github/Responder
1
0
Fork 0
mirror of https://github.com/lgandx/Responder.git synced 2025-08-20 13:23:38 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Removed: old style options. Just use -r instead of -r On

Browse source
This commit is contained in:
lgandx 2014-04-23 00:20:00 -04:00
commit a21aaf7987
3 changed files with 79 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

7
CHANGELOG
View file

@ -1,4 +1,9 @@
ChangeLog Responder 2.0: ChangeLog Responder 2.0.8:
- Removed: Old style options (On/Off). Just use -r instead of -r On.
- Added [DHCP.py]: in-scope target, windows >= Vista support (-R) and unicast answers only.
- Added: In-scope llmnr/nbt-ns name option
- Added: Kerberos hash support
- Added: DHCP INFORM take over tool (DHCP.py)
- Added: MDNS Poisoner. - Added: MDNS Poisoner.
- Added: -F command line switch to force NTLM authentication on PAC file retrieval. - Added: -F command line switch to force NTLM authentication on PAC file retrieval.
- Added: Ability to inject custom HTML in HTTP responses. - Added: Ability to inject custom HTML in HTTP responses.

78
README.md
View file

@ -11,7 +11,7 @@ suffix (see: http://support.microsoft.com/kb/163409). By default, the
tool will only answers to File Server Service request, which is for SMB. tool will only answers to File Server Service request, which is for SMB.
The concept behind this, is to target our answers, and be stealthier on The concept behind this, is to target our answers, and be stealthier on
the network. This also helps to ensure that we don't break legitimate the network. This also helps to ensure that we don't break legitimate
NBT-NS behavior. You can set the -r option to "On" via command line if NBT-NS behavior. You can set the -r option via command line if
you want this tool to answer to the Workstation Service request name you want this tool to answer to the Workstation Service request name
suffix. suffix.
@ -22,12 +22,12 @@ FEATURES
Supports NTLMv1, NTLMv2 hashes with Extended Security NTLMSSP by default. Supports NTLMv1, NTLMv2 hashes with Extended Security NTLMSSP by default.
Successfully tested from Windows 95 to Server 2012 RC, Samba and Mac OSX Lion. Successfully tested from Windows 95 to Server 2012 RC, Samba and Mac OSX Lion.
Clear text password is supported for NT4, and LM hashing downgrade when the Clear text password is supported for NT4, and LM hashing downgrade when the
--lm option is set to On. This functionality is enabled by default when the --lm option is set. This functionality is enabled by default when the
tool is launched. tool is launched.
- Built-in MSSQL Auth server. - Built-in MSSQL Auth server.
In order to redirect SQL Authentication to this tool, you will need to In order to redirect SQL Authentication to this tool, you will need to
set the option -r to On(NBT-NS queries for SQL Server lookup are using set the option -r (NBT-NS queries for SQL Server lookup are using
the Workstation Service name suffix) for systems older than windows the Workstation Service name suffix) for systems older than windows
Vista (LLMNR will be used for Vista and higher). This server supports Vista (LLMNR will be used for Vista and higher). This server supports
NTLMv1, LMv2 hashes. This functionality was successfully tested on NTLMv1, LMv2 hashes. This functionality was successfully tested on
@ -35,7 +35,7 @@ FEATURES
- Built-in HTTP Auth server. - Built-in HTTP Auth server.
In order to redirect HTTP Authentication to this tool, you will need In order to redirect HTTP Authentication to this tool, you will need
to set the option -r to On for Windows version older than Vista (NBT-NS to set the option -r for Windows version older than Vista (NBT-NS
queries for HTTP server lookup are sent using the Workstation Service queries for HTTP server lookup are sent using the Workstation Service
name suffix). For Vista and higher, LLMNR will be used. This server name suffix). For Vista and higher, LLMNR will be used. This server
supports NTLMv1, NTLMv2 hashes *and* Basic Authentication. This server supports NTLMv1, NTLMv2 hashes *and* Basic Authentication. This server
@ -45,7 +45,7 @@ FEATURES
- Built-in HTTPS Auth server. - Built-in HTTPS Auth server.
