WEBVTT

00:00:01.740 --> 00:00:02.620
Before we go,

00:00:02.630 --> 00:00:04.730
I want to show you one more interesting attack that it

00:00:04.730 --> 00:00:06.250
can do using the Responder tool.

00:00:06.940 --> 00:00:09.550
Sometimes we're not able to crack the user password.

00:00:09.970 --> 00:00:12.370
Maybe the person has a really strong password or we

00:00:12.370 --> 00:00:13.550
just don't have time to crack it.

00:00:14.300 --> 00:00:17.950
So, we can try to relay the hashes to authenticate against another server.

00:00:18.940 --> 00:00:21.650
For example, imagine that we have two servers in a network.

00:00:22.420 --> 00:00:26.050
In the first server the user sql‑admin‑1 is logged on.

00:00:26.730 --> 00:00:29.840
So then we'll perform the same poisoning attack with the Responder,

00:00:30.170 --> 00:00:32.509
but instead of cracking the password we'll forward

00:00:32.509 --> 00:00:34.950
the NTLM hash to the second server.

00:00:35.810 --> 00:00:38.170
And this will allow us to connect to the second

00:00:38.170 --> 00:00:40.850
server as we're the sql‑admin‑1 user.

00:00:41.500 --> 00:00:44.290
And then, if the user has the same privilege on that server,

00:00:44.380 --> 00:00:46.150
we'll get a shell to the second server,

00:00:46.410 --> 00:00:48.150
meaning that we can do whatever we want there.

00:00:48.740 --> 00:00:49.710
Pretty interesting, right?

00:00:50.120 --> 00:00:52.300
The thing to keep in mind is that this attack may not

00:00:52.300 --> 00:00:54.020
work in the latest Windows versions,

00:00:54.100 --> 00:00:56.390
but it's still worth trying to attack in legacy servers.

00:00:56.940 --> 00:01:00.150
So, let's go to Kali Linux and see how to perform this attack.

00:01:02.040 --> 00:01:03.550
Awesome, we are back to Kali Linux.

00:01:04.090 --> 00:01:07.750
So first, let's go through folder tools inside of the Responder folder.

00:01:08.420 --> 00:01:11.000
In here there's a tool called MultiRelay.

00:01:11.540 --> 00:01:13.610
And this is the tool that is responsible for relaying the

00:01:13.620 --> 00:01:15.750
NTLM credentials to another server.

00:01:16.870 --> 00:01:20.340
As you can see, the first argument of this command is your target server,

00:01:20.430 --> 00:01:22.890
which means the server that it will try to connect to.

00:01:23.630 --> 00:01:26.420
And the second argument is the user that we want to impersonate.

00:01:27.040 --> 00:01:31.550
In our case, we want to use the flag ALL so it poisons any user that we can.

00:01:32.940 --> 00:01:35.380
For this attack to work we have to find servers in the

00:01:35.380 --> 00:01:37.850
network that do not require SMB signing.

00:01:38.640 --> 00:01:39.150
For that,

00:01:39.160 --> 00:01:43.850
we can use this tool called RunFinger.py to map out the servers in the network.

00:01:44.240 --> 00:01:47.770
We just have to run this command with the option ‑i and

00:01:47.770 --> 00:01:49.240
the network that we want to scan.

00:01:49.820 --> 00:01:55.250
In my case it's 192.168.1.0/24.

00:01:56.220 --> 00:01:57.450
So, let's run this command.

00:02:00.340 --> 00:02:00.860
Perfect.

00:02:00.870 --> 00:02:04.230
As you can see, one of our servers require SMB signing,

00:02:04.310 --> 00:02:05.800
which means that we cannot attack it.

00:02:06.240 --> 00:02:09.870
But we have two other servers that do not require SMB signing,

00:02:10.020 --> 00:02:12.300
so then they're good candidates for this attack.

00:02:13.410 --> 00:02:14.180
In this scenario,

00:02:14.280 --> 00:02:18.870
I'll select the SQL‑SERVER‑02 as our target, and this will be

00:02:18.870 --> 00:02:20.520
the server that it will try to log into.

00:02:21.740 --> 00:02:23.970
So, let's run the MultiRelay tool.

00:02:24.540 --> 00:02:29.750
I type MultiRelay, then ‑t to define the target IP,

00:02:30.440 --> 00:02:33.630
and then ‑u to define the user that I want to impersonate.

