> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/bash-bunny/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/bash-bunny/beginner-guides/network-hijacking-attacks-with-the-bash-bunny.md).
# Network Hijacking Attacks with the Bash Bunny
Exploiting local network attack vectors, the Bash Bunny emulates specialized Ethernet adapters. That means the target computer sees the Bash Bunny not as an ordinary flash drive, but as a USB Ethernet Adapter connected to a network. It's a network of two – the Bash Bunny and your target – and once connected, you'll have direct access to the target bypassing any would-be firewalls, countermeasures or intrusion detection systems from the legitimate LAN.
This is done in such a way that allows the Bash Bunny to be recognized on the victim computer as the fastest network, without drivers, automatically – locked or unlocked. As a 2 gigabit adapter with an authoritative DHCP server, the Bash Bunny obtains a low metric. This means that the computer will instantly trust the Bash Bunny with its network traffic — enabling a plethora of automated pocket network attacks undetectable by the existing infrastructure.\
\
These bring-your-own-network attacks are cross-platform, with the Bash Bunny exploiting Mac, Linux, and Android computers with its ECM Ethernet attack mode, and Windows computers with its Microsoft proprietary RNDIS Ethernet attack mode.\
\
Using these methods, attack like [QuickCreds](https://github.com/hak5/bashbunny-payloads) for example are able to steal hashed credentials from locked computers in seconds. Plug the Bash Bunny into a computer, wait a few seconds and when the light is green – the trap is clean!
Let's take a look at how the Bash Bunny pulls off this simple and effective attack.
First we issue the Ethernet attack mode specific for our target. If it's Windows, we'll want to use `RNDIS_ETHERNET`. If it's a Mac or Linux target, we'll want to use `ECM_ETHERNET`. Even better - if we're not sure, simply use `AUTO_ETHERNET` which will try both.
```
# Use RNDIS for Windows. Mac/*nix use ECM_ETHERNET. Try AUTO_ETHERNET for both.
ATTACKMODE RNDIS_ETHERNET
#ATTACKMODE ECM_ETHERNET
#ATTACKMODE AUTO_ETHERNET
# Set variables for the target's computer name and IP address.
GET TARGET_HOSTNAME
GET TARGET_IP
```
In the above example, we also grab variables for the target's hostname and IP address, which is useful for naming the logs that we lovingly call loot.
```
# Run Responder with specified options
python Responder.py -I usb0 $RESPONDER_OPTIONS &
# Wait until NTLM log is found
until [ -f logs/*NTLM* ]
do
# Ima just loop here until NTLM logs are found
sleep 1
done
```
Then we simply run Responder on the usb0 interface - which is the network directly connected to the target using the Ethernet attack mode above. Finally, we wait until the NTLM hashes are captured. Easy!
With a full TCP/IP stack and all common Linux-based tools at your disposal, the possibilities for pocket network attacks are endless!
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://documentation.hak5.org/bash-bunny/beginner-guides/network-hijacking-attacks-with-the-bash-bunny.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.