aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-07-23Switch HTTP NTLMSSP parsing to use new data extraction helpersJon Cave1-9/+11
2016-07-23Correctly parse SMB NTLMSSP messagesJon Cave1-80/+84
Decide on NTLMv1 vs. NTLMv2 by inspecting the length of the NTLM response data, not by the presence of LM data. Prior to the patch, if an LMv2 response was included, Inveigh would output a badly formatted hash calling it 'NTLMv1'. Use all four bytes for offset data (just in case). Simplify string extraction by requiring the use of an offset. Always used the offsets from the message header instead of assuming a certain content ordering.
2016-05-10Readme fix1.1.1Kevin Robertson1-1/+0
Removed Get-InveighStat reference
2016-05-10Code cleanup and new parametersKevin Robertson4-1569/+2301
Contains a few rounds of code cleanup and the following changes: Parameters Added to Invoke-Inveigh: ConsoleUnique - Enable/Disable displaying challenge/response hashes for only unique IP, domain/hostname, and username combinations when real time console output is enabled. FileUnique - Enable/Disable outputting challenge/response hashes for only unique IP, domain/hostname, and username combinations when real time file output is enabled. ConsoleStatus - Set interval in minutes for displaying all unique captured hashes and credentials. This is useful for displaying full capture lists when running through a shell that does not have access to the support functions. WPADEmptyFile - Enable/Disable serving a proxyless, all direct, wpad.dat file for wpad.dat requests. Enabling this setting can reduce the amount of redundant wpad.dat requests. This parameter is ignored when using WPADIP, WPADPort, or WPADResponse. Fixed: Corrected an issue that was preventing the MachineAccounts parameter from being fully enabled in all three scripts. Removed Support Functions: Get-InveighStat Get-InveighNTLM
2016-03-30Comment/notes update, minor cleanupKevin Robertson4-55/+53
Updated some comments and notes. Replaced ForEach alias with ForEach-Object.
2016-03-16Readme updateKevin Robertson1-1/+4
Added NBNS brute force note and fixed typo
2016-03-16Readme fixKevin Robertson1-1/+1
Second attempt at getting the Invoke-InveighBruteForce example right:)
2016-03-16Readme fixKevin Robertson1-2/+2
The Invoke-InveighBruteForce example listed the wrong function
2016-03-15New Script - Inveigh-BruteForce1.1Kevin Robertson7-358/+2295
New Script - Inveigh-BruteForce - Remote (Hot Potato method)/unprivileged NBNS brute force spoofer. Inveigh-BruteForce Features: Targeted IPv4 NBNS brute force spoofer with granular control NTLMv1/NTLMv2 challenge/response capture over HTTP Granular control of console and file output Run time control Inveigh New Parameters: HTTPSCertAppID - Specify a valid application GUID for use with the ceriticate. LLMNRTTL - Specify a custom LLMNR TTL in seconds for the response packet. NBNSTTL - Specify a custom NBNS TTL in seconds for the response packet. WPADDirectHosts - Comma separated list of hosts to list as direct in the wpad.dat file. Listed hosts will not be routed through the defined proxy. Inveigh-Relay New Parameters: HTTPSCertAppID - Specify a valid application GUID for use with the ceriticate. RunTime - Set the run time duration in minutes. Bug Fix: Fixed an SMB relay issue that was causing a hang before sending the NTLMv2 response. Thanks to @mubix for reporting the bug and providing a packet capture.
2016-01-19Added p0wnedShell linkKevin Robertson1-1/+1
Added p0wnedShell link to the included in section. Removed the SMB relay note to sync with Inveigh.ps1 notes.
