WEBVTT

00:00:01.400 --> 00:00:03.630
Welcome to our Kali Linux virtual machine.

00:00:03.960 --> 00:00:07.350
Before getting started, let me show you the machines that I have in this network.

00:00:08.189 --> 00:00:11.250
First, I have the domain controller, which is a Windows server.

00:00:12.210 --> 00:00:14.550
Then I have a Windows 10 workstation,

00:00:15.190 --> 00:00:17.810
and I even installed the antivirus on it so we can see that

00:00:17.810 --> 00:00:21.880
_____ not detected. Then we have two servers.

00:00:22.110 --> 00:00:26.860
The first one is the SQL server 1, and then the SQL server 2.

00:00:26.860 --> 00:00:32.650
All those machines are in this 192.168.10 network.

00:00:33.790 --> 00:00:35.350
Now, back to our Kali Linux,

00:00:36.440 --> 00:00:39.120
as you can see on the same network than the other machines,

00:00:39.130 --> 00:00:40.450
which is exactly what we need.

00:00:41.480 --> 00:00:42.500
To run Responder,

00:00:42.570 --> 00:00:46.150
I could simply use the Responder that comes out‑of‑the‑box with Kali Linux.

00:00:46.740 --> 00:00:49.840
However, I do like to download the latest version from GitHub,

00:00:50.010 --> 00:00:52.150
just to make sure that I'm using the latest attacks.

00:00:52.880 --> 00:00:55.150
For that, let me go to my desktop folder,

00:00:56.730 --> 00:01:01.960
and then use the common git clone and then the URL for the responder GitHub.

00:01:01.960 --> 00:01:07.230
In a few seconds, this git comment will download all the code to our desktop.

00:01:08.200 --> 00:01:09.040
Once that's done,

00:01:09.110 --> 00:01:12.050
we can enter in the folder and take a look at what is inside there.

00:01:13.820 --> 00:01:18.250
In here we have the Responder.py, which is the main file that we need.

00:01:19.040 --> 00:01:22.330
If you run this file, we see that is a version 3.0,

00:01:22.370 --> 00:01:24.450
which is newer than the one on Kali Linux.

00:01:25.400 --> 00:01:27.850
So let's start by checking the Responder help page.

00:01:28.340 --> 00:01:30.560
We will see here that we have a lot of options,

00:01:30.790 --> 00:01:32.950
and I will leave for you to explore each one of those.

00:01:33.690 --> 00:01:37.150
The ones that we use here are the ‑r and ‑f options.

00:01:37.740 --> 00:01:41.180
Those two options will allow us to capture the netbios hashes,

00:01:41.270 --> 00:01:43.600
as well as fingerprinting the machines that are on network.

00:01:44.640 --> 00:01:46.150
So let's run Responder.

00:01:46.710 --> 00:01:53.920
For that I'll type Responder, then ‑I, and the name of my network interface,

00:01:54.190 --> 00:01:55.850
which is eth0.

00:01:56.790 --> 00:02:01.310
And then I'll put it in two flags that I want to use, which is ‑r and ‑f.

00:02:02.790 --> 00:02:03.350
And that's it.

00:02:03.940 --> 00:02:05.550
All we have to do now is press enter.

00:02:06.920 --> 00:02:09.009
As we can see, Responder is now started.

00:02:09.440 --> 00:02:14.550
It has all the Poisoners active, including the LLMNR and the NBT‑NS poisoners.

00:02:15.430 --> 00:02:17.260
It also has tons of servers running,

00:02:17.270 --> 00:02:20.380
which will try to capture credentials for each of those protocols.

00:02:21.610 --> 00:02:22.290
As you can see,

00:02:22.440 --> 00:02:25.280
Responder is already trying to poison tons of things on my network.

00:02:25.670 --> 00:02:29.810
But let's go to our Windows workstation and see how the attack works.

00:02:29.810 --> 00:02:33.750
In here, if you go to the search bar and type run hosting,

00:02:34.140 --> 00:02:36.550
the work station will send an LLMNR message to the

00:02:36.550 --> 00:02:38.960
network asking who is the server.

