I was reading about this device the author made, however he did not specify WHAT he was able to steal from a locked computer.
What credentials does this steal?
https://room362.com/post/2016/snagging-creds-from-locked-machines/
1 Answer
The article mentions that Responder is used, which is a tool for grabbing NTLM hashes from a variety of Windows protocols using LLMNR/NBT-NS/mDNS poisoning.
Basically, it takes advantage of the fact that many background connections are made by Windows, most of which rely on an identification/resolution protocol that has no guarantee you are talking to a legitimate server.
The same can also be done with a $10 Raspberry Pi Zero (or similar). Take a look at PoisonTap as well.
answered Sep 23, 2019 at 1:00