In order to redirect HTTPS Authentication to this tool, you will need In order to redirect HTTPS Authentication to this tool, you will need
 to set the -r option to On for Windows versions older than Vista (NBT-NS  to set the -r option for Windows versions older than Vista (NBT-NS
 queries for HTTP server lookups are sent using the Workstation Service  queries for HTTP server lookups are sent using the Workstation Service
 name suffix). For Vista and higher, LLMNR will be used. This server  name suffix). For Vista and higher, LLMNR will be used. This server
 supports NTLMv1, NTLMv2, *and* Basic Authentication. This server  supports NTLMv1, NTLMv2, *and* Basic Authentication. This server
@ -57,7 +57,7 @@ FEATURES
- Built-in LDAP Auth server. - Built-in LDAP Auth server.
In order to redirect LDAP Authentication to this tool, you will need In order to redirect LDAP Authentication to this tool, you will need
to set the option -r to On for Windows version older than Vista (NBT-NS to set the option -r for Windows version older than Vista (NBT-NS
queries for HTTP server lookup are sent using the Workstation Service queries for HTTP server lookup are sent using the Workstation Service
name suffix). For Vista and higher, LLMNR will be used. This server name suffix). For Vista and higher, LLMNR will be used. This server
supports NTLMSSP hashes and Simple Authentication (clear text authentication). supports NTLMSSP hashes and Simple Authentication (clear text authentication).
@ -118,52 +118,60 @@ USAGE
First of all, please take a look at Responder.conf and set it for your needs. First of all, please take a look at Responder.conf and set it for your needs.
Running this tool: Running this tool:
- python Responder.py [options] - ./Responder.py [options]
Usage Example: Usage Example:
python Responder.py -i 10.20.30.40 -r On -F On -w On ./Responder.py -i 10.20.30.40 -w -r -f
or:
python Responder.py -i 10.20.30.40 -wrf
Options List: Options List:
-h, --help show this help message and exit. -h, --help show this help message and exit
-i 10.20.30.40, --ip=10.20.30.40 The ip address to redirect the traffic to. -A, --analyze Analyze mode. This option allows you to see NBT-NS,
(usually yours) BROWSER, LLMNR requests from which workstation to
which workstation without poisoning anything.
-I eth0, --interface=eth0 Network interface to use -i 10.20.30.40, --ip=10.20.30.40
The ip address to redirect the traffic to. (usually
yours)
-b Off, --basic=Off Set this to On if you want to return a -I eth0, --interface=eth0 Network interface to use
Basic HTTP authentication. Off will return
an NTLM authentication.
-r Off, --wredir=Off Set this to On to enable answers for netbios -b, --basic Set this if you want to return a Basic HTTP
wredir suffix queries. Answering to wredir authentication. If not set, an NTLM authentication
will likely break stuff on the network will be returned.
(like classics 'nbns spoofer' will).
Default value is therefore set to Off.
-f Off, --fingerprint=Off This option allows you to fingerprint a -r, --wredir Set this to enable answers for netbios wredir suffix
host that issued an NBT-NS or LLMNR query. queries. Answering to wredir will likely break stuff
on the network (like classics 'nbns spoofer' would).
Default value is therefore set to False
-w On, --wpad=On Set this to On or Off to start/stop the WPAD rogue -d, --NBTNSdomain Set this to enable answers for netbios domain suffix
proxy server. Default value is Off queries. Answering to domain suffixes will likely
break stuff on the network (like a classic 'nbns
spoofer' would). Default value is therefore set to
False
--lm=Off Set this to On if you want to force LM hashing -f, --fingerprint This option allows you to fingerprint a host that
downgrade for Windows XP/2003 and earlier. Default value is Off issued an NBT-NS or LLMNR query.
-F Off, --ForceWpadAuth=Off Set this to On or Off to force NTLM/Basic authentication on -w, --wpad Set this to start the WPAD rogue proxy server. Default
wpad.dat file retrieval. This might cause a login prompt in value is False
some specific cases. Default value is Off
-A, --analyze Analyze mode. This option allows you to see NBT-NS,BROWSER, -F, --ForceWpadAuth Set this if you want to force NTLM/Basic
LLMNR requests from which workstation to which workstation authentication on wpad.dat file retrieval. This might
without poisoning any requests. Also, you can map domains, cause a login prompt in some specific cases.
