aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-05-25Proxy and HTTPS bug fixKevin Robertson1-8/+5
Fixed a bug that was preventing proxy and https listeners from finding a target.
2020-04-12Proxy auth fixKevin Robertson1-2/+2
https://github.com/Kevin-Robertson/Inveigh/issues/20
2019-08-18bug fixesKevin Robertson1-15/+48
2019-08-04Merge branch 'master' of https://github.com/Kevin-Robertson/InveighKevin Robertson1-1/+1
2019-08-04DNS spoofer fixesKevin Robertson1-4/+4
2019-07-31Update README.mdKevin Robertson1-1/+1
2019-07-31Inveigh 1.51,5Kevin Robertson3-1003/+2249
Added privileged and unprivileged DNS spoofer capable of answering incoming DNS requests. New ADIDNS attack called NS that can add an NS record to direct DNS requests to Inveigh host. Using this with WPAD can bypass the global query block list (GQBL). https://blog.netspi.com/adidns-revisited/ Pcap TCP and UDP output. New packet sniffing output including incoming SYN packets, kerberos auth negotiation, null responses, local DNS requests. Kerberos kirbi output for unconstrained delegation attacks. - https://blog.netspi.com/machineaccountquota-is-useful-sometimes/
2019-02-21Update README.mdKevin Robertson1-1/+1
2019-02-20Bug fixes and readme updateKevin Robertson2-68/+126
2018-09-25Inveigh 1.41.4Kevin Robertson9-6318/+10578
Inveigh Added ADIDNS attacks New detection evasions Inveigh Relay Added session and enumerate attacks Added ability to handle multiple targets with target selection based on the enumerate attack and/or BloodHound imports
2017-04-09Readme updateKevin Robertson1-1/+1
2017-04-09Inveigh 1.3.11.3.1Kevin Robertson2-367/+580
Added try/finally block to shutdown runspaces when using Empire 2.0's "jobs kill" command. Added handling for Firefox popup boxes. Fixed Empire console output. Various other small bug fixes and comment corrections.
2017-04-06Empire output fix, comment updatesKevin Robertson2-106/+153
Fixed the warning handling for running through Empire. Updated some comments where I left out mDNS.
2017-04-05Inveigh 1.31.3Kevin Robertson7-4479/+6050
Inveigh.ps1 Merged Inveigh and Inveigh-Unprivileged. The new module will run the correct functions based on the detected privilege level or ElevatedPrivilege parameter setting. Added proxy auth capture. (thanks to @lgandx and @mubix for the idea from https://github.com/lgandx/Responder) Added mDNS spoofer. Added limited ability to attack browsers of proxy auth targets. Added the ability to set the content type header for HTTPReponse, or files from disk through HTTPDir, for better support for HTA, etc. Added the ability to capture POST requests. Inveigh-Relay.ps1 Refactored the module. Switched to a TCPListener based HTTP listener so that the module can be run with an unprivileged user. If running unprivileged, the Inveigh host can be targeted with relay for privesc. Added support for longer commands to execute on the target. The module is now Empire 2.0 launcher friendly. Added SMB2 support. The module will negotiate by default and can be forced into SMB1 with the SMB1 switch. Added proxy auth capture and relay. Added NTLMv1 relay support. Added RelayAutoExit parameter to stop any running Inveigh modules after a successful relay. Inveigh.ps1 and Inveigh-Relay.ps1 Added a new HTTPS certificate install method that does not require a certificate file. (thanks to @subTee for code example from https://github.com/subTee/Interceptor) Added user agent and host header details to console/file output. Added ability to filter out specific browsers by user agent for wpad and proxy auth. Added console output levels. Added control over in memory log file and console queue. Inveigh-Unprivileged.ps1 This module has been removed.
2017-01-30Typo fixesKevin Robertson1-2/+2
Thanks to @clr2of8 for reporting the typos.
2016-11-29Updated readmeKevin Robertson1-1/+4
Added PowerUpSQL, PoshC2, and pupy to the 'Included In' section of the readme
2016-10-18Minor fixes for when ports are in use and checks are disabledKevin Robertson1-17/+32
2016-10-17Removed try from NBNS spoofer startupKevin Robertson1-12/+2
2016-10-17Fixes for startup checksKevin Robertson3-20/+109
Added @6cyril's improved netstat checks. Added StartupChecks parameter for an easy way to disable checks if they get in the way.
2016-10-13Updated responder linkKevin Robertson1-1/+1
2016-09-14Typo fixesKevin Robertson2-7/+7
2016-09-14LLMNR learning fixKevin Robertson1-1/+1
Fixed a bad if statement that was preventing Inveigh from sending out LLMNR requests with SpooferLearning enabled.
2016-09-13Correcting Inveigh-BruteForce's survival of the syncKevin Robertson1-1749/+0
2016-09-13Inveigh 1.21.2Kevin Robertson8-1434/+4400
1. Added Inveigh-Unprivileged.ps1 (replaces Inveigh-BruteForce.ps1) – This script contains only LLMNR/NBNS spoofing and hash capture methods that do not require local admin access. The NBNS spoofer can be used without disabling the local NBNS service. The LLMNR spoofer does require stopping (needs admin) the local service and freeing up port 5355. It will work without admin on a system with LLMNR disabled. Note that there can still be systems configurations that will prevent Inveigh-Unprivileged from working, and require admin access to change (e.g. local firewall blocking traffic, LLMNR enabled). This script replaces Inveigh-BruteForce and contains the same functionality. 2. Inveigh.ps1 Updates - Added a learning mode (SpooferLearning parameter) to Invoke-Inveigh that will attempt to avoid spoofing requests for valid hostnames. If enabled, Inveigh will send out LLMNR/NBNS requests for hostnames received through incoming LLMNR/NBNS requests. If Inveigh receives a response for a sent requests, it will add the hostname to a blacklist. Added some some code to help keep track or the SMB capture sequence. Removed the ability to launch Invoke-InveighRelay directly from an Invoke-Inveigh command line. 3. Inveigh-Relay.ps1 Status - This one is due for an overhhaul. I'm also considering trying to convert it to not require admin access. No real changes on this pass though. It will work with either Invoke-Inveigh (-HTTP N and/or -HTTPS N) or Invoke-InveighUnprivileged (-HTTP N) as long as the target system supports SMB1. 4. Support Functions - Merged all of the small Get functions into Get-Inveigh. 5. Extras – Added an extras directory for functions that don’t fit the main scripts. a. Send-NBNSResponse – This function sends a crafted NBNS response packet to a specific target. For name resolution to be successful, the specified TargetIP, Hostname, and TransactionID must match a very (very very) recent NBNS request. You must have an external method (wireshark,etc) of viewing the required NBNS request fields for traffic on the target subnet. The odds of pulling this attack off manually are slim due to the narrow response window. I've only been able to get it to work manually by watching tshark with the the transaction ID being listed in the output. Ideally, this function would be fed by another script. b. Send-LLMNResponse – Just like Send-NBNSResponse but even harder to use manually. c. Invoke-NBNSC2 - Invoke-NBNSC2 will listen for NBNS requests and execute set commands if requests for specific hostnames are received. The function must be supplied with an even number of Hostnames and Commands. NBNS requests can be sent from a NBNS enabled system on the same subnet using ping, etc.
2016-08-02Windows Firewall check and readme updateKevin Robertson4-4/+47
Added a warning for when the Windows Firewall is enabled. Added a note about the June patches likely breaking features of Invoke-InveighBruteForce.
2016-07-24Merge pull request #7 from joncave/NTLMSSP-parsingKevin Robertson1-89/+95
Fix NTLMSSP message parsing
2016-07-23Switch HTTP NTLMSSP parsing to use new data extraction helpersJon Cave1-9/+11
2016-07-23Correctly parse SMB NTLMSSP messagesJon Cave1-80/+84
Decide on NTLMv1 vs. NTLMv2 by inspecting the length of the NTLM response data, not by the presence of LM data. Prior to the patch, if an LMv2 response was included, Inveigh would output a badly formatted hash calling it 'NTLMv1'. Use all four bytes for offset data (just in case). Simplify string extraction by requiring the use of an offset. Always used the offsets from the message header instead of assuming a certain content ordering.
2016-05-10Readme fix1.1.1Kevin Robertson1-1/+0
Removed Get-InveighStat reference
2016-05-10Code cleanup and new parametersKevin Robertson4-1569/+2301
Contains a few rounds of code cleanup and the following changes: Parameters Added to Invoke-Inveigh: ConsoleUnique - Enable/Disable displaying challenge/response hashes for only unique IP, domain/hostname, and username combinations when real time console output is enabled. FileUnique - Enable/Disable outputting challenge/response hashes for only unique IP, domain/hostname, and username combinations when real time file output is enabled. ConsoleStatus - Set interval in minutes for displaying all unique captured hashes and credentials. This is useful for displaying full capture lists when running through a shell that does not have access to the support functions. WPADEmptyFile - Enable/Disable serving a proxyless, all direct, wpad.dat file for wpad.dat requests. Enabling this setting can reduce the amount of redundant wpad.dat requests. This parameter is ignored when using WPADIP, WPADPort, or WPADResponse. Fixed: Corrected an issue that was preventing the MachineAccounts parameter from being fully enabled in all three scripts. Removed Support Functions: Get-InveighStat Get-InveighNTLM
2016-03-30Comment/notes update, minor cleanupKevin Robertson4-55/+53
Updated some comments and notes. Replaced ForEach alias with ForEach-Object.
2016-03-16Readme updateKevin Robertson1-1/+4
Added NBNS brute force note and fixed typo
2016-03-16Readme fixKevin Robertson1-1/+1
Second attempt at getting the Invoke-InveighBruteForce example right:)
2016-03-16Readme fixKevin Robertson1-2/+2
The Invoke-InveighBruteForce example listed the wrong function
2016-03-15New Script - Inveigh-BruteForce1.1Kevin Robertson7-358/+2295
New Script - Inveigh-BruteForce - Remote (Hot Potato method)/unprivileged NBNS brute force spoofer. Inveigh-BruteForce Features: Targeted IPv4 NBNS brute force spoofer with granular control NTLMv1/NTLMv2 challenge/response capture over HTTP Granular control of console and file output Run time control Inveigh New Parameters: HTTPSCertAppID - Specify a valid application GUID for use with the ceriticate. LLMNRTTL - Specify a custom LLMNR TTL in seconds for the response packet. NBNSTTL - Specify a custom NBNS TTL in seconds for the response packet. WPADDirectHosts - Comma separated list of hosts to list as direct in the wpad.dat file. Listed hosts will not be routed through the defined proxy. Inveigh-Relay New Parameters: HTTPSCertAppID - Specify a valid application GUID for use with the ceriticate. RunTime - Set the run time duration in minutes. Bug Fix: Fixed an SMB relay issue that was causing a hang before sending the NTLMv2 response. Thanks to @mubix for reporting the bug and providing a packet capture.
2016-01-19Added p0wnedShell linkKevin Robertson1-1/+1
Added p0wnedShell link to the included in section. Removed the SMB relay note to sync with Inveigh.ps1 notes.
2016-01-12Spoofer, HTTP/HTTPS, and WPAD additions/changes1.0.0Kevin Robertson3-167/+492
LLMNR/NBNS spoofer: SpooferIPsReply/SpooferIPsIgnore - These parameters provide granular control over what systems to respond to when spoofing. SpooferHostsReply/SpooferHostsIgnore - These parameters provide granular control over what requested hostnames to respond to when spoofing. Note that SpooferHostsAccept replaces SpoofList. SpooferRepeat - This parameter replaces Repeat in order to sync the parameter name with the prefix used for other spoofer parameters. HTTP/HTTPS Listener: HTTPAuth - This parameter provides the ability to set the HTTP/HTTPS non-WPAD auth to NTLM, Basic, or Anonymous. Basic authentication can be used to capture cleartext credentials (thanks @xorrior!). HTTPBasicRealm - Set a realm name if Basic auth is enabled. HTTPDir/HTTPDefaultFile/HTTPDefaultEXE/HTTPResponse - These parameters provide control over the content served by the listener. HTTPSCertThumbprint - This parameter provides the ability to more easily set the thumbprint for custom certs. HTTP/HTTPS requests are now reported and/or logged. WPAD: WPADIP/WPADPort - These parameters provide the ability to configure a proxy server on victim systems through WPAD. WPADResponse - These parameters provide the ability to configure a custom wpad.dat response rather than the basic one used by WPADIP and WPADPort. WPADAuth - This parameter provides the ability to set the HTTP/HTTPS WPAD auth to NTLM, Basic, or Anonymous. Basic authentication can be used to capture cleartext credentials (thanks @xorrior!). Note that this parameter replaces ForceWPADAuth. Miscellaneous: Get-InveighCleartext - Gets all captured cleartext credentials. Inspect - This switch parameter serves as an easier way to inspect LLMNR/NBNS traffic. If -Inspect is added to the command line, LLMNR, NBNS, HTTP, HTTPS, and SMB are disabled.
2015-12-09Added ability to display only one captured challenge/response for each ↵Kevin Robertson2-4/+136
unique account Added the 'unique' parameter to Get-InveighNTLMv1 and Get-InveighNTLMv2. If 'unique' is enabled, only the first captured challenge/response for each unique account will be displayed.
2015-11-15SMB relay fixKevin Robertson1-8/+16
I found that I had some hard coded packet data that needed to be dynamic. This was causing authentication failures on domain systems that didn't match the specs (domain name length, etc) of my test domain. Sorry!
2015-10-15Added SpoofList parameter and spoofer improvementsKevin Robertson1-169/+203
Added the SpoofList parameter for listing specific hostnames to spoof with LLMNR/NBNS. Stopped Inveigh from responding to AAAA LLMNR packets received over IPv4. Fixed a NBNS display bug with 15 characters requests.
2015-10-14Updated error handling and outputKevin Robertson1-87/+79
Added additional error handling for the command execution process. The console and file output will now report the name of the temp service created on the relay target. Removed an unnecessary packet and modified some of the bytes within the remaining packets.
2015-10-11Removed ps1 from main directoryKevin Robertson1-2251/+0
2015-10-11Moved SMB relay code to a dedicated script, also added a Scripts directory ↵Kevin Robertson5-10/+3376
and psm1 and psd1 files The SMB relay code is now in Inveigh-Relay.ps1. The script can be used either through Invoke-Inveigh or as a standalone function.
2015-10-11Revert "Moved SMB relay code to a dedicated script, also added psm1 and psd1 ↵Kevin Robertson5-2013/+894
files." This reverts commit 8ab002602f672dddb91e27ff6bb7d5050771c688.
2015-10-11Moved SMB relay code to a dedicated script, also added psm1 and psd1 files.Kevin Robertson5-894/+2013
The SMB relay code is now in Inveigh-Relay.ps1. The script can be used either through Invoke-Inveigh or as a standalone function.
2015-10-07Typo fixKevin Robertson1-1/+1
2015-10-07Additional updates as part of module conversionKevin Robertson1-247/+465
Changed the real time console update loop location to get rid of the remaining writelines and work better with Empire. Removed Hide-Inveigh since it was no longer needed. Added the 'Tool' parameter to easily set the proper options when running through other tools. Right now, Metasploit Interactive PowerShell sessions and PowerShell Empire are selectable. Also, added additional parameters and code so that Inveigh runs better with those tools.
2015-10-07Updated Metasploit screenshot and removed Hide-InveighKevin Robertson1-3/+2
2015-10-06Updated to reflect new module formatKevin Robertson1-7/+5
2015-10-06Switched to module formatKevin Robertson1-1/+1
Inveigh should now be executed as a module rather than a standalone script. There are multiple cmdlets for interacting with Inveigh. Also fixed a file encoding issue that was causing problems with IEX.
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-31 23:37:18 +0000