From 008b492c98cc47828d46e41069f0f974086fbe3f Mon Sep 17 00:00:00 2001 From: Matt Andreko Date: Tue, 27 Oct 2015 16:50:05 -0400 Subject: [PATCH] First round of cleanup --- README.md | 4 +- Responder.py | 2 +- odict.py | 2 +- packets.py | 104 ++++++++++++++++++++--------------------- poisoners/LLMNR.py | 2 +- poisoners/NBTNS.py | 4 +- servers/HTTP.py | 4 +- servers/HTTP_Proxy.py | 10 ++-- servers/MSSQL.py | 2 +- settings.py | 2 +- tools/DHCP.py | 6 +-- tools/Icmp-Redirect.py | 6 +-- tools/RelayPackets.py | 2 +- tools/SMBRelay.py | 8 ++-- utils.py | 4 +- 15 files changed, 81 insertions(+), 81 deletions(-) diff --git a/README.md b/README.md index 6a6e594..512dc58 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ Note: This module also works for WebDav NTLM authentication issued from Windows - Built-in HTTPS Auth server. -Same as above. The folder certs/ containa 2 default keys, including a dummy private key. This is *intentional*, the purpose is to have Responder working out of the box. A script was added in case you need to generate your own self signed key pair. +Same as above. The folder certs/ contains 2 default keys, including a dummy private key. This is *intentional*, the purpose is to have Responder working out of the box. A script was added in case you need to generate your own self signed key pair. - Built-in LDAP Auth server. @@ -46,7 +46,7 @@ This server will answer type A queries. This is really handy when it's combined - Built-in WPAD Proxy Server. -This module will capture all HTTP requests from anyone launching Internet Explorer on the network if they have "Auto-detect settings" enabled. This module is higly effective. You can configure your custom PAC script in Responder.conf and inject HTML into the server's responses. See Responder.conf. +This module will capture all HTTP requests from anyone launching Internet Explorer on the network if they have "Auto-detect settings" enabled. This module is highly effective. You can configure your custom PAC script in Responder.conf and inject HTML into the server's responses. See Responder.conf. - Browser Listener diff --git a/Responder.py b/Responder.py index 29ef8dc..98fb366 100644 --- a/Responder.py +++ b/Responder.py @@ -201,7 +201,7 @@ def main(): thread.start_new(serve_thread_tcp,('', 3141, HTTP_Proxy)) if settings.Config.SMB_On_Off: - if settings.Config.LM_On_Off == True: + if settings.Config.LM_On_Off: from servers.SMB import SMB1LM thread.start_new(serve_thread_tcp,('', 445, SMB1LM)) thread.start_new(serve_thread_tcp,('', 139, SMB1LM)) diff --git a/odict.py b/odict.py index 56abb70..343ca48 100644 --- a/odict.py +++ b/odict.py @@ -77,7 +77,7 @@ class OrderedDict(dict, DictMixin): inst_dict = vars(self).copy() self.__map, self.__end = tmp if inst_dict: - return (self.__class__, (items,), inst_dict) + return self.__class__, (items,), inst_dict return self.__class__, (items,) def keys(self): diff --git a/packets.py b/packets.py index d3fbe63..6ec66d1 100644 --- a/packets.py +++ b/packets.py @@ -74,7 +74,7 @@ class DNS_Ans(Packet): ("AnswerPointer", "\xc0\x0c"), ("Type1", "\x00\x01"), ("Class1", "\x00\x01"), - ("TTL", "\x00\x00\x00\x1e"), #30 secs, dont mess with their cache for too long.. + ("TTL", "\x00\x00\x00\x1e"), #30 secs, don't mess with their cache for too long.. ("IPLen", "\x00\x04"), ("IP", "\x00\x00\x00\x00"), ]) @@ -169,7 +169,7 @@ class NTLM_Challenge(Packet): ("Av5Len", "\x12\x00"), ("Av5Str", "smb.local"), ("Av6", "\x00\x00"),#AvPairs Terminator - ("Av6Len", "\x00\x00"), + ("Av6Len", "\x00\x00"), ]) def calculate(self): @@ -180,7 +180,7 @@ class NTLM_Challenge(Packet): self.fields["Av3Str"] = self.fields["Av3Str"].encode('utf-16le') self.fields["Av4Str"] = self.fields["Av4Str"].encode('utf-16le') self.fields["Av5Str"] = self.fields["Av5Str"].encode('utf-16le') - + # Then calculate CalculateNameOffset = str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"]) CalculateAvPairsOffset = CalculateNameOffset+str(self.fields["TargetNameStr"]) @@ -209,8 +209,8 @@ class IIS_Auth_401_Ans(Packet): ("Type", "Content-Type: text/html\r\n"), ("WWW-Auth", "WWW-Authenticate: NTLM\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"), - ("Len", "Content-Length: 0\r\n"), - ("CRLF", "\r\n"), + ("Len", "Content-Length: 0\r\n"), + ("CRLF", "\r\n"), ]) class IIS_Auth_Granted(Packet): @@ -222,7 +222,7 @@ class IIS_Auth_Granted(Packet): ("WWW-Auth", "WWW-Authenticate: NTLM\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("ContentLen", "Content-Length: "), - ("ActualLen", "76"), + ("ActualLen", "76"), ("CRLF", "\r\n\r\n"), ("Payload", "\n\n\n\nLoading\n\n\n"), ]) @@ -240,7 +240,7 @@ class IIS_NTLM_Challenge_Ans(Packet): ("Payload-CRLF", "\r\n"), ("PoweredBy", "X-Powered-By: ASP.NC0CD7B7802C76736E9B26FB19BEB2D36290B9FF9A46EDDA5ET\r\n"), ("Len", "Content-Length: 0\r\n"), - ("CRLF", "\r\n"), + ("CRLF", "\r\n"), ]) def calculate(self,payload): @@ -256,8 +256,8 @@ class IIS_Basic_401_Ans(Packet): ("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("AllowOrigin", "Access-Control-Allow-Origin: *\r\n"), ("AllowCreds", "Access-Control-Allow-Credentials: true\r\n"), - ("Len", "Content-Length: 0\r\n"), - ("CRLF", "\r\n"), + ("Len", "Content-Length: 0\r\n"), + ("CRLF", "\r\n"), ]) ##### Proxy mode Packets ##### @@ -269,7 +269,7 @@ class WPADScript(Packet): ("Type", "Content-Type: application/x-ns-proxy-autoconfig\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("ContentLen", "Content-Length: "), - ("ActualLen", "76"), + ("ActualLen", "76"), ("CRLF", "\r\n\r\n"), ("Payload", "function FindProxyForURL(url, host){return 'PROXY wpadwpadwpad:3141; DIRECT';}"), ]) @@ -288,7 +288,7 @@ class ServeExeFile(Packet): ("ContentDiFile", ""), ("FileCRLF", ";\r\n"), ("ContentLen", "Content-Length: "), - ("ActualLen", "76"), + ("ActualLen", "76"), ("Date", "\r\nDate: Thu, 24 Oct 2013 22:35:46 GMT\r\n"), ("Connection", "Connection: keep-alive\r\n"), ("X-CCC", "US\r\n"), @@ -308,7 +308,7 @@ class ServeHtmlFile(Packet): ("Server", "Server: Microsoft-IIS/7.5\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("ContentLen", "Content-Length: "), - ("ActualLen", "76"), + ("ActualLen", "76"), ("Date", "\r\nDate: Thu, 24 Oct 2013 22:35:46 GMT\r\n"), ("Connection", "Connection: keep-alive\r\n"), ("CRLF", "\r\n"), @@ -330,7 +330,7 @@ class FTPPacket(Packet): class MSSQLPreLoginAnswer(Packet): fields = OrderedDict([ ("PacketType", "\x04"), - ("Status", "\x01"), + ("Status", "\x01"), ("Len", "\x00\x25"), ("SPID", "\x00\x00"), ("PacketID", "\x01"), @@ -352,7 +352,7 @@ class MSSQLPreLoginAnswer(Packet): ("SubBuild", "\x00\x00"), ("EncryptionStr", "\x02"), ("InstOptStr", "\x00"), - ]) + ]) def calculate(self): CalculateCompletePacket = str(self.fields["PacketType"])+str(self.fields["Status"])+str(self.fields["Len"])+str(self.fields["SPID"])+str(self.fields["PacketID"])+str(self.fields["Window"])+str(self.fields["TokenType"])+str(self.fields["VersionOffset"])+str(self.fields["VersionLen"])+str(self.fields["TokenType1"])+str(self.fields["EncryptionOffset"])+str(self.fields["EncryptionLen"])+str(self.fields["TokenType2"])+str(self.fields["InstOptOffset"])+str(self.fields["InstOptLen"])+str(self.fields["TokenTypeThrdID"])+str(self.fields["ThrdIDOffset"])+str(self.fields["ThrdIDLen"])+str(self.fields["ThrdIDTerminator"])+str(self.fields["VersionStr"])+str(self.fields["SubBuild"])+str(self.fields["EncryptionStr"])+str(self.fields["InstOptStr"]) @@ -376,7 +376,7 @@ class MSSQLPreLoginAnswer(Packet): class MSSQLNTLMChallengeAnswer(Packet): fields = OrderedDict([ - ("PacketType", "\x04"), + ("PacketType", "\x04"), ("Status", "\x01"), ("Len", "\x00\xc7"), ("SPID", "\x00\x00"), @@ -415,7 +415,7 @@ class MSSQLNTLMChallengeAnswer(Packet): ("Av5Str", "smb.local"), ("Av6", "\x00\x00"),#AvPairs Terminator ("Av6Len", "\x00\x00"), - ]) + ]) def calculate(self): # First convert to unicode @@ -425,7 +425,7 @@ class MSSQLNTLMChallengeAnswer(Packet): self.fields["Av3Str"] = self.fields["Av3Str"].encode('utf-16le') self.fields["Av4Str"] = self.fields["Av4Str"].encode('utf-16le') self.fields["Av5Str"] = self.fields["Av5Str"].encode('utf-16le') - + # Then calculate CalculateCompletePacket = str(self.fields["PacketType"])+str(self.fields["Status"])+str(self.fields["Len"])+str(self.fields["SPID"])+str(self.fields["PacketID"])+str(self.fields["Window"])+str(self.fields["TokenType"])+str(self.fields["SSPIBuffLen"])+str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"])+str(self.fields["TargetNameStr"])+str(self.fields["Av1"])+str(self.fields["Av1Len"])+str(self.fields["Av1Str"])+str(self.fields["Av2"])+str(self.fields["Av2Len"])+str(self.fields["Av2Str"])+str(self.fields["Av3"])+str(self.fields["Av3Len"])+str(self.fields["Av3Str"])+str(self.fields["Av4"])+str(self.fields["Av4Len"])+str(self.fields["Av4Str"])+str(self.fields["Av5"])+str(self.fields["Av5Len"])+str(self.fields["Av5Str"])+str(self.fields["Av6"])+str(self.fields["Av6Len"]) CalculateSSPI = str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"])+str(self.fields["TargetNameStr"])+str(self.fields["Av1"])+str(self.fields["Av1Len"])+str(self.fields["Av1Str"])+str(self.fields["Av2"])+str(self.fields["Av2Len"])+str(self.fields["Av2Str"])+str(self.fields["Av3"])+str(self.fields["Av3Len"])+str(self.fields["Av3Str"])+str(self.fields["Av4"])+str(self.fields["Av4Len"])+str(self.fields["Av4Str"])+str(self.fields["Av5"])+str(self.fields["Av5Len"])+str(self.fields["Av5Str"])+str(self.fields["Av6"])+str(self.fields["Av6Len"]) @@ -454,59 +454,59 @@ class MSSQLNTLMChallengeAnswer(Packet): class SMTPGreeting(Packet): fields = OrderedDict([ ("Code", "220"), - ("Separator", "\x20"), + ("Separator", "\x20"), ("Message", "smtp01.local ESMTP"), ("CRLF", "\x0d\x0a"), - ]) + ]) class SMTPAUTH(Packet): fields = OrderedDict([ ("Code0", "250"), - ("Separator0", "\x2d"), + ("Separator0", "\x2d"), ("Message0", "smtp01.local"), ("CRLF0", "\x0d\x0a"), ("Code", "250"), - ("Separator", "\x20"), + ("Separator", "\x20"), ("Message", "AUTH LOGIN PLAIN XYMCOOKIE"), ("CRLF", "\x0d\x0a"), - ]) + ]) class SMTPAUTH1(Packet): fields = OrderedDict([ ("Code", "334"), - ("Separator", "\x20"), + ("Separator", "\x20"), ("Message", "VXNlcm5hbWU6"),#Username ("CRLF", "\x0d\x0a"), - ]) + ]) class SMTPAUTH2(Packet): fields = OrderedDict([ ("Code", "334"), - ("Separator", "\x20"), + ("Separator", "\x20"), ("Message", "UGFzc3dvcmQ6"),#Password ("CRLF", "\x0d\x0a"), - ]) + ]) ##### IMAP Packets ##### class IMAPGreeting(Packet): fields = OrderedDict([ ("Code", "* OK IMAP4 service is ready."), - ("CRLF", "\r\n"), - ]) + ("CRLF", "\r\n"), + ]) class IMAPCapability(Packet): fields = OrderedDict([ ("Code", "* CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN"), - ("CRLF", "\r\n"), - ]) + ("CRLF", "\r\n"), + ]) class IMAPCapabilityEnd(Packet): fields = OrderedDict([ ("Tag", ""), ("Message", " OK CAPABILITY completed."), - ("CRLF", "\r\n"), - ]) + ("CRLF", "\r\n"), + ]) ##### POP3 Packets ##### class POPOKPacket(Packet): @@ -659,10 +659,10 @@ class LDAPNTLMChallenge(Packet): ("NTLMSSPNTLMChallengeAVPairsUnicodeStr", "smb12"), ("NTLMSSPNTLMChallengeAVPairs1Id", "\x01\x00"), ("NTLMSSPNTLMChallengeAVPairs1Len", "\x1e\x00"), - ("NTLMSSPNTLMChallengeAVPairs1UnicodeStr", "SERVER2008"), + ("NTLMSSPNTLMChallengeAVPairs1UnicodeStr", "SERVER2008"), ("NTLMSSPNTLMChallengeAVPairs2Id", "\x04\x00"), ("NTLMSSPNTLMChallengeAVPairs2Len", "\x1e\x00"), - ("NTLMSSPNTLMChallengeAVPairs2UnicodeStr", "smb12.local"), + ("NTLMSSPNTLMChallengeAVPairs2UnicodeStr", "smb12.local"), ("NTLMSSPNTLMChallengeAVPairs3Id", "\x03\x00"), ("NTLMSSPNTLMChallengeAVPairs3Len", "\x1e\x00"), ("NTLMSSPNTLMChallengeAVPairs3UnicodeStr", "SERVER2008.smb12.local"), @@ -734,7 +734,7 @@ class SMBNego(Packet): ("bcc", "\x62\x00"), ("data", "") ]) - + def calculate(self): self.fields["bcc"] = struct.pack("