aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-01-19Added p0wnedShell linkKevin Robertson1-1/+1
Added p0wnedShell link to the included in section. Removed the SMB relay note to sync with Inveigh.ps1 notes.
2016-01-12Spoofer, HTTP/HTTPS, and WPAD additions/changes1.0.0Kevin Robertson3-167/+492
LLMNR/NBNS spoofer: SpooferIPsReply/SpooferIPsIgnore - These parameters provide granular control over what systems to respond to when spoofing. SpooferHostsReply/SpooferHostsIgnore - These parameters provide granular control over what requested hostnames to respond to when spoofing. Note that SpooferHostsAccept replaces SpoofList. SpooferRepeat - This parameter replaces Repeat in order to sync the parameter name with the prefix used for other spoofer parameters. HTTP/HTTPS Listener: HTTPAuth - This parameter provides the ability to set the HTTP/HTTPS non-WPAD auth to NTLM, Basic, or Anonymous. Basic authentication can be used to capture cleartext credentials (thanks @xorrior!). HTTPBasicRealm - Set a realm name if Basic auth is enabled. HTTPDir/HTTPDefaultFile/HTTPDefaultEXE/HTTPResponse - These parameters provide control over the content served by the listener. HTTPSCertThumbprint - This parameter provides the ability to more easily set the thumbprint for custom certs. HTTP/HTTPS requests are now reported and/or logged. WPAD: WPADIP/WPADPort - These parameters provide the ability to configure a proxy server on victim systems through WPAD. WPADResponse - These parameters provide the ability to configure a custom wpad.dat response rather than the basic one used by WPADIP and WPADPort. WPADAuth - This parameter provides the ability to set the HTTP/HTTPS WPAD auth to NTLM, Basic, or Anonymous. Basic authentication can be used to capture cleartext credentials (thanks @xorrior!). Note that this parameter replaces ForceWPADAuth. Miscellaneous: Get-InveighCleartext - Gets all captured cleartext credentials. Inspect - This switch parameter serves as an easier way to inspect LLMNR/NBNS traffic. If -Inspect is added to the command line, LLMNR, NBNS, HTTP, HTTPS, and SMB are disabled.
2015-12-09Added ability to display only one captured challenge/response for each ↵Kevin Robertson2-4/+136
unique account Added the 'unique' parameter to Get-InveighNTLMv1 and Get-InveighNTLMv2. If 'unique' is enabled, only the first captured challenge/response for each unique account will be displayed.
2015-11-15SMB relay fixKevin Robertson1-8/+16
I found that I had some hard coded packet data that needed to be dynamic. This was causing authentication failures on domain systems that didn't match the specs (domain name length, etc) of my test domain. Sorry!
2015-10-15Added SpoofList parameter and spoofer improvementsKevin Robertson1-169/+203
Added the SpoofList parameter for listing specific hostnames to spoof with LLMNR/NBNS. Stopped Inveigh from responding to AAAA LLMNR packets received over IPv4. Fixed a NBNS display bug with 15 characters requests.
2015-10-14Updated error handling and outputKevin Robertson1-87/+79
Added additional error handling for the command execution process. The console and file output will now report the name of the temp service created on the relay target. Removed an unnecessary packet and modified some of the bytes within the remaining packets.
2015-10-11Removed ps1 from main directoryKevin Robertson1-2251/+0
2015-10-11Moved SMB relay code to a dedicated script, also added a Scripts directory ↵Kevin Robertson5-10/+3376
and psm1 and psd1 files The SMB relay code is now in Inveigh-Relay.ps1. The script can be used either through Invoke-Inveigh or as a standalone function.
2015-10-11Revert "Moved SMB relay code to a dedicated script, also added psm1 and psd1 ↵Kevin Robertson5-2013/+894
files." This reverts commit 8ab002602f672dddb91e27ff6bb7d5050771c688.
