From c33da69a8b96f796b4f08042ddc22f09f367d57d Mon Sep 17 00:00:00 2001 From: HexPandaa <47880094+HexPandaa@users.noreply.github.com> Date: Fri, 2 Apr 2021 17:00:35 +0200 Subject: [PATCH 01/10] Use `==` instead of `is` `==` should be used when comparing values, `is` should be used to compare identities. --- tools/SMBFinger/Finger.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/SMBFinger/Finger.py b/tools/SMBFinger/Finger.py index b779abb..04c139a 100755 --- a/tools/SMBFinger/Finger.py +++ b/tools/SMBFinger/Finger.py @@ -47,20 +47,20 @@ SMB1 = "Enabled" def StructWithLenPython2or3(endian,data): #Python2... - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return struct.pack(endian, data) #Python3... else: return struct.pack(endian, data).decode('latin-1') def NetworkSendBufferPython2or3(data): - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return str(data) else: return bytes(str(data), 'latin-1') def NetworkRecvBufferPython2or3(data): - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return str(data) else: return str(data.decode('latin-1')) From f4c11111a78f5e93961bf5a3598c2460eff6f9cc Mon Sep 17 00:00:00 2001 From: HexPandaa <47880094+HexPandaa@users.noreply.github.com> Date: Fri, 2 Apr 2021 17:03:56 +0200 Subject: [PATCH 02/10] Compare strings with `==` instead of `is` `==` should be used when comparing values, `is` should be used to compare identities. Modern versions of Python throw a SyntaxWarning. --- tools/MultiRelay/RelayMultiCore.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/MultiRelay/RelayMultiCore.py b/tools/MultiRelay/RelayMultiCore.py index 31d0dfc..d82856a 100644 --- a/tools/MultiRelay/RelayMultiCore.py +++ b/tools/MultiRelay/RelayMultiCore.py @@ -66,20 +66,20 @@ class Packet(): def StructWithLenPython2or3(endian,data): #Python2... - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return struct.pack(endian, data) #Python3... else: return struct.pack(endian, data).decode('latin-1') def NetworkSendBufferPython2or3(data): - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return str(data) else: return bytes(str(data), 'latin-1') def NetworkRecvBufferPython2or3(data): - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return str(data) else: return str(data.decode('latin-1')) From 3d9147f36c8967a9db63be7732b52c3d9ad0d391 Mon Sep 17 00:00:00 2001 From: HexPandaa <47880094+HexPandaa@users.noreply.github.com> Date: Fri, 2 Apr 2021 17:04:36 +0200 Subject: [PATCH 03/10] Compare strings with `==` instead of `is` `==` should be used when comparing values, `is` should be used to compare identities. Modern versions of Python throw a SyntaxWarning. --- tools/MultiRelay/RelayMultiPackets.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/MultiRelay/RelayMultiPackets.py b/tools/MultiRelay/RelayMultiPackets.py index 2aa164e..095059b 100644 --- a/tools/MultiRelay/RelayMultiPackets.py +++ b/tools/MultiRelay/RelayMultiPackets.py @@ -45,7 +45,7 @@ else: def StructWithLenPython2or3(endian,data): #Python2... - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return struct.pack(endian, data) #Python3... else: From 51f176633e1ade08e1e1976083bdbeff0ca3eebb Mon Sep 17 00:00:00 2001 From: HexPandaa <47880094+HexPandaa@users.noreply.github.com> Date: Fri, 2 Apr 2021 17:10:17 +0200 Subject: [PATCH 04/10] Compare values with `==` instead of `is` `==` should be used when comparing values, `is` should be used to compare identities. Modern versions of Python throw a SyntaxWarning. --- tools/MultiRelay.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/MultiRelay.py b/tools/MultiRelay.py index 8a046f2..cabbf17 100755 --- a/tools/MultiRelay.py +++ b/tools/MultiRelay.py @@ -29,7 +29,7 @@ import time import random import subprocess from threading import Thread -if PY2OR3 is "PY3": +if PY2OR3 == "PY3": from socketserver import TCPServer, UDPServer, ThreadingMixIn, BaseRequestHandler else: from SocketServer import TCPServer, UDPServer, ThreadingMixIn, BaseRequestHandler @@ -159,13 +159,13 @@ Logs = logging Logs.basicConfig(filemode="w",filename=Logs_Path+'logs/SMBRelay-Session.txt',level=logging.INFO, format='%(asctime)s - %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p') def NetworkSendBufferPython2or3(data): - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return str(data) else: return bytes(str(data), 'latin-1') def NetworkRecvBufferPython2or3(data): - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return str(data) else: return str(data.decode('latin-1')) @@ -446,12 +446,12 @@ class SMBRelay(BaseRequestHandler): data = self.request.recv(4096) ## Make sure it's not a Kerberos auth. - if data.find(b'NTLM') is not -1: + if data.find(b'NTLM') != -1: ## Start with nego protocol + session setup negotiate to our target. data, smbdata, s, challenge = GrabNegotiateFromTarget(data, s, Pivoting) ## Make sure it's not a Kerberos auth. - if data.find(b'NTLM') is not -1: + if data.find(b'NTLM') != -1: ##Relay all that to our client. if data[8:10] == b'\x73\x00': head = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x43\xc8", errorcode="\x16\x00\x00\xc0", pid=pidcalc(data),mid=midcalc(data)) From 7d96fa95c466445fcd7c6f8439b8800f3a2994c1 Mon Sep 17 00:00:00 2001 From: HexPandaa <47880094+HexPandaa@users.noreply.github.com> Date: Fri, 2 Apr 2021 17:13:05 +0200 Subject: [PATCH 05/10] Compare strings with `==` instead of `is` `==` should be used when comparing values, `is` should be used to compare identities. Modern versions of Python throw a SyntaxWarning. --- tools/RunFingerPackets.