WEBVTT 00:00:02.040 --> 00:00:02.640 Hey there. 00:00:02.650 --> 00:00:03.820 Welcome to Pluralsight. 00:00:03.950 --> 00:00:06.830 I'm Ricardo. In this course, you'll learn how to get valid 00:00:06.830 --> 00:00:10.700 credentials using the Responder tool. In here, we'll exploit the 00:00:10.700 --> 00:00:14.540 famous LLMNR attack to post a request and get credentials from 00:00:14.540 --> 00:00:16.160 users on internal network. 00:00:17.140 --> 00:00:20.700 So imagine that you go to your office in the morning, it is 9 AM, 00:00:20.700 --> 00:00:22.750 you get your coffee, and you start to work. 00:00:23.140 --> 00:00:25.870 So then you try to access an internal shared folder. 00:00:26.540 --> 00:00:30.170 Once you try to access it, you note that a misspelled internal share name. 00:00:30.540 --> 00:00:32.850 So then you fix it and it works fine. 00:00:33.340 --> 00:00:35.350 You get access to your shared file server. 00:00:35.940 --> 00:00:36.890 Pretty normal, right? 00:00:37.090 --> 00:00:41.260 Nothing wrong here, except that by now I could have erased all the 00:00:41.260 --> 00:00:45.000 credentials. We want here more details later in this course, but 00:00:45.000 --> 00:00:48.090 basically what happened is that when you typed your wrong address for the 00:00:48.090 --> 00:00:50.260 shared folder, we pretended to be the server. 00:00:50.940 --> 00:00:54.070 Then your computer sent your hash credentials to the attacker, 00:00:54.220 --> 00:00:57.710 which is then is able to crack it and get a plain text password 00:00:57.710 --> 00:01:03.460 and this is called the LLMNR and NBT‑NS poisoning attack. Pretty 00:01:03.460 --> 00:01:06.230 interesting, right? And the scary part is that you would never 00:01:06.230 --> 00:01:07.170 know that this happened. 00:01:08.540 --> 00:01:09.310 In my opinion, 00:01:09.440 --> 00:01:11.870 the best tool to perform this poisoning attack is the 00:01:11.870 --> 00:01:15.560 responder. This tool automates the whole poisoning process 00:01:15.570 --> 00:01:17.160 and supports several protocols. 00:01:18.040 --> 00:01:21.590 Responder was developed by Laurent Gaffie, and thanks to him, 00:01:21.600 --> 00:01:24.160 my job as a Red team specialist is way easier. 00:01:24.740 --> 00:01:28.310 Laurent is an active member of the cybersecurity community and I do 00:01:28.310 --> 00:01:30.650 recommend you checking his blog and his other work. 00:01:31.240 --> 00:01:32.350 So thanks, Laurent. 00:01:33.140 --> 00:01:34.510 According to documentation, 00:01:34.640 --> 00:01:39.940 the responder is an LLMNR, an NBT‑NS, and MDNS poisoner that's able to 00:01:39.940 --> 00:01:44.130 capture hashes and passwords from several protocols, such as SMB, 00:01:44.290 --> 00:01:49.160 Microsoft SQL, HTTP, LDAP, FTP, and much more. 00:01:50.840 --> 00:01:54.630 What I love about responder is that it's fully open source under the GNU 00:01:54.630 --> 00:01:59.360 3 license. You can download the code from GitHub and even customize it if 00:01:59.360 --> 00:02:01.760 you want to. As you've seen this course, 00:02:01.840 --> 00:02:05.710 installing and using responder is really simple, and also, I love 00:02:05.710 --> 00:02:08.789 the fact that the hashes generated by Responder tool are fully 00:02:08.789 --> 00:02:11.060 compatible with Hashcat and John the Ripper. 00:02:11.540 --> 00:02:16.200 And this means that you can easily brute for the hashes offline. And as I 00:02:16.200 --> 00:02:19.800 mentioned in the previous slide, responder supports several protocols such 00:02:19.800 --> 00:02:25.950 as SMB ,FTP, HTTP, Microsoft SQL, and much more. 00:02:26.740 --> 00:02:29.760 And this means that using this poisoning attack, we're able to get 00:02:29.760 --> 00:02:32.850 credentials not only from domain credentials, but also from all 00:02:32.850 --> 00:02:35.350 those protocols, such as FTP and SQL. 00:02:37.440 --> 00:02:40.350 If you're familiar with the Red team kill chain, we can map 00:02:40.350 --> 00:02:43.170 the Responder tool to right after the exploitation phase. 