1

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif. Causing forced authentication which passes the NTLM hash. I have the code which executes the process (check reference links).

But how can I retrieve/steal the NTLM hash back over the internet remotely without being on the local network?

This process can be done locally very easily but I'm struggling with finding an NTLM listener to use over the internet remotely on a website.

References:

Improve this question
1
  • The links all clearly explain that the IP is your attacking server. The attacking server is on the internet. That's how you get it.
    – schroeder ♦
    Apr 18, 2021 at 11:40

1 Answer 1

Reset to default
0

For this kind of attack you could use for example Responder.py Please, bare in mind that in order to make it work over the internet it would be necessary to:

  • Enable outbound SMB connections on the server that you plan to attack.
  • NAT the port 445 on the attacker computer and ensure that no firewall is blocking it.

Once those two conditions are true you can now configure Responder.py to enable a SMB server and after that start Responder.py.

Now you just need to test it accessing it.

Please, do not forget to close everything back once you have finished playing!

Improve this answer
2
  • 1
    Will responder catch the NTLM hash of another pc of another router visiting the website?
    – Alexander Arnold
    Apr 18, 2021 at 23:09
  • As long as the "visiting" computer has outbound SMB connections enabled yes! It will grab it. Also it is worth mentioning that you will grab the Net-Ntlm hash, not the NTLM itself :-)
    – borcho
    Apr 19, 2021 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .