OK.
Let's talk about our first attack.
So this is called l m and r poisoning.
Now what is L M and R so l m and r is what is known as link local multicast and name resolution.
And when you say that all we have to do is think about it is it's basically DNS.
So it's used to identify hosts when DNS fails to do so.
And this was previously known as M B T N S which was net bios named service.
And the key flaw here is that when we respond to this service it actually responds back to us with a
username and a password hash and it's really bad.
OK.
So we're going to take a quick overview and look at what it looks like.
We're going to see how the attack is ran and talk through some of the strategies and then we're going
to go ahead and actually do a live demo in the next video so you can follow along.
So let's take a look first at an overview so let's say we have a victim up here in the corner.
You see the victim machine and it reaches out to the server and it says hey I want to connect to this
hack em server.
Well really the server name was hack me but the user just happen to type in something wrong which is
causing a DNS issue in that DNS issue goes out we can't resolve it DNS and the server says hey I have
no idea really what you're talking about here.
And so we go out and we say hey broadcast a message.
I'm going to send this out to everybody.
Does anybody know what this hack M is or where I can go to connect to it and us listening in the middle.
Is this the man in the middle attack.
We're going to say hey I know exactly where that computer is relying and we're going to say just send
me over your hash and I'm going to get you connected and the victim just going to say Here you go.
Here's my hash.
So that's really what element our poisoning is we're sitting in the middle listening for these requests
and when their class happens we're just waiting to get a response to us.
We're going to run so called responder and we'll talk about that here in a second.
So a responder is part of the impact tool kit.
Now we brand impact with several things in this course already we installed it way earlier and we even
used it in some of the box walkthrough is when we use the S&P client and the P.S. exact and the w my
exact that's all part of impact.
And we're gonna be using impact for some other attacks as well as we go through some of these common
Active Directory attacks.
So we're going to run a tool called responder.
It does exactly what we just described.
It responds to these requests and we just run this tool and we load it up and we're just sitting there
we're listening.
Now my strategy is that I run this tool first thing in the morning.
So if my assessment starts at 8:00 I'm running this first thing.
The best time to run this is first thing in the morning or right after lunch because people are coming
back from lunch and you need a lot of traffic.
So I will actually start this up before I start up any end map scans any NSA scans anything at all.
This is one of the first things that goes up.
Why do I do that.
Because the end map scan and the NSA scan is going to generate some traffic as well.
And then it might actually get some traffic talking back to you from other machines.
So we're just waiting for those responses and trying to capture hashes.
So let's say here that we run responder and then with running responder an event occurs now here.
All I'm doing is I am pointing this at our attacker Michigan IP address.
Not to worry about that too much.
But just think of this as somebody typed in the wrong network drive.
And this is just one example by the way a wrong network drive is just something failing to do DNS right.
So we're trying to access is network drive can access.
We're just sitting here listening in the middle for the ease of the demo.
We're going to point this out ourselves but that does not always have to be true.
Once that happens an event occurs OK the event occurs and it says listening for events.
Look what comes through.
We get here a until M.B. to hash right here and we get the IP address of who we captured and the user
who we captured.
So you see here Marvel's slash f Castle this is our Frank Castle user.
And this is their password hash.
Now there's a lot of things that we can do with this hash and we're going to run a couple different
attacks with it but the first attack we're going to talk about is just taking this hash and trying to
crack it so we can take this hash and we're gonna run it through a tool called hash cat and you can
see here that we actually crack the password to be password one which is what we set it when we first
set up the lab.
So that's really it all we're doing here is we're listening.
And the man in the middle situation.
And this is very very common.
So what happens here is if passwords are weak and guesses well then we're going to be able to crack
these passwords with any sort of decent password cracking rig.
And for example I'm using a 28 DTI which is pretty latest and greatest pretty powerful right now.
There are some rigs out there that will stack like four to six of these 20 eyes or even better but you
don't necessarily need that.
When I was first starting out I was using a 970 graphics card and it was doing just fine for cracking
the better the graphics card the better your cracking speed will be.
You don't have to have the latest and greatest to perform a lot of these tasks right now and chances
are when you go work for somebody they're gonna have a cracking rig anyway.
So not something you have to worry about too too much but to understand this attack the less complex
the password the better off we are because we're gonna be able to crack these passwords and then once
we have a cracked password account there's a lot of cool things that we can do to leverage that to actually
get on to a machine.
So we're going to cover that as well as we get into this and get deeper as to what can we do to get
access.
Once we have a password and how can we leverage that.
So from here just your big takeaway is we're doing man the middle listening were listening for any sort
of event where we can take over in place of DNS and we're going to respond to these is the tool called
responder.
We're going to pull down these hashes take them off line and try to crack them.
If the passwords are weak or and when I say weak I mean like less than 14 characters.
The longest password that I've ever cracked is 19 characters and that was a Bible verse.
So I always tell clients that just because your password is long does not mean that is good your password
should be non common words or long sentences or something greater than 14 characters but also complex.
So the longer and the more complex the better.
But honestly I will take a 40 character sentence without any complexity at all over a 14 character password
that has some complexity capital letter exclamation point etc. because we could still crack these and
you're gonna see that later on us cracking a pretty lengthy password but still a guest evil password.
So that's the takeaways from this.
Let's go ahead and move on to the next video.
Well we're going to actually talk about performing this we're going to perform this live and see how
to do it and then we'll talk about the fences as well.
Let's go ahead and jump over there.