MSSQL servers, workstations passively. Therefore, default value is False
--lm Set this if you want to force LM hashing downgrade for
Windows XP/2003 and earlier. Default value is False
-v More verbose -v More verbose
For more information read these posts: For more information read these posts:

59
Responder.py
View file

@ -23,28 +23,28 @@ from odict import OrderedDict
from socket import inet_aton from socket import inet_aton
from random import randrange from random import randrange
parser = optparse.OptionParser(usage='python %prog -i 10.20.30.40 -b On -r On', parser = optparse.OptionParser(usage='python %prog -i 10.20.30.40 -w -r -f\nor:\npython %prog -i 10.20.30.40 -wrf',
prog=sys.argv[0], prog=sys.argv[0],
) )
parser.add_option('-A','--analyze', action="store_true", help="Analyze mode. This option allows you to see NBT-NS, BROWSER, LLMNR requests from which workstation to which workstation without poisoning anything.", metavar="10.20.30.40",dest="Analyse") parser.add_option('-A','--analyze', action="store_true", help="Analyze mode. This option allows you to see NBT-NS, BROWSER, LLMNR requests from which workstation to which workstation without poisoning anything.", dest="Analyse")
parser.add_option('-i','--ip', action="store", help="The ip address to redirect the traffic to. (usually yours)", metavar="10.20.30.40",dest="OURIP") parser.add_option('-i','--ip', action="store", help="The ip address to redirect the traffic to. (usually yours)", metavar="10.20.30.40",dest="OURIP")
parser.add_option('-I','--interface', action="store", help="Network interface to use", metavar="eth0", dest="INTERFACE", default="Not set") parser.add_option('-I','--interface', action="store", help="Network interface to use", metavar="eth0", dest="INTERFACE", default="Not set")
parser.add_option('-b', '--basic',action="store", help="Set this to On if you want to return a Basic HTTP authentication. Off will return an NTLM authentication.This option is mandatory.", metavar="Off",dest="Basic", choices=['On','on','off','Off'], default="Off") parser.add_option('-b', '--basic',action="store_true", help="Set this if you want to return a Basic HTTP authentication. If not set, an NTLM authentication will be returned.", dest="Basic", default=False)
parser.add_option('-r', '--wredir',action="store", help="Set this to enable answers for netbios wredir suffix queries. Answering to wredir will likely break stuff on the network (like classics 'nbns spoofer' will). Default value is therefore set to Off", metavar="Off",dest="Wredirect", choices=['On','on','off','Off'], default="Off") parser.add_option('-r', '--wredir',action="store_true", help="Set this to enable answers for netbios wredir suffix queries. Answering to wredir will likely break stuff on the network (like classics 'nbns spoofer' would). Default value is therefore set to False", dest="Wredirect", default=False)
parser.add_option('-d', '--NBTNSdomain',action="store", help="Set this to enable answers for netbios domain suffix queries. Answering to domain will likely break stuff on the network (like classics 'nbns spoofer' will). Default value is therefore set to Off", metavar="Off",dest="NBTNSDomain", choices=['On','on','off','Off'], default="Off") parser.add_option('-d', '--NBTNSdomain',action="store_true", help="Set this to enable answers for netbios domain suffix queries. Answering to domain suffixes will likely break stuff on the network (like a classic 'nbns spoofer' would). Default value is therefore set to False",dest="NBTNSDomain", default=False)
parser.add_option('-f','--fingerprint', action="store", dest="Finger", help = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query.", metavar="Off", choices=['On','on','off','Off'], default="Off") parser.add_option('-f','--fingerprint', action="store_true", dest="Finger", help = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query.", default=False)
parser.add_option('-w','--wpad', action="store", dest="WPAD_On_Off", help = "Set this to On or Off to start/stop the WPAD rogue proxy server. Default value is Off", metavar="On", choices=['On','on','off','Off'], default="Off") parser.add_option('-w','--wpad', action="store_true", dest="WPAD_On_Off", help = "Set this to start the WPAD rogue proxy server. Default value is False", default=False)
parser.add_option('-F','--ForceWpadAuth', action="store", dest="Force_WPAD_Auth", help = "Set this to On or Off to force NTLM/Basic authentication on wpad.dat file retrieval. This might cause a login prompt in some specific cases. Default value is Off", metavar="Off", choices=['On','on','off','Off'], default="Off") parser.add_option('-F','--ForceWpadAuth', action="store_true", dest="Force_WPAD_Auth", help = "Set this if you want to force NTLM/Basic authentication on wpad.dat file retrieval. This might cause a login prompt in some specific cases. Therefore, default value is False",default=False)
parser.add_option('--lm',action="store", help="Set this to On if you want to force LM hashing downgrade for Windows XP/2003 and earlier. Default value is Off", metavar="Off",dest="LM_On_Off", choices=['On','on','off','Off'], default="Off") parser.add_option('--lm',action="store_true", help="Set this if you want to force LM hashing downgrade for Windows XP/2003 and earlier. Default value is False", dest="LM_On_Off", default=False)
parser.add_option('-v',action="store_true", help="More verbose",dest="Verbose") parser.add_option('-v',action="store_true", help="More verbose",dest="Verbose")
@ -85,15 +85,15 @@ RespondToName = config.get('Responder Core', 'RespondToName').strip()
RespondToName.split(",") RespondToName.split(",")
#Cli options. #Cli options.
OURIP = options.OURIP OURIP = options.OURIP
LM_On_Off = options.LM_On_Off.upper() LM_On_Off = options.LM_On_Off
WPAD_On_Off = options.WPAD_On_Off.upper() WPAD_On_Off = options.WPAD_On_Off
Wredirect = options.Wredirect.upper() Wredirect = options.Wredirect
NBTNSDomain = options.NBTNSDomain.upper() NBTNSDomain = options.NBTNSDomain
Basic = options.Basic.upper() Basic = options.Basic
Finger_On_Off = options.Finger.upper() Finger_On_Off = options.Finger
INTERFACE = options.INTERFACE INTERFACE = options.INTERFACE
Verbose = options.Verbose Verbose = options.Verbose
Force_WPAD_Auth = options.Force_WPAD_Auth.upper() Force_WPAD_Auth = options.Force_WPAD_Auth
AnalyzeMode = options.Analyse AnalyzeMode = options.Analyse
if INTERFACE != "Not set": if INTERFACE != "Not set":
@ -203,7 +203,7 @@ Challenge = ""
for i in range(0,len(NumChal),2): for i in range(0,len(NumChal),2):
Challenge += NumChal[i:i+2].decode("hex") Challenge += NumChal[i:i+2].decode("hex")
Show_Help("[+]NBT-NS, LLMNR & MDNS responder started\n[+]Loading Responder.conf File..\nGlobal Parameters set:\nResponder is bound to this interface:%s\nChallenge set is:%s\nWPAD Proxy Server is:%s\nWPAD script loaded:%s\nHTTP Server is:%s\nHTTPS Server is:%s\nSMB Server is:%s\nSMB LM support is:%s\nKerberos Server is:%s\nSQL Server is:%s\nFTP Server is:%s\nIMAP Server is:%s\nPOP3 Server is:%s\nSMTP Server is:%s\nDNS Server is:%s\nLDAP Server is:%s\nFingerPrint Module is:%s\nServing Executable via HTTP&WPAD is:%s\nAlways Serving a Specific File via HTTP&WPAD is:%s\n\n"%(BIND_TO_Interface, NumChal,WPAD_On_Off,WPAD_Script,On_Off,SSL_On_Off,SMB_On_Off,LM_On_Off,Krb_On_Off,SQL_On_Off,FTP_On_Off,IMAP_On_Off,POP_On_Off,SMTP_On_Off,DNS_On_Off,LDAP_On_Off,Finger_On_Off,Exe_On_Off,Exec_Mode_On_Off)) Show_Help("[+]NBT-NS, LLMNR & MDNS responder started\n[+]Loading Responder.conf File..\nGlobal Parameters set:\nResponder is bound to this interface: %s\nChallenge set: %s\nWPAD Proxy Server: %s\nWPAD script loaded: %s\nHTTP Server: %s\nHTTPS Server: %s\nSMB Server: %s\nSMB LM support: %s\nKerberos Server: %s\nSQL Server: %s\nFTP Server: %s\nIMAP Server: %s\nPOP3 Server: %s\nSMTP Server: %s\nDNS Server: %s\nLDAP Server: %s\nFingerPrint hosts: %s\nServing Executable via HTTP&WPAD: %s\nAlways Serving a Specific File via HTTP&WPAD: %s\n\n"%(BIND_TO_Interface, NumChal,WPAD_On_Off,WPAD_Script,On_Off,SSL_On_Off,SMB_On_Off,LM_On_Off,Krb_On_Off,SQL_On_Off,FTP_On_Off,IMAP_On_Off,POP_On_Off,SMTP_On_Off,DNS_On_Off,LDAP_On_Off,Finger_On_Off,Exe_On_Off,Exec_Mode_On_Off))
if AnalyzeMode: if AnalyzeMode:
print '[+]Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned.\n' print '[+]Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned.\n'
@ -225,9 +225,9 @@ class Packet():
#Function name self-explanatory #Function name self-explanatory
def Is_Finger_On(Finger_On_Off): def Is_Finger_On(Finger_On_Off):
if Finger_On_Off == "ON": if Finger_On_Off == True:
return True return True
if Finger_On_Off == "OFF": if Finger_On_Off == False:
return False return False
def RespondToSpecificHost(RespondTo): def RespondToSpecificHost(RespondTo):
@ -306,11 +306,11 @@ def Validate_NBT_NS(data,Wredirect):
if NBT_NS_Role(data[43:46]) == "File Server Service.": if NBT_NS_Role(data[43:46]) == "File Server Service.":