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/RunFingerPackets.py b/tools/RunFingerPackets.py index a112ef6..651849b 100644 --- a/tools/RunFingerPackets.py +++ b/tools/RunFingerPackets.py @@ -11,7 +11,7 @@ else: def StructWithLenPython2or3(endian,data): #Python2... - if PY2OR3 is "PY2": + if PY2OR3 == "PY2": return struct.pack(endian, data) #Python3... else: From 0b669c305d08d01dbc60edcf8fe466b25ea290b4 Mon Sep 17 00:00:00 2001 From: lgandx Date: Fri, 16 Apr 2021 22:32:51 -0300 Subject: [PATCH 06/10] Update README.md Added Synacktiv as major donor. --- README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 53ba5ad..ba415d6 100644 --- a/README.md +++ b/README.md @@ -176,9 +176,11 @@ Or BTC address: Late Responder development has been possible because of the donations received from individuals and companies. -We would like to thanks those major donator: +We would like to thanks those major sponsors: -- SecureWorks : https://www.secureworks.com/ +- SecureWorks: https://www.secureworks.com/ + +- Synacktiv: https://www.synacktiv.com/ - Black Hills Information Security: http://www.blackhillsinfosec.com/ From 465f730846c59fa0a3c22deb48e70c0198d4f89e Mon Sep 17 00:00:00 2001 From: lgandx Date: Mon, 19 Apr 2021 01:32:38 -0300 Subject: [PATCH 07/10] Update README.md --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index ba415d6..ee68639 100644 --- a/README.md +++ b/README.md @@ -194,6 +194,12 @@ We would like to thanks those major sponsors: Thank you. +## Official Discord Channel + +Come hang out on Discord! + +[![Porchetta Industries](https://discordapp.com/api/guilds/736724457258745996/widget.png?style=banner3)](https://discord.gg/sEkn3aa) + ## Copyright ## NBT-NS/LLMNR Responder From 53d66e3816ecc9e949e8549a17e20d69cddebe11 Mon Sep 17 00:00:00 2001 From: lgandx Date: Mon, 19 Apr 2021 12:29:36 -0300 Subject: [PATCH 08/10] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index ee68639..d89cc20 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Author: Laurent Gaffie https://g-laurent.blogspot.c Responder is an LLMNR, NBT-NS and MDNS poisoner. It will answer to *specific* NBT-NS (NetBIOS Name Service) queries based on their name suffix (see: http://support.microsoft.com/kb/163409). By default, the tool will only answer to File Server Service request, which is for SMB. -The concept behind this is to target our answers, and be stealthier on the network. This also helps to ensure that we don't break legitimate NBT-NS behavior. You can set the -r option via command line if you want to answer to the Workstation Service request name suffix. +The concept behind this is to target our answers, and be stealthier on the network. This also helps to ensure that we don't break legitimate NBT-NS behavior. You can set the -r option via command line if you want to answer to the Workstation Service request name suffix. The option -d is also available if you want to poison Domain Service name queries. ## Features ## From b779d1b49461d4c00cc16d3c37872ac556a2e357 Mon Sep 17 00:00:00 2001 From: lgandx Date: Mon, 19 Apr 2021 12:38:21 -0300 Subject: [PATCH 09/10] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index d89cc20..f674562 100644 --- a/README.md +++ b/README.md @@ -16,11 +16,11 @@ The concept behind this is to target our answers, and be stealthier on the netwo - Built-in SMB Auth server. -Supports NTLMv1, NTLMv2 hashes with Extended Security NTLMSSP by default. Successfully tested from Windows 95 to Server 2012 RC, Samba and Mac OSX Lion. Clear text password is supported for NT4, and LM hashing downgrade when the --lm option is set. SMBv2 has also been implemented and is supported by default. +Supports NTLMv1, NTLMv2 hashes with Extended Security NTLMSSP by default. Successfully tested from Windows 95 to Server 2022, Samba and Mac OSX Lion. Clear text password is supported for NT4, and LM hashing downgrade when the --lm option is set. SMBv2 has also been implemented and is supported by default. - Built-in MSSQL Auth server. -In order to redirect SQL Authentication to this tool, you will need to set the option -r (NBT-NS queries for SQL Server lookup are using the Workstation Service name suffix) for systems older than windows Vista (LLMNR will be used for Vista and higher). This server supports NTLMv1, LMv2 hashes. This functionality was successfully tested on Windows SQL Server 2005 & 2008. +In order to redirect SQL Authentication to this tool, you will need to set the option -r (NBT-NS queries for SQL Server lookup are using the Workstation Service name suffix) for systems older than windows Vista (LLMNR will be used for Vista and higher). This server supports NTLMv1, LMv2 hashes. This functionality was successfully tested on Windows SQL Server 2005, 2008, 2012, 2019. - Built-in HTTP Auth server. From 35a02e389bfbc755673a2cfb58d289569f286ada Mon Sep 17 00:00:00 2001 From: lgandx Date: Mon, 19 Apr 2021 12:50:44 -0300 Subject: [PATCH 10/10] Update README.md --- README.