00:02:38.960 --> 00:02:41.320
And note that I don't even need to press enter,

00:02:41.540 --> 00:02:43.050
I just have to type something wrong.

00:02:44.340 --> 00:02:45.950
Now, let's go back to Responder.

00:02:47.340 --> 00:02:48.110
Now, take a look.

00:02:48.180 --> 00:02:49.480
A lot of stuff happened in here.

00:02:49.680 --> 00:02:50.750
So let's scroll up.

00:02:52.040 --> 00:02:54.400
In here, the moment we tried the wrong address,

00:02:54.530 --> 00:02:58.050
the Responder got the LLMNR message and poisoned the answer.

00:02:58.870 --> 00:03:01.650
In this way, we're able to get a hashes from the work station.

00:03:02.310 --> 00:03:03.360
And that was pretty easy, right?

00:03:03.610 --> 00:03:04.140
And again,

00:03:04.260 --> 00:03:06.900
the work station is fully up to date and has both

00:03:06.900 --> 00:03:09.050
Windows Defender and an antivirus enabled.

00:03:10.040 --> 00:03:13.860
So now that we have the hash, we can stop the Responder by using ctrl+C.

00:03:13.860 --> 00:03:16.100
Awesome.

00:03:16.280 --> 00:03:18.950
The hashes are now saved in the Responder database here,

00:03:19.440 --> 00:03:21.750
but it's also saved on the logs folder.

00:03:22.940 --> 00:03:23.920
In this logs folder,

00:03:24.050 --> 00:03:27.250
Responder will create one file for each machine that we attacked.

00:03:27.870 --> 00:03:31.950
As you can see, I have one file regarding the SMB hash for the work station.

00:03:32.850 --> 00:03:35.850
In this file, we have the NTLM hash for the user.

00:03:36.790 --> 00:03:40.150
From here, all we have to do is crack it using a hash cracker.

00:03:40.790 --> 00:03:44.650
To do that, first, we need a password list to perform a dictionary attack.

00:03:45.380 --> 00:03:47.920
And the good thing about Kali Linux is it already comes

00:03:47.920 --> 00:03:49.960
with a few password lists in this folder,

00:03:49.960 --> 00:03:52.150
usr/share/wordlists.

00:03:53.190 --> 00:03:55.670
In here, I'll use this rockyou password list.

00:03:56.510 --> 00:03:57.790
As this file is compressed,

00:03:57.850 --> 00:04:01.210
I will uncompress it using the gzip with the option ‑d.

00:04:04.140 --> 00:04:07.150
Once the file is uncompressed, we're ready to crack the password.

00:04:08.440 --> 00:04:13.150
In here, we can use any hash cracking tool, such as Hashcat or John the Ripper.

00:04:13.740 --> 00:04:16.050
For this demo, I'll be using the John the Ripper.

00:04:16.519 --> 00:04:22.960
So then I type john, then ‑wordlist, and the path for my password list,

00:04:22.960 --> 00:04:24.630
then space,

00:04:24.660 --> 00:04:28.250
and the path for the file containing the hashes that Responder created.

00:04:29.640 --> 00:04:30.090
Awesome.

00:04:30.140 --> 00:04:30.650
That's it.

00:04:31.040 --> 00:04:33.250
Now all we have to do is press enter and wait,

00:04:34.240 --> 00:04:37.520
and this process may take a while, depending on the size of your password list.

00:04:37.880 --> 00:04:40.450
But, I will speed up this video so we can save some time.

00:04:43.560 --> 00:04:44.390
Then amazing.

00:04:44.390 --> 00:04:44.870
Take a look.

00:04:44.970 --> 00:04:46.780
We have the password for the account rreimao.

00:04:47.430 --> 00:04:50.950
We see multiple lines because it captures several hashes for the same user.

00:04:51.610 --> 00:04:52.240
As you can see,

00:04:52.350 --> 00:04:54.210
in less than 10 minutes we were able to get a user's

00:04:54.210 --> 00:04:55.560
credentials with the Responder.

00:04:55.940 --> 00:04:58.360
Now I can use those credentials anywhere into the main.