NTLMv2 Hash harvesting remotely

Question

I'm experimenting with ways to harvest NTLMv2 hashes remotely. Responder.py is perhaps the most widely used mechanism (these days) to perform the task, but I'm unsure if it's even possible to utilize it remotely.

Ideally what I'd like to do is run Responder on my attacking box and proxy the information through a compromised machine via a Meterpreter shell (or similar mechanism).

Is this something that's possible? I've been able to find no real documentation on it.

If not, is there a mechanism that could accomplish this that does not involve privilege escalation to harvest passwords from lsass?

Answer 1

Responder.py and MultiRelay are recompiled for win32, but I've used the Python scripts in Win10's Linux subsystem and they also appeared to work fine from there. I prefer purpleteam/snarf for NTLM Relay, but if all you want is hashes off-the wire then any pcap library/utility will be fine.

If you are PowerShell-fluent you can use Inveigh.

If you want to focus on what you can do without escalating privs then you can use NetRipper, net-creds, PCredz, or similar. Depending on the version of Windows and other factors (protected processes 1, protected processes 2, protected processes 3), lsass may or may not be able to provide passwords.