLMNR packet and the MultiRelay
tool is waiting for a NTLM hash to relay.
Now, let's go to our SQL‑SERVER‑01.
And this is not our target server.
This is the server that will provide the hashes.
In here I will just misspell the name of a local server.
And that's it.
We can go back to Kali Linux and see what happened.
Here we go.
Take a look.
Just like magic, I have a shell here.
I can even check the user I'm connected to, as well as the IP of the machine.
Pretty cool, right?
In just a few seconds I have a shell to a server.
And even cooler, this shell is compatible with Mimikatz commands.
For example,
let me use this Mimikatz command to dump out the passwords from memory.
Awesome.
Take a look.
There's a lot of information,
but if we scroll to the data we can see that we extracted the
plain text password for the sql‑admin‑1 user.
This password was in memory, and Mimikatz was able to extract that.
And even more,
if we check here we're able to extract the password for
the domain admin that was in memory.
Pretty cool, right?
In less than 5 minutes we went from a known admin user to a domain admin.