00:02:34.300 --> 00:02:38.550
In my case, I'm putting ALL so then we're trying to impersonate all the users.

00:02:39.740 --> 00:02:40.780
Now let's run this.

00:02:42.940 --> 00:02:43.430
Awesome.

00:02:43.740 --> 00:02:47.100
Now, we have to run the Responder, which should do the poisoning part.

00:02:48.010 --> 00:02:52.250
As you can see, MultiRelay gives us some tips on how we should run Responder.

00:02:52.890 --> 00:02:57.380
For example, here it says that we should run Responder with the options r and v.

00:02:58.240 --> 00:03:02.160
It also says that this tool uses the ports 80 and 445.

00:03:02.430 --> 00:03:05.250
So, we need to ensure Responder will not use these ports too.

00:03:06.140 --> 00:03:08.950
So, let's open a new tab to deal with the Responder.

00:03:09.940 --> 00:03:13.150
In here, I'll start by editing the Responder configuration file.

00:03:14.720 --> 00:03:18.550
In this file, I'll turn off the HTTP and SMB servers.

00:03:19.240 --> 00:03:23.750
For that, I just replace the word On by Off in both protocols.

00:03:25.080 --> 00:03:26.850
Then, we can save and close the file.

00:03:27.940 --> 00:03:28.410
Awesome.

00:03:28.530 --> 00:03:30.250
Now attempt to run the Responder.

00:03:30.840 --> 00:03:34.850
In here, I'll run Responder exactly as the MultiRelay tool taught us to do.

00:03:35.540 --> 00:03:40.750
I type Responder, then ‑I, and the Ethernet port that I'm using,

00:03:41.340 --> 00:03:43.560
and then the options rv.

00:03:45.180 --> 00:03:46.900
Then Responder is now running.

00:03:47.120 --> 00:03:49.690
It is important to note that the HTTP server is now

00:03:49.690 --> 00:03:52.150
off and the SMB server is also off.

00:03:53.240 --> 00:03:53.890
As you can see,

00:03:53.980 --> 00:03:57.430
Responder is waiting for a LLMNR packet and the MultiRelay

00:03:57.430 --> 00:04:00.250
tool is waiting for a NTLM hash to relay.

00:04:01.440 --> 00:04:03.510
Now, let's go to our SQL‑SERVER‑01.

00:04:04.240 --> 00:04:06.310
And this is not our target server.

00:04:06.510 --> 00:04:08.650
This is the server that will provide the hashes.

00:04:09.370 --> 00:04:12.250
In here I will just misspell the name of a local server.

00:04:13.140 --> 00:04:13.730
And that's it.

00:04:13.850 --> 00:04:16.050
We can go back to Kali Linux and see what happened.

00:04:17.940 --> 00:04:18.380
Here we go.

00:04:18.380 --> 00:04:18.890
Take a look.

00:04:19.149 --> 00:04:21.050
Just like magic, I have a shell here.

00:04:21.490 --> 00:04:24.950
I can even check the user I'm connected to, as well as the IP of the machine.

00:04:25.610 --> 00:04:26.370
Pretty cool, right?

00:04:26.510 --> 00:04:28.850
In just a few seconds I have a shell to a server.

00:04:29.740 --> 00:04:33.110
And even cooler, this shell is compatible with Mimikatz commands.

00:04:33.420 --> 00:04:33.980
For example,

00:04:34.050 --> 00:04:37.850
let me use this Mimikatz command to dump out the passwords from memory.

00:04:41.740 --> 00:04:42.070
Awesome.

00:04:42.070 --> 00:04:42.620
Take a look.

00:04:42.630 --> 00:04:43.770
There's a lot of information,

00:04:43.970 --> 00:04:46.710
but if we scroll to the data we can see that we extracted the

00:04:46.710 --> 00:04:49.750
plain text password for the sql‑admin‑1 user.

00:04:50.980 --> 00:04:54.350
This password was in memory, and Mimikatz was able to extract that.

00:04:55.200 --> 00:04:55.860
And even more,

00:04:55.870 --> 00:04:58.590
if we check here we're able to extract the password for

00:04:58.590 --> 00:05:00.150
the domain admin that was in memory.

00:05:00.740 --> 00:05:01.500
Pretty cool, right?

00:05:01.690 --> 00:05:05.650
In less than 5 minutes we went from a known admin user to a domain admin.