search

SySS-Research / Seth

Perform a MitM attack and extract clear text credentials from RDP connections
MIT License
1.38k stars 325 forks source link

SETH and Responder ? #61

Closed Leo4j closed 1 year ago

Leo4j commented 1 year ago

Hi. Is there any documentation on how to run SETH with Responder ? The readme file mentions the -h flag to get more info but could find none

AdrianVollmer commented 1 year ago

You should be able to just start the Python script and wait for a connecton. Since Seth isn't integrated into Responder, you can't know the original target host, so you'll need to run it with --fake-server. Let me know if that works for you.

Leo4j commented 1 year ago

Thanks for your reply. I'm using seth.py this way: 1) I used clone-cert and pointed at 10.0.2.6:3389 (where 10.0.2.6 is the DC IP) 2) python3 seth.py --fake-server Responder-IP -c /tmp/10.0.2.6:3389.cert -k /tmp/10.0.2.6:3389.key Seth says "listening for connections". Is everything correct so far ? My end goal would be to intercept all RDP connections within the network, and run seth for all of them Is this possible in the first place ? If so, I wonder how am I supposed to use Responder to achieve this ? Thanks

AdrianVollmer commented 1 year ago

Should be fine. But using Responder to obtain a man-in-the-middle position is always tricky. There is always a lot of luck involved. I mean, just run responder -I eth0 or whatever your interface is called and hope for the best.

Leo4j commented 1 year ago

Yeah that’s the issue with Responder, and I was actually wondering how I could take the most advantage from that. Thanks for your help :)