Snagging Creds From Locked Machines With a LAN turtle - Hak5 2104

[@alexsacco1948]

At 2:22 the time on the computer is 2:22

[@stowww]

Omg wat

[@emmanuelserrato7805]

Alex Sacco sick

[@kevinportillo1971]

It was already 2:22 on that pc before the vid--- never mind why am i even bothering....🙄

[@zirizo]

@@kevinportillo1971 ??? Yea it's cool

[@ralph17p]

One mitigation that works - disable automatic USB device installations. It pisses off users as they can't connect their iPhones, USB sticks, etc. but if security is a concern it's worth doing.

[@jaybreeze2033]

UPnP is actually pretty standard, also makes the rubber ducky useless. an in-line hardware keylogger works nicely still.

[@ahmedifhaam7266]

most ADs have this as a GP usually

[@ralph17p]

​@@ahmedifhaam7266That's not been my experience and I've been an IT consultant for quite a while. Most of my customers are in finance (hedge funds, insurance etc.) and most of them don't block USB device installation. Those companies that do often end up rolling it back after the execs have a moan and get themselves an exception. Then the marketing team gets an exception because they have to connect to random devices in customer boardrooms and, before you know it, the whole thing has more holes than a sieve and it's fairly pointless. Mostly, we've moved to next-gen anti-malware and HIPS, designed to detect anomalous behaviour and hopefully catch the payloads delivered by these sort of devices. Also, it seems the latest Rubber Ducky is utterly unphased by USB blocking as it can be configured to circumvent most basic endpoint restrictions by emulating a different, permitted, USB device.

[@nickt4879]

what a disapointment, got a device to test it out for myself, i mean come on it's really straight forward, plug, update 6.1, install quick creds, config, and pouff no more space on device... dosn't work as advertised either.. now i have to factory reset bullshit and waste time reading post of a TON of people having hte same issue all the way 2 years back... man seriously i should have google it before buying, what a waste of time

[@uniquelycommon2244]

Great ground-up explanation of how this sweet method actually works. Subscribed. Have to get me a LAN turtle post-haste and start playing around with this.

[@hak5]

Hope you enjoy it.

[@davidmaxey3440]

perfect amount of time to fill in the last half hr of work :P

[@lnteI]

is this still working? i heard microsoft released patch to fix this

[@AliciaSykes]

Not working anymore, 2020

[@datsuprakidbackup8]

@@yuck871 still working?

[@ViolentOrchid]

if the rubber ducky had a clock that keeps track of seconds or milliseconds, just use that to pulse the led. seconds/60 * 255 or milliseconds /100 * some number to keep it from being crazy fast * 255. there

[@ahmedifhaam7266]

Doubt

[@ThatNateGuy]

Both of you guys have awesome shirts!

[@rumpelstiltskin9729]

This Crip is very skilled with computers.

[@RawApeFromAlbion]

🤣🤣🤣 yo dog!

[@h.i.1359]

Basically a ~30 y/o attack is still working fine and all it takes to mitigate it is to use a static route. Security and comfort never go together.

[@grimssouls3897]

Whenever I attempt this on myself, it takes too long, so I never get to finish. It rapidly blinks for hours. I left it in for hours. Didn't finish. When I check the folder it's empty.

[@dosluke]

very cool. Ill be buying a lan turtle soon, I already have the ducky :P. btw, Shannon, you are a beauty :)

[@over00lordunknown12]

Back when this was new, and I took a tour of a Microsoft center near me (with my High School), I asked the tour guide (who is a seasoned MS worker, who mainly worked in the MS Office Suite) why Windows just sends the NTLM hashes over the network without ensuring it is a server that is valid. Their response was: "Windows doesn't." but he looked *VERY* confused, and my class mates were all happy I stumped the guy because he was so sure of him self in the beginning that he could answer ANY question... XD

[@ahmedifhaam7266]

that's not really a victory or whatever lol.

[@lxRAVERxl]

And then everyone stood up and slow clapped while nodding approvingly.

[@mikvance]

My turtle likes Shannon.

[@AholicKnight]

same

[@zaggery]

What about the whole private, public lan? It will trust this network device?