00:02:43.940 --> 00:02:48.150 This means that to use responder, you do need access to the internal network, 00:02:48.160 --> 00:02:51.200 which you may have done by exporting availability or even 00:02:51.200 --> 00:02:52.850 phishing some credentials via email. 00:02:53.940 --> 00:02:55.130 Once you're in the network, 00:02:55.140 --> 00:02:58.860 you can use the Responder tool to escalate privileges and move laterally. 00:02:59.740 --> 00:03:03.370 The idea is getting as much credentials as you can, so then you can 00:03:03.370 --> 00:03:06.440 try to get access to another account or even admin account if 00:03:06.440 --> 00:03:10.410 you're lucky. If we map the techniques that we learn in this course 00:03:10.420 --> 00:03:14.470 to the MITRE ATT&CK framework, we see that we're focusing in one main area, 00:03:14.480 --> 00:03:18.080 which is credential access. Inside of credential 00:03:18.080 --> 00:03:20.090 access, we covered two main techniques. 00:03:20.840 --> 00:03:26.010 The main 1 is the T1557, which is man‑in‑the‑middle. And 00:03:26.010 --> 00:03:28.890 more specific, we'll be covering the same attack called 00:03:28.890 --> 00:03:32.350 LLMNR, NBT‑NS poisoning, and relay, 00:03:32.740 --> 00:03:35.650 and this one is the main technique that responder covers. 00:03:36.640 --> 00:03:39.640 The MITRE ATT&CK framework also map this attack to the 00:03:39.640 --> 00:03:42.850 technique t1040 which is network sniffing. 00:03:43.440 --> 00:03:45.950 And that's because we we're basically listening for LLMNR 00:03:45.950 --> 00:03:48.360 requests and we were poisoning them. 00:03:49.140 --> 00:03:52.260 As you can see, we combine two techniques into one attack. 00:03:53.740 --> 00:03:55.990 But before getting to the technical part of this course, 00:03:56.000 --> 00:03:58.610 I want you to keep in mind that performing this attack without 00:03:58.610 --> 00:04:01.940 authorization is illegal in most of the countries. This means 00:04:01.950 --> 00:04:04.910 that if use this attack in a library on any other place with 00:04:04.910 --> 00:04:07.530 intent of stealing credentials, you may go to jail, 00:04:07.580 --> 00:04:08.660 and that's not cool. 00:04:09.340 --> 00:04:14.250 So it is important to stay legal. First, if you're working on Red team project, 00:04:14.270 --> 00:04:16.610 make sure you have a letter of engagement from the client 00:04:16.769 --> 00:04:19.540 detailing the dates that a test will be executed, as well the 00:04:19.540 --> 00:04:21.070 type of attack that are in scope. 00:04:22.240 --> 00:04:22.690 Also, 00:04:22.700 --> 00:04:26.200 it is important to have a formal document signed by the client detailing 00:04:26.210 --> 00:04:30.060 and authorizing the test that it'll be performing and this if the 00:04:30.060 --> 00:04:33.030 document differentiates a criminal from professional Red team 00:04:33.030 --> 00:04:35.860 specialist. And, as a personal recommendation, 00:04:35.870 --> 00:04:39.960 always consult a client before executing any attack that may impact the network. 00:04:40.740 --> 00:04:43.170 So the bottom line is, don't be a criminal. 00:04:45.240 --> 00:04:46.540 Before we go to our demo, 00:04:46.550 --> 00:04:49.860 I want you to understand how this attack works. And in my opinion, 00:04:49.890 --> 00:04:53.270 the easiest way of understanding a complex concept is using a diagram. 00:04:54.040 --> 00:04:57.620 So what you see on your screen is internal network of Globomantics, 00:04:57.650 --> 00:04:59.860 which is a medium‑sized consultants company. 