All right.
So first things first we need to be able to identify what has S&P signing enabled and what has S&P signing.
Disabled.
Now there are a few different ways that we can do this.
One way would be to run a NSA scan and when you run NSX it'll tell you nice and neatly hey look this
has S&P signing disabled on these servers and you can copy that list down if you want to.
Another method which I'm going to show you is and map.
We can run a specific script on and map that is built in and it will check for S&P signing.
And then lastly you can go out to get hub and search for something like S&P signing check and you will
find a bunch different scripts that will do this for you.
Or you can write your own if you really want to.
So we're going to do is we're going to just use and map here and just do a quick check and then we can
kind of understand what we're looking for.
So we're going to type in and map and then we'll do a dash dash script like this and the script is called
the S&P two dash security dash mode dot NSC.
This is an app scripting engine and we're going to be looking just on port for forty five and then we're
going to sweep across the entire network that we're on.
So it should look something like this and it should go by pretty quick for us.
So let's go ahead and just enter and what's going to come back is whether or not the port is open.
As you can see here like this has filtered on this port.
It's going to come back whether or not the port is open and whether or not S&P signing is enabled or
disabled let's ignore dot 1 and 2.
OK.
So dot one forty This is where we start at least for me dot 140 is our server.
So this is our domain controller and you could see in the Domain Controller message signing is enabled
and required.
So remember when we talked about message signing we said that it is disabled by default on any workstation
and enabled and required on every single server by default.
OK.
So we expect to see this.
We will not be able to relate to this machine.
However if we look at forty one which is the Punisher and 142 which is Spider-Man we can see here that
one forty one in 142 will both say the same thing message signing enabled but not required.
So it's enabled but it's not required meaning that we can still do a relay attack because of the non
requirement here.
So what we can do is we can take the list of ip addresses that we have here given one forty one and
one forty two and put those into a list and we go ahead do that now.
So let's just go ahead and say get it and you'll see my target's already here but we're going to say
Gee at a target site text hit enter and I actually only want you to put one target in there.
So I'm using Peter Parker's machine.
So let's go ahead and just use Peter Parker's machine whichever one you have your secondary machine
on.
You should have a 141 142 whatever the IP address actually is go ahead and you pick one of those machines
here in a perfect world you would put all your machines in here but we're just going to simplify this
for the attack go ahead and save that out and then I'm going to pause here.
We're gonna meet in the next video we configure everything and we'll set up the relay and see how the
attack looks so I'll catch you over in the next video.