[@goustune]

I'm not sure I get it but, this work only if Windows is configured to use an AD ? Because there is no reason that Windows will send creds over the network on a simple home network

[@LakeVermilionDreams]

Isn't there some sort of work group sharing in Windows still? Or is that managed by our use a different protocol or procedures?

[@AlexKennedy47]

I'm assuming DHCP sends WPAD option in response. This forces windows to do an HTTP request for the WPAD. The HTTP server is set up to require NTLM-Auth. Hence Windows sends NTLM... Just a guess but I think this is correct.

[@sandortakacs546]

Certificed Checkbox Unchecker.. I died 😂

[@RawApeFromAlbion]

Yep come get your CCU certificates!

[@LakeVermilionDreams]

I love this show! I learn a bunch here, then get to wow my coworkers with security stories and get them excited about how something as simple as MITM attacks work.

[@jblackops99]

what Linux distribution was used on the laptop.

[@navjotsingh2251]

MJGC-Jonathan kali Linux I think

[@KyletheKReep92]

Kali.

[@matthewsummers6545]

testing in my environment and pulled the hash off a test machine but its a much longer hash then old NTLM is there certain areas that are the hash and the rest isnt? curious how to get ophcrack or something to work with the format

[@AllYourDubStep]

I'm able to get NTLMv2 hashes, but how do I crack it? I'm not sure what to do with the NTLMv2 hash. Thank you! Also great toy this thing is.

[@AllYourDubStep]

Alright perfect. Thanks man

[@ahmedifhaam7266]

@@AllYourDubStep ?

[@kdnew7877]

sadly it doesnt work for me. responder.log says "starting attack" and the amber LED blinks fast and doesnt went solid :-/

[@TeganBurns]

8:30 what is PWM for 500 please

[@hak5]

Pulse width modulation - shannon

[@TeganBurns]

No like Jeopardy lol :P But yeah, I was saying you can use PWM for fading the LED in and out by changing the duty cycle from 100% - 0% (and vice versa) with a for loop.

[@davetriplett4779]

Tegan Burns Oooo, )))

[@davetriplett4779]

Yeah, ...I'm lost. .

[@bearwolffish]

What do you mean Glenn, there is a 0-100% duty cycle. Do you mean because that is either on or off? From AVR datasheet on using timer capture: "While this implementation plan will produce generally reasonable results, there are some boundary conditions which must be considered. The first is that it is possible to have a PWM duty cycle of 0%, or of 100%. These both have meaning, but they are anomalous, since the former cycle consists only of a (constant) inactive signal, and the latter only of an active signal. In neither case, there is any edge for the ICP to trigger on. "

[@alicoolman1xx]

The solution: Switch user(put a note 📝 on screen saying pc in use) Use an anti virus so it block internet from new network cards.

[@evilplaguedoctor5158]

so.. what are Creds?

[@hak5]

credentials - like username / password. - Shannon

[@evilplaguedoctor5158]

Hak5 ah, makes sense, thank you!

[@rhettro_]

First time peepin' the channel, I am officially in love with Snubs

[@danmac4969]

what is the benefit of buying a land turtle vs a rubber ducky?

[@edwinkania5286]

What is up with the wrist wrap............

[@Badminkey7]

Does it need to always have a cat 5 cable plugged in or does it still work just plugged in via USB

[@mircoheitmann]

But why isn't it a camera? in case you don't understand, take a look at the beginning

[@ale-lx9gp]

Yo dawg, tell me more about these leds and that inside joke

[@aquatrax123]

that's why you disable ntlm and move to kerberos only.

[@TMusicLis]

Whats the name of the Documentary.

[@Chubbza5]

Couldn't you implement a "process counter" or something into the hash code that counted the clock cycle during the compilation and completely nullify this kind of attack?

[@speedcorefreak7238]

@hak5 Echo in the audio

[@hitmansnipes6445]

nothing shows up when i cat the .log file do i need to configure responder too?

[@gabrieltaggart]

So i’m confused. You can snag the creds from the locked machines into hashes... But can’t decrypt the hashes, or at least quickly? I apologise, I’m not a very good listener, and I lose concentration very easily. Can someone please briefly explain what this actually does? Like for example: -You configure the Lan Turtle to Quickcreds -Plug it into the locked machine -Wait until the amber light is solid -Unplug it and plug it back into your machine -FTP to /root/loot -Find the hashes... What do I do with the hashes? And how do I get the passwords?