00:05:00.440 --> 00:05:02.830 It has few services in the data center, an internal 00:05:02.830 --> 00:05:05.360 network in which few users are connected to. 00:05:06.640 --> 00:05:09.160 So imagine you already got access internal network, 00:05:09.640 --> 00:05:12.880 and this could be done by exploring vulnerability, by phishing a user, 00:05:12.890 --> 00:05:15.510 or even if you got physical access to the building and 00:05:15.510 --> 00:05:17.350 plug your laptop on an Ethernet port. 00:05:18.340 --> 00:05:19.630 Once you're inside of the network, 00:05:19.640 --> 00:05:21.760 your computer can listen to all the packets in there. 00:05:22.540 --> 00:05:26.650 So imagine that Bob tried to access a shared folder that does not exist. 00:05:27.340 --> 00:05:29.950 In this case, he misspelled the name of the shared drive. 00:05:30.740 --> 00:05:34.460 So then Bob's computer would try to query the DNS for this host name. 00:05:35.330 --> 00:05:38.870 The DNS would not recognize the host name because of the misspelling. 00:05:39.940 --> 00:05:43.570 So then Bob's computer would send a message to the multicast network 00:05:43.580 --> 00:05:45.970 asking if anyone knows who is the host name, 00:05:46.640 --> 00:05:50.960 and this is sent using the LLMNR or NBT‑NS protocols. 00:05:52.340 --> 00:05:52.730 Then, 00:05:52.740 --> 00:05:55.730 as we're running the Responder tool or machine, we'll see this 00:05:55.730 --> 00:06:00.050 message and answer it saying that we are the server. And right after, 00:06:00.090 --> 00:06:05.240 Responder also sends a message asking for Bob's credentials. As Bob's 00:06:05.240 --> 00:06:09.170 laptop think we're the real server, it sends its hashed NTLM 00:06:09.170 --> 00:06:10.450 credentials to our machine. 00:06:12.040 --> 00:06:14.920 We then can take those hashes offline and crack that 00:06:14.920 --> 00:06:16.660 hash to get a plain text password. 00:06:18.040 --> 00:06:20.050 Pretty cool, right? And, believe it or not, 00:06:20.060 --> 00:06:21.710 this attack has been around for years, 00:06:21.720 --> 00:06:24.670 and it's still one of the most effective attacks in the Red team engagement. 00:06:25.540 --> 00:06:26.340 From my experience, 00:06:26.350 --> 00:06:29.690 I would say that 80% of the company is still having those protocols enabled, 00:06:29.700 --> 00:06:32.170 making it really easy for us to get valid credentials. 00:06:33.940 --> 00:06:36.850 To follow the demos on this course, you need two things. 00:06:37.440 --> 00:06:41.370 The first one is a laptop or a virtual machine with Kali Linux. 00:06:41.740 --> 00:06:44.640 In theory, you can use any Linux distribution you want, 00:06:44.890 --> 00:06:46.770 as long as you install all the pre‑reqs on it. 00:06:47.640 --> 00:06:48.260 However, 00:06:48.270 --> 00:06:51.640 I do like to use Kali Linux because all the dependencies are already 00:06:51.640 --> 00:06:54.950 installed and it already also comes with the responder pre‑installed and 00:06:54.950 --> 00:07:00.660 ready to use. In here, I'm using the Kali Linux version 2020.1, but you 00:07:00.660 --> 00:07:02.450 can use any Kali Linux version you want. 00:07:03.640 --> 00:07:06.970 Also, I do recommend you have an up‑to‑date operational system. 00:07:07.540 --> 00:07:12.670 And for that, just open the terminal and run apt‑get update and apt‑get upgrade. 00:07:14.140 --> 00:07:16.160 Also, if you want to follow a demo, 00:07:16.170 --> 00:07:18.680 I do recommend you having a small lab environment. 00:07:18.810 --> 00:07:21.210 So then you can practice your skills and see how the 00:07:21.210 --> 00:07:22.660 attack works with your own hands. 00:07:23.640 --> 00:07:26.580 In my case, I'm using a Windows 2019 domain, 00:07:26.600 --> 00:07:30.120 including a Windows 2010 domain controller, a Windows 10 00:07:30.120 --> 00:07:32.550 Workstation, and a Windows 2008 server. 00:07:33.340 --> 00:07:35.280 You don't have to have exactly the same machines, 00:07:35.290 --> 00:07:37.840 but I do recommend you have at least domain controller 00:07:37.850 --> 00:07:39.310 and a workstation connect to it. 00:07:40.540 --> 00:07:41.650 So if you're ready, 00:07:41.660 --> 00:07:44.560 let's go through Kali Linux and see how to harvest with some credentials.