2016-01-12Spoofer, HTTP/HTTPS, and WPAD additions/changes1.0.0Kevin Robertson3-167/+492
LLMNR/NBNS spoofer: SpooferIPsReply/SpooferIPsIgnore - These parameters provide granular control over what systems to respond to when spoofing. SpooferHostsReply/SpooferHostsIgnore - These parameters provide granular control over what requested hostnames to respond to when spoofing. Note that SpooferHostsAccept replaces SpoofList. SpooferRepeat - This parameter replaces Repeat in order to sync the parameter name with the prefix used for other spoofer parameters. HTTP/HTTPS Listener: HTTPAuth - This parameter provides the ability to set the HTTP/HTTPS non-WPAD auth to NTLM, Basic, or Anonymous. Basic authentication can be used to capture cleartext credentials (thanks @xorrior!). HTTPBasicRealm - Set a realm name if Basic auth is enabled. HTTPDir/HTTPDefaultFile/HTTPDefaultEXE/HTTPResponse - These parameters provide control over the content served by the listener. HTTPSCertThumbprint - This parameter provides the ability to more easily set the thumbprint for custom certs. HTTP/HTTPS requests are now reported and/or logged. WPAD: WPADIP/WPADPort - These parameters provide the ability to configure a proxy server on victim systems through WPAD. WPADResponse - These parameters provide the ability to configure a custom wpad.dat response rather than the basic one used by WPADIP and WPADPort. WPADAuth - This parameter provides the ability to set the HTTP/HTTPS WPAD auth to NTLM, Basic, or Anonymous. Basic authentication can be used to capture cleartext credentials (thanks @xorrior!). Note that this parameter replaces ForceWPADAuth. Miscellaneous: Get-InveighCleartext - Gets all captured cleartext credentials. Inspect - This switch parameter serves as an easier way to inspect LLMNR/NBNS traffic. If -Inspect is added to the command line, LLMNR, NBNS, HTTP, HTTPS, and SMB are disabled.
2015-12-09Added ability to display only one captured challenge/response for each ↵Kevin Robertson2-4/+136
unique account Added the 'unique' parameter to Get-InveighNTLMv1 and Get-InveighNTLMv2. If 'unique' is enabled, only the first captured challenge/response for each unique account will be displayed.
2015-11-15SMB relay fixKevin Robertson1-8/+16
I found that I had some hard coded packet data that needed to be dynamic. This was causing authentication failures on domain systems that didn't match the specs (domain name length, etc) of my test domain. Sorry!
2015-10-15Added SpoofList parameter and spoofer improvementsKevin Robertson1-169/+203
Added the SpoofList parameter for listing specific hostnames to spoof with LLMNR/NBNS. Stopped Inveigh from responding to AAAA LLMNR packets received over IPv4. Fixed a NBNS display bug with 15 characters requests.
2015-10-14Updated error handling and outputKevin Robertson1-87/+79
Added additional error handling for the command execution process. The console and file output will now report the name of the temp service created on the relay target. Removed an unnecessary packet and modified some of the bytes within the remaining packets.
2015-10-11Removed ps1 from main directoryKevin Robertson1-2251/+0
2015-10-11Moved SMB relay code to a dedicated script, also added a Scripts directory ↵Kevin Robertson5-10/+3376
and psm1 and psd1 files The SMB relay code is now in Inveigh-Relay.ps1. The script can be used either through Invoke-Inveigh or as a standalone function.
2015-10-11Revert "Moved SMB relay code to a dedicated script, also added psm1 and psd1 ↵Kevin Robertson5-2013/+894
files." This reverts commit 8ab002602f672dddb91e27ff6bb7d5050771c688.
2015-10-11Moved SMB relay code to a dedicated script, also added psm1 and psd1 files.Kevin Robertson5-894/+2013
The SMB relay code is now in Inveigh-Relay.ps1. The script can be used either through Invoke-Inveigh or as a standalone function.
2015-10-07Typo fixKevin Robertson1-1/+1
2015-10-07Additional updates as part of module conversionKevin Robertson1-247/+465
Changed the real time console update loop location to get rid of the remaining writelines and work better with Empire. Removed Hide-Inveigh since it was no longer needed. Added the 'Tool' parameter to easily set the proper options when running through other tools. Right now, Metasploit Interactive PowerShell sessions and PowerShell Empire are selectable. Also, added additional parameters and code so that Inveigh runs better with those tools.
2015-10-07Updated Metasploit screenshot and removed Hide-InveighKevin Robertson1-3/+2
2015-10-06Updated to reflect new module formatKevin Robertson1-7/+5
2015-10-06Switched to module formatKevin Robertson1-1/+1
Inveigh should now be executed as a module rather than a standalone script. There are multiple cmdlets for interacting with Inveigh. Also fixed a file encoding issue that was causing problems with IEX.
2015-10-06Updated to reflect new module formatKevin Robertson5-40/+45
2015-09-30Typo fixKevin Robertson1-0/+0
2015-09-30Forgot to list Get-InveighKevin Robertson2-0/+1
2015-09-30Formatting fixKevin Robertson1-10/+10
2015-09-30Formatting fixKevin Robertson1-12/+12
2015-09-30Module version of InveighKevin Robertson2-2/+18
This has not been fully tested. See readme for details.
