WEBVTT 00:00:01.140 --> 00:00:01.469 All right, 00:00:01.470 --> 00:00:03.490 so let's take advantage of some of the stuff that you've 00:00:03.490 --> 00:00:08.550 learned with the looping passwords around users and perform a 00:00:08.550 --> 00:00:10.540 password spray attack against RDP. 00:00:11.470 --> 00:00:15.070 So a Windows 10 machine that's running Remote Desktop Protocol. 00:00:15.250 --> 00:00:19.510 So let's give that a try here. You've got hydra ‑u so 00:00:19.510 --> 00:00:20.890 that it'll loop around the users. 00:00:21.110 --> 00:00:25.650 And then we've got ‑L for our usernames. 00:00:26.680 --> 00:00:33.670 And then we've got ‑P for a password of Winter2018. Then we've 00:00:33.680 --> 00:00:36.480 got to target by designating the protocol, 00:00:36.480 --> 00:00:45.080 which in this case is rdp:// 192.168.30.131, and then let's give this a try. 00:00:46.940 --> 00:00:54.140 And here we have four users that have the Winter2018 password. 00:00:54.140 --> 00:00:59.307 Let's go ahead and give those a try, or least one of them, Emily Moss at 00:00:59.307 --> 00:01:09.750 rdesktop ‑u for Emily.Moss ‑d for globomantics, the domain ‑p. 00:01:12.410 --> 00:01:15.790 And then a dash so that we're not storing the password in the history. 00:01:17.140 --> 00:01:23.450 And then the target IP, Winter2018. 00:01:29.740 --> 00:01:34.850 And as you can see, we are now logged in through RDP on Emily's machine. 00:01:36.840 --> 00:01:41.450 Hydra allows you to configure your proxy settings so that it will 00:01:41.450 --> 00:01:43.630 route the traffic through a proxy of your choosing. 00:01:44.080 --> 00:01:46.950 Now that's useful for many different things, but in this case 00:01:46.950 --> 00:01:51.340 we're going to leverage it so that we can send it to a local Burp 00:01:51.340 --> 00:01:53.450 Community Edition proxy that's set up. 00:01:53.940 --> 00:02:05.750 So we've got export HYDRA_PROXY_HTTP=http://127.0.0.1:8080. 00:02:06.030 --> 00:02:08.160 So let's go ahead and add that to our environment. 00:02:08.979 --> 00:02:13.970 We can check the environment by grepping it out to 00:02:13.970 --> 00:02:18.410 make sure everything went well, and it's in there as we wanted it to. 00:02:18.410 --> 00:02:19.950 So let's go ahead and clear this out. 00:02:20.640 --> 00:02:30.200 And then I will minimize the terminal here and load up Burp Suite. We can 00:02:30.200 --> 00:02:34.610 use the defaults here just to get started. And the very first thing that 00:02:34.610 --> 00:02:36.760 I'm going to want to do is go into Proxy here, 00:02:37.340 --> 00:02:41.750 turn the Intercept is on to Intercept is off, 00:02:42.440 --> 00:02:48.570 then jump into Options and select the proxy listener, and we'll 00:02:48.570 --> 00:02:54.250 want to edit this. Go to Request handling, 00:02:54.940 --> 00:02:57.250 and then check this box right here, 00:02:57.250 --> 00:03:03.635 Support invisible proxy. And we'll click OK. And then let's go to 00:03:03.635 --> 00:03:09.580 HTTP history, and we'll have to bounce back over to the terminal 00:03:09.820 --> 00:03:11.350 so that we can launch an attack. 00:03:12.840 --> 00:03:13.330 Here we go, 00:03:13.330 --> 00:03:16.440 and we'll do something simple and we'll leverage one of the commands 00:03:16.440 --> 00:03:19.990 that we've already got in here and then modify few things because 00:03:20.440 --> 00:03:21.920 basically you just want to send a few packets. 00:03:22.210 --> 00:03:28.840 So I've got hydra ‑l for login bee, and then dash ‑p for bug. 00:03:29.440 --> 00:03:33.940 And then I've got the 192, etc., address and all of the 00:03:33.940 --> 00:03:35.520 other items that we've already talked about. 00:03:35.780 --> 00:03:40.180 So let's go ahead and give this a try, and it found a password, 00:03:40.640 --> 00:03:44.760 and let's jump back into Burp Suite Community Edition and take 00:03:44.760 --> 00:03:45.950 a look at what we've got here. 00:03:46.640 --> 00:03:50.950 So here is our POST request, which was expected, 00:03:51.800 --> 00:03:55.120 right? So you've got your cookies and you've got password as 00:03:55.120 --> 00:03:57.760 bug and security level 0 and login is bee. 00:03:58.940 --> 00:04:00.250 So all is well there. 00:04:00.840 --> 00:04:01.650 However, 00:04:02.140 --> 00:04:07.820 we also have this additional item here. And it seems that Hydra 00:04:07.830 --> 00:04:10.950 is sending both a POST and a GET request. 00:04:11.380 --> 00:04:14.940 So of course, now we'll have to troubleshoot this a bit. 00:04:15.840 --> 00:04:19.250 And let's take a look and see what happens with a failed password. 00:04:20.839 --> 00:04:24.010 So we'll jump in here and just look at the password 00:04:24.020 --> 00:04:26.650 bugs and see if that's any different. 00:04:27.610 --> 00:04:31.060 We'll jump back into Burp Suite, and no, 00:04:31.070 --> 00:04:34.650 we get the same thing, there's a GET method and a POST method. 00:04:35.740 --> 00:04:41.400 The next step would probably be to jump back into the terminal, and let's 00:04:41.400 --> 00:04:43.650 clear our screen here so we have something to work with, 00:04:44.440 --> 00:04:50.050 and then we will re‑run this command, and this time we're going to debug. 00:04:51.250 --> 00:04:56.300 So ‑d, and we are going to get a lot more information here. 00:04:57.140 --> 00:04:58.150 So let's scroll up. 00:05:02.180 --> 00:05:07.220 And we've got a POST request, which is what we would have expected to see. 00:05:08.140 --> 00:05:13.650 But then if you scroll up here further, you also have a GET request. 00:05:14.280 --> 00:05:14.660 Now, 00:05:14.670 --> 00:05:18.480 I'm not going to dive into why that's occurring here right now, 00:05:18.480 --> 00:05:22.730 but the one takeaway I hope you get is that if you are having 00:05:22.730 --> 00:05:26.390 trouble with something and you need to understand more about 00:05:26.400 --> 00:05:31.530 what you're dealing with, use the debug option and follow through line by line, 00:05:31.540 --> 00:05:35.290 and hopefully that will help you find any errors that you may have made 00:05:35.450 --> 00:05:37.700 while you're setting up your brute force session.