[@Cr4ntz]

Decrypt them with programs such as john the ripper

[@alvaroelloco24]

would it work as well if the computer is unlocked? i mean logged in? thanks i keep waiting for your answers!

[@jameshersee169]

does it only run on Linix as i would assume it could run on a mac as the UI on terminal looked similar and macOS and Linix are practically the same thing

[@tonycheung7624]

If this is a local account we can boot from PE to unlock all of the accounts. Is it this tool can unlock domain accounts?

[@tehtron]

+Hak 5 I think i have another method to Snag creds for entire active directory domain that I have theories about

[@ahmedifhaam7266]

no, you dont.

[@AlexKennedy47]

So how did the autologin work? Or can someone point me to good information to pass the hash?

[@Chris-ze3ic]

would this work on a machine if had all its files encrypted ?

[@tgyk1568]

I just noticed the @HunterHonda sticker behind Mubix at 11:49. Fuckkin aweeesssooome.

[@DarrenKitchen]

I love that guy! @HunterHonda is the man!

[@tgyk1568]

Do you regular any other motovloggers? Hunter and Dan are definitely a couple of my favorites.

[@Babyfacemcgill]

You guys keep talking about NTLM but what about NTLMv2? Anyone doing basic Windows security should be refusing LM and NTLM.

[@stevesmith2553]

what about Kerberos

[@grave0x]

they speak about NTLMv1 and v2 after 16:30

[@pj1106]

How to you view the creds form the Lan turtle?

[@Anonymouspock]

What's with the repeated opkg invocations? Shouldn't you store that output in a variable then use that? Actually, that should be a function because it's a bunch of repeated stuff.

[@ahmedifhaam7266]

function or static variable, choose 1

[@JeffereyDembinski]

Does this hack rely on the use of DHCP? What if it's a desktop with a manually set IP address?

[@bwagenberg]

So how unlock a logged off pc?

[@nitinmeena8589]

can you tell how to break speed limit on a lan ?

[@ronniepalmer9813]

is there a way I can buy your stuff in the UK

[@fahdadni]

i always wanted one of your devices(usb rubber ducky, lan turtle...)but i can't afford it hahaha

[@kodiererg]

Real hackers build and program their own. Look into raspberry pi and arduino, and learn C

[@Q_20]

What? I don't think it would work if I prevent installation of driver.

[@ahmedifhaam7266]

does it install anything?

[@becouso9h]

do you need 2 turtle to do the job?

[@forskern]

Can you do this with bash bunny?

[@hellsguardian2004]

Can the LAN Turtle be used to get creds from a linux system?

[@veryfrozen3271]

Shannon has a really nice t-shirt

[@jarisipilainen3875]

pc is there locked or unlocked you own it allready

[@SoundsFantastic]

Green beginning....HULK!

[@Anonymouspock]

Hey! I'm just curious why you don't have local dynamic DNS and instead use IPs everywhere.

[@andrewel5383]

im wonderinf if you would please do a vid on hack os's i mean there are several linux based hacking os im specifically focused on blackarch and kali

[@joshuaott2800]

So... it doesn't do anything you advertised? big surprise haha

[@fahdadni]

i got an idea, it's called lanpi, it's a box with raspberry pi with 3g or lte modem shared over Ethernet with lan turtle and it's portable and usable anytime please respond hahahah

[@karelorigin4649]

connect your phone with the raspberry pi using the usb port, enable usb tethering, problem solved.

[@fahdadni]

Yep or that Lol hahaha

[@RoyalTurnips]

Beirut go boom

[@glitchtheanarchist5589]

Can c++ work for this. Or is it just python and bash.

[@ahmedifhaam7266]

anything works prolly,

[@R4Z0R-5H4RP]

bob is another name for kate

[@zirizo]

Creds?

[@croquis24]

wayt i just realise you can do theis atac from the network room lol

[@sureal808]

Anyone able to get this working? Have a lan turtle and a fresh Windows 10 install but no luck.

