M@$T

Quickcreds issue

15 posts in this topic

I know there is a similar thread open however this will be specifically used for people who are not managing to use the quick creds module to work on the turtle. 

My issue is that when plugged into Windows 10 the amber LED keeps blinking to infinity and I am not able to get a hash. Whoever has the same issue or maybe anyone managed to make the turtle with the quick creds please shed some light.

0

Share this post


Link to post
Share on other sites

have you checked the responder config

I found a line in there to edit

AutoIgnoreAfterSuccess =

0

Share this post


Link to post
Share on other sites
On 19/10/2016 at 3:33 AM, M@$T said:

I know there is a similar thread open however this will be specifically used for people who are not managing to use the quick creds module to work on the turtle. 

My issue is that when plugged into Windows 10 the amber LED keeps blinking to infinity and I am not able to get a hash. Whoever has the same issue or maybe anyone managed to make the turtle with the quick creds please shed some light.

I'm having the same issue but I've found file with hashes in /etc/turtle/Responder/logs directory. Check there.

0

Share this post


Link to post
Share on other sites
On 10/21/2016 at 7:29 PM, D4rkOperat0r said:

I'm having the same issue but I've found file with hashes in /etc/turtle/Responder/logs directory. Check there.

Hmmm, I am facing the same issue. Factory reset of the turtle, opkg update, then configuration of the quickcreds module using the turtle shell.

The log folders I see in the /etc/turtle/Responder/logs folder are linked to /root/loot as it should be, but there is nothing in it.

On the wire I can see that the poisoning is woking and windows is using the faked proxy which is asking for NTML authentication. Anyway no hashes are dumped to the turtle. I have tested the setup with a domain joined win 7 pro and a stand alone win 10 home.

0

Share this post


Link to post
Share on other sites

Starting to believe this was just a hoax for people to buy more turtles :( 

Is there someone here who actually managed to make this work on domain and local PCs?

0

Share this post


Link to post
Share on other sites
16 hours ago, M@$T said:

Starting to believe this was just a hoax for people to buy more turtles :( 

Is there someone here who actually managed to make this work on domain and local PCs?

Plenty of people have, yes. If you check the other threads, people have had success.

0

Share this post


Link to post
Share on other sites

I've had it not work, and have had it work.  Like I've said a few times before, it won't work on every computer.

1

Share this post


Link to post
Share on other sites

Has anyone been able to have the hash bypass the lock screen or just able to gather creds?

 

I can get mine to capture creds but I want it to go the next step....

0

Share this post


Link to post
Share on other sites

I just noticed an issue with the symlink creation from /etc/turtle/Responder/logs -> /root/loot/# that was preventing logs from saving to the incrementally numbered directories.

I've updated the module to fix this. You can either uninstall the module manually by following the commands below, then reinstalling and configuring from modulemanager, or you can apply the fix below.

Manual uninstall:

rm -rf /etc/turtle/Responder
rm /etc/turtle/modules/QuickCreds
rm -rf /root/loot

To apply the one-line fix, edit /etc/turtle/Responder (with nano or vi) and find line 118 (CTRL+C shows line # in nano). Then replace the following:

rm /etc/turtle/Responder/logs/*

with

rm -rf /etc/turtle/Responder/logs

 

0

Share this post


Link to post
Share on other sites
On 11/3/2016 at 1:20 PM, sureal808 said:

Has anyone been able to have the hash bypass the lock screen or just able to gather creds?

 

I can get mine to capture creds but I want it to go the next step....

Is yours stuck on the blinking LEDs?

0

Share this post


Link to post
Share on other sites
On 11/5/2016 at 1:32 AM, Darren Kitchen said:

I just noticed an issue with the symlink creation from /etc/turtle/Responder/logs -> /root/loot/# that was preventing logs from saving to the incrementally numbered directories.

I've updated the module to fix this. You can either uninstall the module manually by following the commands below, then reinstalling and configuring from modulemanager, or you can apply the fix below.

Manual uninstall:


rm -rf /etc/turtle/Responder
rm /etc/turtle/modules/QuickCreds
rm -rf /root/loot

To apply the one-line fix, edit /etc/turtle/Responder (with nano or vi) and find line 118 (CTRL+C shows line # in nano). Then replace the following:


rm /etc/turtle/Responder/logs/*

with


rm -rf /etc/turtle/Responder/logs

 

Thanks @Darren Kitchen for the update!

 

Any idea why the turtle keeps on blinking amber? doesnt seem to be snatching creds from my Win 10 pc

0

Share this post


Link to post
Share on other sites

When I open the responder logs all I can see is "Starting attack" and that is it

0

Share this post


Link to post
Share on other sites

Having the same issue here. Have not gotten this module to work yet.

0

Share this post


Link to post
Share on other sites

All the success cases I've read so far were always domain based. Is it supposed to work on non-domain computers too?

Thanks.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.