Exploiting Windows Network with Responder and MultiRelay

In a local network, Windows systems use Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (Net-NS) for host resolution when DNS and local hosts file lookups fail. So when a user mistypes the host name, or if a service is looking for a host which no longer exists, the queries are broadcasted to all systems in the same subnet. These protocol does not require any authentication, and any system in the local network can respond the client queries. Attackers use this very techniques to exploit systems in the local network. This is also very effective in the wireless networks which makes it a dangerous attack vector!

[osugovernorshipmovement]

Iam an Ethical hacker i really learned enough from your tutorials. Thanks a million

[uyscuti]

Suuuuch a good job man, keep doing these really demonstrative videos, they are the best kind.

[cyberagent]

#Rajganesh could you also post about how to setup the lab that's used here.

[SimZoneStudios]

You have the name resolution order wrong.

[boustaniaymane]

Hello, i have an issue: Hashes get passed to MultiRelay but it says "Relay failed, Logon Failure. This user doesn't have an account on this target.", which is kind of wierd. thanks

[lassebg]

thx, but i have a situation where i start responder with wpad proxy on, get the NTLM challange 2, target makes a GET request for the wpad.dat file, but then nothing happens.. can you help?

[AbhisekMishra]

I am not getting any ntlm hashes in responder tool. Can anyone please help me

[unixware]

is this done in the local area network

[abelimathiasi]

bro hope you are fine and there but you know what the link is not working

[mariacaldartdeu]

Awesome video, learned a lot from it and it was very easy to understand. I appreciate that you took the time to explain how we communicate with each network because it was something I had been struggling with for a while, and other videos I've seen don't take the time to explain it. First time seeing your videos but I'll definitely drop a follow!

[utkarshagrawal]

Please tell me your RAM amount please. Guess 16 gb?

[gkooti]

what happens if there is no user in fornt of that attacking pc and we don't get any requests from the user account ? will the responder still receive any hash by the system services ?

[maxrepyo]

i have this problem when i run responder in eth0
[!] Error starting SSL server on port 443, check permissions or other servers running.
[+] Listening for events...
what can i do ??

[benjamincardona]

might be a dumb question or not, but does this work with linux networks? i get to capture hashes but when i use multirelay it does not give me a shell.