[@hotfreshrider]

Shipping estimate: September 27 but we want it nooowwww

[@dpatt6175]

Puff puff pass the hash

[@Antonio-yp3tj]

He looks like he’s from florida

[@OSHA_Inspector]

Florida Man (Hacker Version)

[@slimshady4126]

Didn't know darren was reppin

[@williammartens7037]

Hello Hak5, i have seen a bounch of videos about the lan turtle, But, if you just connect it to the Home's /work's ethernet (and NOT a computer, just to a powersource like a powerbank,outlet,etc) can you acces everything on that network that are connected to the ethernet??? + is the lan turtle 's tools (msf-meterpreter,scan networks,MITM-attacks, etc) fully undetectable? Please answear this as fast as possible!

[@ahmedifhaam7266]

ooh

[@Nismo1019]

Does this attack work using a pi zero??

[@x_Erebus]

it could if you put in the time to build it

[@virtualevan]

Hey! Listen!

[@tomerkane8424]

Hi guys im totally new to the hacking world even tho i know some html css and python. Where i can start learning the lenguage the use on the trrminal and the explanation of what are hashes and all that cool stuff.

[@fatcunt6765]

learn to code first. i started off with c# to make bots for discord and other cool stuff, just look something up

[@zach3664]

I think the lan turtle is awesome. I was wondering if you guys have thought of doing a lan turtle that plugs in via Ethernet instead of USB. Some companies have enacted no USB use so that would mitigate that attack. Do you think there is a way to do Ethernet in from the switch to Ethernet out to the computer so you wont have any unauthorized USB device setting off alarms? If there is a way to pull power from the NIC of the computer to power the turtle I think that would be another great attack vector. Then you could just say "oh yeah that's just a insulator" or something to that effect to make them not question what it really is. I'm not sure if it is possible but just an idea just in case said company or entity has enacted no USB policy. Like always love watching your channel and hack the planet!

[@CodeBeasty]

WOOOOOO

[@mysticsilent]

thnx :) nice tutorial and excellent explanation!

[@prod.treyxoldd]

hak5 how do create my own physical access hacking device

[@aidenblanchard7157]

rip Lebanon... F

[@Calm_Energy]

I too 🧡 the directory name /root/loot lol

[@phreaklulz]

I have noticed with the lanturtle, if the user does not have access to the internet, OR if the computer does not allow Microsoft to search for drivers outside of the computer, then the LanTurtle only shows up as a 10/100 Ethernet device with no function. So my question, wouldn't something like this mitigate the attack? support.microsoft.com/en-us/kb/2500967

[@pablorodriguez196]

great stuff guys!

[@geekinginandout]

nice shirt

[@j0ltc0lajunki3]

Damn Darren, That shirt

[@pcbreezejp]

I want that pineapple shirt

[@eddietours3728]

Link !!!! BOTW coming

[@bseverance5390]

Too Cool! One more thing I can do with my LAN Turtle!

[@RawApeFromAlbion]

yo dog!

[@millipeace86]

I love your content, and the contents of your shirt but can I be real with ya? You look like you should be in a ska band.

[@hak5]

Don't judge a book by it's cover. The way a person dresses doesn't necessarily constitute what they are into. Food for thought. - Shannon

[@QasimSeeha]

Nice hat mubix د

[@lifeisaadventure9948]

I’d 😍 to be able to hack our wireless printer 🖨 👩🏼‍💻

[@briankelleher5649]

Hi could you possibly make your videos more concise because they drag on a lot.

[@ericmin6055]

but that's why i like it if they make it concise I think it will become boring like most other hacking vids.

[@ericmin6055]

But most of all, Samy is my hero.

[@MajikCatSecurity]

Shannon....(sigh) =)

[@fahdadni]

great guys

[@ITpanda]

She has an awesome shirt. Also cool episode

[@Oper8or]

I'll buy a LANturtle right now if snubs will bit it before its sent to me!!!!

[@THE16THPHANTOM]

guys why do you only hack windows machines? Nobody important uses a windows machine. i assume they don't just to be safe from hacks like this. apple devices are all the rage now. let see some apple device hacking. cause windows hacking is pretty much useless were im from. and by that i mean i can't impress anyone with my hacking skills since no one i know uses windows. And we all know the point of hacking is to impress the person you hacked. so lets get to it. My future -wife- girlfriend is at stake.

[@Storm_FireFox1]

THE16THPHANTOM Just look up Linux reverse shells and linux Meterpreter and you have literally everything you need. Mac is a Linux box, so do your research. Good luck and don't creep out that future girlfriend!