Attack Vectors
Last updated
Was this helpful?
Last updated
Was this helpful?
Basically we are mitm and wait for someone in the domain to access non-existing domain which will lead to sending a broadcast request through which we capture the hash and then maybe crack it to get access.
hashcat -m 5600 ntlmhash wordlist //5600 - NetNTLMv2
We change configs in responder.conf, run the responder again with the same command and setup relay with ntlmrelayx.py. Same as LLMNR poisoning but we use the hash to relay it to smb service and get access. In ntmlrelayx.py, we can use -i to get interactive smb shell.
Getting Shell with credentials using psexec
psexec.py marvel.local/fcastle:password1@192.168.1.12
Feature like Active Directory Certificate Services can make the attack more powerful. If a AD CS certificate is enabled, we can run LDAP or LDAPS to attack
We search for devices in domain with smb signing disabled. for example with nse script in nmap for smb
