All right.
Picking up right where we left off so we now have our targets that text screen cap targets that text
and we've got the Spider-Man computer sitting here at 142.
And remember our other computer is sitting at one forty one.
And we're going to relay our credentials from responder from one forty one to one forty two and hopefully
get something good back.
So we need to set up a responder so let's go ahead and go to get it and we're gonna go edit the Etsy
responder and responder DOT COM file.
This is the config file.
And remember we need to turn off SMB and we need to turn off H TTP here so your setting should look
like this.
Go ahead and save that and then we're going to run responder just like we did before.
So we're going to say responder capital I like this ether net zero and then already WB just like that
should hit enter.
Once you're ready and if we scroll up just a tad it should look just like the picture did before where
we have a few more reds mixed in with these greens here.
SMB server is off HDP server is off.
So now we're listening for events.
Now we're going to set the relay.
So let's go ahead and open up a new tab.
I'll make this a little bit bigger.
And we're gonna use NTA M relay X stop pie.
We're gonna set that target file with the dash T F and that is Target stock text and then we're just
going to say SMB to support and so look just like that hit enter and now the server has been started.
We are waiting for a connection to happen.
So let's go ahead and trigger that connection.
So I'm going to open up my Punisher machine and I've already got it signed in.
So Punisher is online here make sure your Punisher is online and your spider man machines online.
And I'm going to just go ahead and point this right at my attacker machine again.
So 9 2 1 6 8 fifty seven one thirty nine.
This is the same thing we've been doing with responder just this time.
It's going to relay instead of capture hash.
So go ahead and hit enter here.
It's gonna say there's an error but look at what's happening here.
Beautiful.
OK.
So we come in here and you can see it's connected a couple of times.
Let's make this bigger you see.
OK.
It comes in.
It says Hey I'm receiving this connection from one forty one.
Let's go ahead and attack our target of 142.
And it's going to authenticate it's going to succeed.
Why.
Remember SMB signing is disabled.
Here it is enabled but not required.
That is considered the same exact thing.
OK.
So it succeeds.
And and most importantly Frank Castle f castle here is an administrator on this computer because this
user is an administrator on this computer.
Guess what.
We dump the Sam.
So we've dumped the same hashes and now we have these hashes these wonderful hashes OK and we can copy
these hashes.
We could take them off line.
We could try to crack them and we can try to move laterally with these hashes.
What I want you to do is copy these hashes and we'll save them for later we'll talk about this again
or revisit hash cat work on cracking these will also work on passing these around in later section.
So for now just know that we have dumped the same hashes which is just like the shadow file on a Linux
machine.
And there are things that we can do with these hashes.
So we're all building up into gaining shells getting access doing more cool stuff.
But here we've got some access to this machine.
And now we can start trying to move laterally with the access that we have or even move vertically.
So from here that's it.
I just wanted to show you this quick demonstration of how this could be potentially vulnerable.
And this is an easy attack to pull off.
And it's by design again no settings really changed right.
This is just how default Windows environments are.
So this is a very common occurrence especially if the environment has a lot of local admins and you
have a lot of local admins on the same machine or the same user or a local app and on a lot of different
machines.
So from here we're gonna make another video and the next video is going to cover improving upon this.
Just one example of how we can improve upon this.
We can actually take this and get a shell out of this so I'm going to show you how to do that and we'll
improve upon it then we'll talk about how we can prevent this or talk some defenses and then we'll move
on to the next attack.
So I'll catch you over in the next video.