Situation: We usually perform penetration tests from Linux machines connected to the clients local network. However for this test the client wants the start point to be a windows machine and has thus provided us with remote access to one of their windows workstations(To simulate phishing).

I know there are windows alternative options, but what i'm wanting to do is find the best way to "fully" join my linux machine in our office to the network that the windows machine is on.

My current thinking is a OpenVPN connection via a reverse SSH tunnel. Will this be enough to run tools such as Responder and Layer 2 MITM attacks? I'm open to any alternative methods of joining the linux machine to the remote network.

  • What is the purpose of tunneling the VPN connection over SSH? Is the Windows machine the VPN client or server? What level of access do you have to the Windows machine? – multithr3at3d Jun 5 '18 at 23:42
  • Hey @multithr3at3d, full admin access to the windows machine, I'm trying to join the linux machines to the network at layer 2 remotely. I'm really not sure how to go about it so i was taking a guess with the OpenVPN/SSH. Would be great to hear how to do it properly! – Jacob2471 Jun 12 '18 at 12:03
  • Okay, I think you are on track with the OpenVPN TAP then. – multithr3at3d Jun 12 '18 at 17:43

No, it's not possible to run responder through a VPN. You must compromise a system on the network then run responder via that system. After compromising a system and gaining higher privileged access, crackmapexec would be a better option than responder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.