Responder combines two powerful techniques: Local File Inclusion (LFI) to force a Windows web application to make an outbound SMB connection, and Responder to intercept that connection and capture an NTLMv2 authentication hash. The hash is then cracked offline with hashcat. This chain — LFI → NTLM capture → offline crack → authenticated access — is a classic lateral movement pattern in Windows environments.
| Skill | Why it matters |
|---|---|
| Local File Inclusion via URL parameter | LFI is a top web vuln — and on Windows, it can trigger outbound authentication |
| Responder for NTLM capture | The most widely used tool for credential capture on internal Windows networks |
| NTLMv2 hash cracking with hashcat | Offline cracking against a wordlist — no account lockout risk |
| WinRM access with evil-winrm | Remote PowerShell access once valid credentials are obtained |
What you're seeing: port 80 (web app), port 5985 (WinRM — Windows Remote Management). WinRM on 5985 means if you get valid credentials, you can get a remote PowerShell shell via evil-winrm. The web app is the initial attack surface.
Browsing to port 80 shows a web application with a language selection feature. The URL reveals a page parameter loading files dynamically:
This pattern — a parameter that includes a file by name — is a textbook LFI candidate. On Linux you'd test for /etc/passwd. On Windows, you can point it to a UNC path on your machine, forcing the server to authenticate to you over SMB.
Start Responder on your tun0 (VPN) interface first, then trigger the LFI with a UNC path pointing to your IP.
The Windows web server tries to resolve the UNC path and authenticates to your Responder instance over SMB. Responder captures the NTLMv2 hash.
| Hashcat flag | Meaning |
|---|---|
| -m 5600 | Hash type: NTLMv2 (NetNTLMv2) |
| -m 1000 | Hash type: NTLM (used for pass-the-hash) |
| -a 0 | Attack mode: dictionary (default) |
| -a 3 | Attack mode: brute-force with mask |
| --show | Display previously cracked results from the potfile |
The LFI → Responder → hashcat → WinRM chain is one of the most elegant lateral movement paths in Windows environments. Each step is simple in isolation — the power is in chaining them together.
| Concept | Real-world relevance |
|---|---|
| LFI + UNC path on Windows | A unique Windows behaviour — Linux servers won't authenticate to a UNC path the same way |
| Responder on internal networks | On a real internal assessment, Responder captures hashes passively from LLMNR/NBNS broadcasts — not just from triggered LFI |
| Offline cracking has no lockout | Unlike online brute-force, offline hash cracking against rockyou.txt has no account lockout risk |
| WinRM for post-exploitation | evil-winrm gives a full PowerShell prompt — equivalent to an SSH shell on Linux |