2015-09-27Importable versionKevin Robertson2-0/+3
2015-09-27Throttled console loopKevin Robertson1-0/+0
Added a sleep to the main console loop to keep CPU from spiking.
2015-09-27Improved SMB capture functions and added challenge parameterKevin Robertson1-0/+0
Modified the SMB capture functions to remove the need to handle SMB versions differently. To help avoid IDS/IPS, I also added a -challenge parameter for setting a custom HTTP/HTTPS NTLM challenge. If this parameter is left blank, a random challenge will be generated for each HTTP/HTTPS request. To use the traditional 1122334455667788 challenge, simply use -challenge 1122334455667788. Finally, the console prompt can be enabled/disabled with the -consoleprompt parameter.
2015-09-26Added additional SMB relay parameter validationKevin Robertson1-0/+0
Added validation to ensure that a relay target and command are specified if SMB relay is enabled.
2015-09-26Comment type fixKevin Robertson1-0/+0
2015-09-22Updated the SMB relay add user exampleKevin Robertson1-0/+0
The old generic add user example would not work on a system with complex password requirements. Added an actual username and password to avoid confusion.
2015-09-20Removed invalid note regarding output locationKevin Robertson1-3/+2
2015-09-20Added SMB relay limiters and new parameterKevin Robertson1-0/+0
Added some additional SMB relay limiters to lessen the amount to unnecessary relay attempts. Inveigh will not attempt to relay from the relay target back to itself. Inveigh will also not attempt to relay with a username that has already failed against a target due to either not authenticating or not being a local admin. There is also now a parameter for specifying usernames to relay. If this parameter is used, usernames not on the list will not be relayed.
2015-09-20Added new screenshots and SMB relay command lineKevin Robertson1-1/+1
2015-09-20Added new screenshots and SMB relay command lineKevin Robertson1-1/+1
2015-09-20Added new screenshots and smb relay command lineKevin Robertson1-2/+8
2015-09-20Removing old version filesKevin Robertson6-149/+0
2015-09-20Added SMB relay limiters and new parameterKevin Robertson1-0/+0
Added some additional SMB relay limiters to lessen the amount to unnecessary relay attempts. Inveigh will not attempt to relay from the relay target back to itself. Inveigh will also not attempt to relay with a username that has already failed against a target due to either not authenticating or not being a local admin. There is also now a parameter for specifying usernames to relay. If this parameter is used, usernames not on the list will not be relayed.
2015-09-13Checked SMB relayKevin Robertson1-2/+2
2015-09-13Added SMB relay noteKevin Robertson1-0/+1
2015-09-13SMB relay added, runspace changesKevin Robertson1-0/+0
This version contains the first pass at SMB relay. It will currently relay HTTP/HTTPS NTLMv2 to SMB. It will perform a psexec style, command only (no file upload) execution. It will attempt to delete the temp service after the service is started. Launching shells directly through the command may delay or prevent the service deletion. In the event that manual deletion is needed, the display name of the added service is IVSRV plus some random characters. The error/status checking needs a lot of work. The current messages cannot be completely trusted. The spoofer/sniffer loop has been placed in a runspace to permit interaction with the console while Inveigh is running. Pressing enter will now bring up a prompt. In addition to ctrl+c, Inveigh can be exited using the quit command. Avoid using ctrl+c while the prompt is open since it will bypass the shutdown function.
2015-09-13Old versionKevin Robertson6-0/+72
Keeping the older version easily accessible until the new version is tested more.
2015-08-05Added parameter for controlling output directory. Added first version of ↵Kevin Robertson3-5/+82
loader script for easier execution as a payload. Added '-OutputDir' parameter for controlling the output directory. Added 'Inveigh-Loader.ps1' script which has additional options for running Inveigh as an unattended payload. Performed some cleanup. Updated screenshot in readme.
2015-08-05Added requirements sectionKevin Robertson1-0/+3
2015-08-05Fixed SMB capture bug, added parameter for specifying separate listening and ↵Kevin Robertson1-0/+0
LLMNR/NBNS spoofing IPs. Fixed a bug that prevented SMB server challenges from being captured when NBNS spoofing was disabled. The listening IP can now be set with the '-IP' parameter and the LLMNR/NBNS spoofing IP can be set with '-SpooferIP'. Both parameters are optional. If not set, the listening IP will be used for '-SpooferIP'. Replaced the one write-host with a write-warning. Removed the '-help' parameter.
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-31 23:34:30 +0000