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index f674562..44a8baa 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ In order to redirect SQL Authentication to this tool, you will need to set the o - Built-in HTTP Auth server. -In order to redirect HTTP Authentication to this tool, you will need to set the option -r for Windows version older than Vista (NBT-NS queries for HTTP server lookup are sent using the Workstation Service name suffix). For Vista and higher, LLMNR will be used. This server supports NTLMv1, NTLMv2 hashes *and* Basic Authentication. This server was successfully tested on IE 6 to IE 10, Firefox, Chrome, Safari. +In order to redirect HTTP Authentication to this tool, you will need to set the option -r for Windows version older than Vista (NBT-NS queries for HTTP server lookup are sent using the Workstation Service name suffix). For Vista and higher, LLMNR will be used. This server supports NTLMv1, NTLMv2 hashes *and* Basic Authentication. This server was successfully tested on IE 6 to IE 11, Edge, Firefox, Chrome, Safari. Note: This module also works for WebDav NTLM authentication issued from Windows WebDav clients (WebClient). You can now send your custom files to a victim. @@ -34,7 +34,11 @@ Same as above. The folder certs/ contains 2 default keys, including a dummy pri - Built-in LDAP Auth server. -In order to redirect LDAP Authentication to this tool, you will need to set the option -r for Windows version older than Vista (NBT-NS queries for HTTP server lookup are sent using the Workstation Service name suffix). For Vista and higher, LLMNR will be used. This server supports NTLMSSP hashes and Simple Authentication (clear text authentication). This server was successfully tested on Windows Support tool "ldp" and LdapAdmin. +In order to redirect LDAP Authentication to this tool, you will need to set the option -r for Windows version older than Vista (NBT-NS queries for LDAP server lookup are sent using the Workstation Service name suffix). For Vista and higher, LLMNR will be used. This server supports NTLMSSP hashes and Simple Authentication (clear text authentication). This server was successfully tested on Windows Support tool "ldp" and LdapAdmin. + +- Built-in DCE-RPC Auth server. + +In order to redirect DCE-RPC Authentication to this tool, you will need to set the option -r and -d (NBT-NS queries for DCE-RPC server lookup are sent using the Workstation and Domain Service name suffix). For Vista and higher, LLMNR will be used. This server supports NTLMSSP hashes. This server was successfully tested on Windows XP to Server 2019. - Built-in FTP, POP3, IMAP, SMTP Auth servers. @@ -42,7 +46,7 @@ This modules will collect clear text credentials. - Built-in DNS server. -This server will answer type A queries. This is really handy when it's combined with ARP spoofing. +This server will answer type SRV and A queries. This is really handy when it's combined with ARP spoofing. - Built-in WPAD Proxy Server. @@ -66,7 +70,7 @@ For MITM on Windows XP/2003 and earlier Domain members. This attack combined wit python tools/DHCP.py -DHCP Inform Spoofing. Allows you to let the real DHCP Server issue IP addresses, and then send a DHCP Inform answer to set your IP address as a primary DNS server, and your own WPAD URL. +DHCP Inform Spoofing. Allows you to let the real DHCP Server issue IP addresses, and then send a DHCP Inform answer to set your IP address as a primary DNS server, and your own WPAD URL. To inject a DNS server, domain, route on all Windows version and any linux box, use -R - Analyze mode. @@ -89,7 +93,7 @@ Additionally, all captured hashed are logged into an SQLite database which you c ## Considerations ## -- This tool listens on several ports: UDP 137, UDP 138, UDP 53, UDP/TCP 389,TCP 1433, UDP 1434, TCP 80, TCP 139, TCP 445, TCP 21, TCP 3141,TCP 25, TCP 110, TCP 587, TCP 3128, Multicast UDP 5355 and 5353. +- This tool listens on several ports: UDP 137, UDP 138, UDP 53, UDP/TCP 389,TCP 1433, UDP 1434, TCP 80, TCP 135, TCP 139, TCP 445, TCP 21, TCP 3141,TCP 25, TCP 110, TCP 587, TCP 3128, Multicast UDP 5355 and 5353. - If you run Samba on your system, stop smbd and nmbd and all other services listening on these ports.