2

Situation: We usually perform penetration tests from Linux machines connected to the clients local network. However for this test the client wants the start point to be a windows machine and has thus provided us with remote access to one of their windows workstations(To simulate phishing).

I know there are windows alternative options, but what i'm wanting to do is find the best way to "fully" join my linux machine in our office to the network that the windows machine is on.

My current thinking is a OpenVPN connection via a reverse SSH tunnel. Will this be enough to run tools such as Responder and Layer 2 MITM attacks? I'm open to any alternative methods of joining the linux machine to the remote network.

Improve this question
3
  • What is the purpose of tunneling the VPN connection over SSH? Is the Windows machine the VPN client or server? What level of access do you have to the Windows machine?
    – multithr3at3d
    Jun 5, 2018 at 23:42
  • Hey @multithr3at3d, full admin access to the windows machine, I'm trying to join the linux machines to the network at layer 2 remotely. I'm really not sure how to go about it so i was taking a guess with the OpenVPN/SSH. Would be great to hear how to do it properly!
    – Jacob2471
    Jun 12, 2018 at 12:03
  • Okay, I think you are on track with the OpenVPN TAP then.
    – multithr3at3d
    Jun 12, 2018 at 17:43

1 Answer 1

Reset to default
2

No, it's not possible to run responder through a VPN. You must compromise a system on the network then run responder via that system. After compromising a system and gaining higher privileged access, crackmapexec would be a better option than responder.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .