Capturing Hashes with Responder - HackTheBox Querier
Exploiting a SQL Server instance using the xp_dirtree command to capture a Net-NTLMv2 hash via SMB authentication. The technique involves pointing the database to an SMB share hosted on an attacker's machine. When the server attempts to access the share, it triggers authentication, allowing tools like Responder to capture the Net-NTLMv2 hash.
This method is similar to the approach used in the retired box Giddy, where an SQL injection was leveraged to achieve the same outcome. Instead of SQLi, this example showcases the process with direct access to the database.
Check out the link to get started with Kali Linux for free!
https://hackerforge.carrd.co/