DO-MA

SMB-RELAY ATTACK

This attack relies on NTLMv2 authentication - mostly used on all networks.

By listening to the network, an attacker is able to capture parts of this authentication/user credentials and use it to RELAY the authentication to control other systems on the network.

I am going to demonstrate in three phases how to utilize these security tools to gain a reverse TCP shell on a Windows 7 Pro system.

First I am going to start the following VM's:

Window 7

Windows 10

Window Server 2019

Kali Linux 2020

My First USB Rubber Ducky:

A Cool Multi Payload Device with Interesting Behaviors.

  I am a long time YouTube fan of Hak5 and have always wanted to tinker with a device Hak5 developed called the USB Rubber Ducky. So, last month I ordered one to start tinkering/explo(r|it)ing on my own. You can order one for around $49.99. Very affordable considering its capabilities. Fortunately, it arrived with 6 individual wrapped parts, some cool stickers and a nice guide from Darren Kitchen. A wealth of information can be also found at USBRubberDucky.com.

Posting the complete article on my LinkedIn page.

Local Subnet Attacks Learned From My Windows Active Directory Attack Lab

Explo(r|it)ing LLMNR (UDP/5355) -N- NBT-NS (UDP/137) Poisoning

What is Responder? Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2 hash types, Extended Security NTLMSSP and Basic HTTP authentication.

I will demonstrate in this first article of two, how I use Responder (by author: Laurent Gaffie) to listen for UDP packets on my local virtualized subnet. My attack lab subnet contains one Win 2019 Server (victim domain controller), two Windows 10 desktops (victim) and one Kali Linux (attacker) machine.

The Public Vulnerability: The attacker machine will listen on the local subnet for these LLMNR (UDP/5355) or NBT-NS (UDP/137) broadcasts and then will respond to the victim requesting to connect, in my case to \\\192.168.1.200.

Link for video: https://vimeo.com/405106642

LLMNR - Link-Local Multicast Name Resolution

NBT-NS - Netbios Name Service

Posting the complete article on my LinkedIn page.