Quickcreds issue

[M@$T]

I know there is a similar thread open however this will be specifically used for people who are not managing to use the quick creds module to work on the turtle. 

My issue is that when plugged into Windows 10 the amber LED keeps blinking to infinity and I am not able to get a hash. Whoever has the same issue or maybe anyone managed to make the turtle with the quick creds please shed some light.

[janpol]

I am having the exact same issue :(

[m40295]

have you checked the responder config

I found a line in there to edit

AutoIgnoreAfterSuccess =

[D4rkOperat0r]

On 19/10/2016 at 3:33 AM, M@$T said:

I know there is a similar thread open however this will be specifically used for people who are not managing to use the quick creds module to work on the turtle. 

My issue is that when plugged into Windows 10 the amber LED keeps blinking to infinity and I am not able to get a hash. Whoever has the same issue or maybe anyone managed to make the turtle with the quick creds please shed some light.

I'm having the same issue but I've found file with hashes in /etc/turtle/Responder/logs directory. Check there.

[cyb3rwr3ck]

On 10/21/2016 at 7:29 PM, D4rkOperat0r said:

I'm having the same issue but I've found file with hashes in /etc/turtle/Responder/logs directory. Check there.

Hmmm, I am facing the same issue. Factory reset of the turtle, opkg update, then configuration of the quickcreds module using the turtle shell.

The log folders I see in the /etc/turtle/Responder/logs folder are linked to /root/loot as it should be, but there is nothing in it.

On the wire I can see that the poisoning is woking and windows is using the faked proxy which is asking for NTML authentication. Anyway no hashes are dumped to the turtle. I have tested the setup with a domain joined win 7 pro and a stand alone win 10 home.

[M@$T]

Starting to believe this was just a hoax for people to buy more turtles :( 

Is there someone here who actually managed to make this work on domain and local PCs?

[Sebkinne]

16 hours ago, M@$T said:

Starting to believe this was just a hoax for people to buy more turtles :( 

Is there someone here who actually managed to make this work on domain and local PCs?

Plenty of people have, yes. If you check the other threads, people have had success.

[barry99705]

I've had it not work, and have had it work.  Like I've said a few times before, it won't work on every computer.

[sureal808]

Has anyone been able to have the hash bypass the lock screen or just able to gather creds?

 

I can get mine to capture creds but I want it to go the next step....

[Darren Kitchen]

I just noticed an issue with the symlink creation from /etc/turtle/Responder/logs -> /root/loot/# that was preventing logs from saving to the incrementally numbered directories.

I've updated the module to fix this. You can either uninstall the module manually by following the commands below, then reinstalling and configuring from modulemanager, or you can apply the fix below.

Manual uninstall:

rm -rf /etc/turtle/Responder
rm /etc/turtle/modules/QuickCreds
rm -rf /root/loot

To apply the one-line fix, edit /etc/turtle/Responder (with nano or vi) and find line 118 (CTRL+C shows line # in nano). Then replace the following:

rm /etc/turtle/Responder/logs/*

with

rm -rf /etc/turtle/Responder/logs

 

[M@$T]

On 11/3/2016 at 1:20 PM, sureal808 said:

Has anyone been able to have the hash bypass the lock screen or just able to gather creds?

 

I can get mine to capture creds but I want it to go the next step....

Is yours stuck on the blinking LEDs?

[M@$T]

On 11/5/2016 at 1:32 AM, Darren Kitchen said:

I just noticed an issue with the symlink creation from /etc/turtle/Responder/logs -> /root/loot/# that was preventing logs from saving to the incrementally numbered directories.

I've updated the module to fix this. You can either uninstall the module manually by following the commands below, then reinstalling and configuring from modulemanager, or you can apply the fix below.

Manual uninstall:

rm -rf /etc/turtle/Responder
rm /etc/turtle/modules/QuickCreds
rm -rf /root/loot

To apply the one-line fix, edit /etc/turtle/Responder (with nano or vi) and find line 118 (CTRL+C shows line # in nano). Then replace the following:

rm /etc/turtle/Responder/logs/*

with

rm -rf /etc/turtle/Responder/logs

 

Thanks @Darren Kitchen for the update!

 

Any idea why the turtle keeps on blinking amber? doesnt seem to be snatching creds from my Win 10 pc

[M@$T]

When I open the responder logs all I can see is "Starting attack" and that is it

[sn0wfa11]

Having the same issue here. Have not gotten this module to work yet.

[drakorg]

All the success cases I've read so far were always domain based. Is it supposed to work on non-domain computers too?

Thanks.