return True return True
if NBTNSDomain == "ON": if NBTNSDomain == True:
if NBT_NS_Role(data[43:46]) == "Domain controller service. This name is a domain controller.": if NBT_NS_Role(data[43:46]) == "Domain controller service. This name is a domain controller.":
return True return True
if Wredirect == "ON": if Wredirect == True:
if NBT_NS_Role(data[43:46]) == "Workstation/Redirector Service.": if NBT_NS_Role(data[43:46]) == "Workstation/Redirector Service.":
return True return True
@ -1600,16 +1600,16 @@ def WpadCustom(data,client):
return False return False
def WpadForcedAuth(Force_WPAD_Auth): def WpadForcedAuth(Force_WPAD_Auth):
if Force_WPAD_Auth == "ON": if Force_WPAD_Auth == True:
return True return True
else: if Force_WPAD_Auth == False:
return False return False
# Function used to check if we answer with a Basic or NTLM auth. # Function used to check if we answer with a Basic or NTLM auth.
def Basic_Ntlm(Basic): def Basic_Ntlm(Basic):
if Basic == "ON": if Basic == True:
return IIS_Basic_401_Ans() return IIS_Basic_401_Ans()
if Basic == "OFF": else:
return IIS_Auth_401_Ans() return IIS_Auth_401_Ans()
def ServeEXE(data,client, Filename): def ServeEXE(data,client, Filename):
@ -1737,7 +1737,7 @@ class HTTP(BaseRequestHandler):
self.request.settimeout(1) self.request.settimeout(1)
data = self.request.recv(8092) data = self.request.recv(8092)
buff = WpadCustom(data,self.client_address[0]) buff = WpadCustom(data,self.client_address[0])
if buff and Force_WPAD_Auth == "OFF": if buff and WpadForcedAuth(Force_WPAD_Auth) == False:
Message = "[+]WPAD (no auth) file sent to: %s"%(self.client_address[0]) Message = "[+]WPAD (no auth) file sent to: %s"%(self.client_address[0])
if Verbose: if Verbose:
print Message print Message
@ -1748,7 +1748,6 @@ class HTTP(BaseRequestHandler):
self.request.send(buffer0) self.request.send(buffer0)
except Exception: except Exception:
pass#No need to be verbose.. pass#No need to be verbose..
self.request.close()
################################################################################## ##################################################################################
@ -2313,15 +2312,15 @@ def Is_HTTPS_On(SSL_On_Off):
#Function name self-explanatory #Function name self-explanatory
def Is_WPAD_On(on_off): def Is_WPAD_On(on_off):
if on_off == "ON": if on_off == True:
return thread.start_new(serve_thread_tcp,('', 3141,ProxyHandler)) return thread.start_new(serve_thread_tcp,('', 3141,ProxyHandler))
if on_off == "OFF": if on_off == False:
return False return False
#Function name self-explanatory #Function name self-explanatory
def Is_SMB_On(SMB_On_Off): def Is_SMB_On(SMB_On_Off):
if SMB_On_Off == "ON": if SMB_On_Off == "ON":
if LM_On_Off == "ON": if LM_On_Off == True:
return thread.start_new(serve_thread_tcp, ('', 445,SMB1LM)),thread.start_new(serve_thread_tcp,('', 139,SMB1LM)) return thread.start_new(serve_thread_tcp, ('', 445,SMB1LM)),thread.start_new(serve_thread_tcp,('', 139,SMB1LM))
else: else:
return thread.start_new(serve_thread_tcp, ('', 445,SMB1)),thread.start_new(serve_thread_tcp,('', 139,SMB1)) return thread.start_new(serve_thread_tcp, ('', 445,SMB1)),thread.start_new(serve_thread_tcp,('', 139,SMB1))