All right.
So now we're gonna legalize responder and we're going to pull down this hash.
So you should already have the pick a tool kit installed.
If you don't.
There are multiple videos here so please be watching the videos all the way through.
Don't skip ahead or go out and Google impact get hub and install it that way.
So from here let's go ahead and type in responder and you should be able to auto complete all we're
gonna type in now is a dash capital I.
And this is our interface our interface here is going to be either net zero and I will go ahead and
just open up a new tab because we're going to need that and let's go ahead and just type in I have config
or IPA and you can see here that we have our IP address and it's on Ethan and zero.
So that's what we're gonna be listening on the Internet either at zero interface and then the rest that
we're gonna need is just a dash RTW.
So you're not to worry too much about what this is.
This is a saying these are the different types of what we're gonna be listening on.
One of them is w pad you can look at the dash help for this but this is the most common settings and
if you want to see a Hash again more than once go ahead and just do a dash of V.
So if we're not saving this Apple right now I just do a dash V for verbose.
This is an optional setting once you're actually working in the field but just for now just in case
you capture the hashing you want to see it again.
This is a good way.
Otherwise soars in a pop file for later on.
Let's go ahead and just do a dash RTW like this.
You can see OK.
It says Hey you're listening on Ethan at 0.
Here's your IP address.
And when you scroll up here are your poisonous OK element are and then when element are fails it actually
goes down and works on empty DNS.
So it goes to DNS element R and B DNS.
It's also listening on DNS and it's doing a few different things here.
It's running a few different servers and all we're doing is running those servers in the middle just
to see if we can get a connection from any of these and try to intercept and respond back.
So you see here now it says it's listening for events.
So go ahead and go over to your Windows machine and you can see that I've actually put my Windows machines
just as a lab setting this is kind of what's nice about having the actual Pro version is you can just
keep all of your windows machines in one area.
So I've got my windows machine spun up.
I've got Windows Server 2016 and I've got the Windows 10 Frank Castle machine spun up so the Punisher
and the Windows Server.
And what we're gonna do is we're just going to open up a file share like this or a folder and I'm just
going to point this right at our attacker machine.
So mine was 1 9 2 1 6 8 5 7 1 thirty nine I do believe.
Let's go ahead and double check that 5 7 1 thirty nine.
OK.
And then I'm going to do here is hit enter and it shouldn't resolve right this should this should wig
out.
Nothing should happen here and you see it's trying to Internet credentials access is denied.
We actually do have a server up and running an SMB server.
And look what's happened here.
But we do have we do have the SMB server up earnings those trying to connect to that but you could see
that it has pulled down the hash and it pulled it down twice which is fine but it's pull down the IP
address of the machine we're attacking the user and the user domain and then hash right here.
So everything that we talked about in the last one this is exactly what happens.
So let's go ahead and recap this and I'm going to blow this up so you're on your first assessment.
You're sitting on an internal and first thing you want to do at least in my my playbook.
One of the first things I'm doing I'm running a responder now.
It just depends how loud we're gonna be I'm gonna show you some other things but this is especially
if the client has never had a pen test before this is always a good go to now clients are getting smarter
about this attack and technique and we'll talk about that in the actual defense video for this.
But clients are getting smarter about this and they're starting to turn this off.
But for now I would say 70 percent of the clients that I test against are still running MLM and are
on their networks and this is allowing for easy wins especially if they have a poor password policy
which a lot of clients will.
So this is a great initial attack vector to capture some hashes and we'll capture these hashes take
it off line try to crack it.
It's amazing we can do a lot with this.
So from here we're going to go ahead and install hash cap or use hash tag on our machine I'll show you
a couple of different methods of how we do it.
Then we'll talk about the fences and move on to the next attack.
So let's go ahead and move on.
Next video I'll see you over there.
When we work on cracking this hash.