2015-10-11Moved SMB relay code to a dedicated script, also added psm1 and psd1 files.Kevin Robertson5-894/+2013
The SMB relay code is now in Inveigh-Relay.ps1. The script can be used either through Invoke-Inveigh or as a standalone function.
2015-10-07Typo fixKevin Robertson1-1/+1
2015-10-07Additional updates as part of module conversionKevin Robertson1-247/+465
Changed the real time console update loop location to get rid of the remaining writelines and work better with Empire. Removed Hide-Inveigh since it was no longer needed. Added the 'Tool' parameter to easily set the proper options when running through other tools. Right now, Metasploit Interactive PowerShell sessions and PowerShell Empire are selectable. Also, added additional parameters and code so that Inveigh runs better with those tools.
2015-10-07Updated Metasploit screenshot and removed Hide-InveighKevin Robertson1-3/+2
2015-10-06Updated to reflect new module formatKevin Robertson1-7/+5
2015-10-06Switched to module formatKevin Robertson1-1/+1
Inveigh should now be executed as a module rather than a standalone script. There are multiple cmdlets for interacting with Inveigh. Also fixed a file encoding issue that was causing problems with IEX.
2015-10-06Updated to reflect new module formatKevin Robertson5-40/+45
2015-09-30Typo fixKevin Robertson1-0/+0
2015-09-30Forgot to list Get-InveighKevin Robertson2-0/+1
2015-09-30Formatting fixKevin Robertson1-10/+10
2015-09-30Formatting fixKevin Robertson1-12/+12
2015-09-30Module version of InveighKevin Robertson2-2/+18
This has not been fully tested. See readme for details.
2015-09-27Importable versionKevin Robertson2-0/+3
2015-09-27Throttled console loopKevin Robertson1-0/+0
Added a sleep to the main console loop to keep CPU from spiking.
2015-09-27Improved SMB capture functions and added challenge parameterKevin Robertson1-0/+0
Modified the SMB capture functions to remove the need to handle SMB versions differently. To help avoid IDS/IPS, I also added a -challenge parameter for setting a custom HTTP/HTTPS NTLM challenge. If this parameter is left blank, a random challenge will be generated for each HTTP/HTTPS request. To use the traditional 1122334455667788 challenge, simply use -challenge 1122334455667788. Finally, the console prompt can be enabled/disabled with the -consoleprompt parameter.
2015-09-26Added additional SMB relay parameter validationKevin Robertson1-0/+0
Added validation to ensure that a relay target and command are specified if SMB relay is enabled.
2015-09-26Comment type fixKevin Robertson1-0/+0
2015-09-22Updated the SMB relay add user exampleKevin Robertson1-0/+0
The old generic add user example would not work on a system with complex password requirements. Added an actual username and password to avoid confusion.
2015-09-20Removed invalid note regarding output locationKevin Robertson1-3/+2
2015-09-20Added SMB relay limiters and new parameterKevin Robertson1-0/+0
Added some additional SMB relay limiters to lessen the amount to unnecessary relay attempts. Inveigh will not attempt to relay from the relay target back to itself. Inveigh will also not attempt to relay with a username that has already failed against a target due to either not authenticating or not being a local admin. There is also now a parameter for specifying usernames to relay. If this parameter is used, usernames not on the list will not be relayed.
2015-09-20Added new screenshots and SMB relay command lineKevin Robertson1-1/+1
2015-09-20Added new screenshots and SMB relay command lineKevin Robertson1-1/+1
2015-09-20Added new screenshots and smb relay command lineKevin Robertson1-2/+8
2015-09-20Removing old version filesKevin Robertson6-149/+0
2015-09-20Added SMB relay limiters and new parameterKevin Robertson1-0/+0
Added some additional SMB relay limiters to lessen the amount to unnecessary relay attempts. Inveigh will not attempt to relay from the relay target back to itself. Inveigh will also not attempt to relay with a username that has already failed against a target due to either not authenticating or not being a local admin. There is also now a parameter for specifying usernames to relay. If this parameter is used, usernames not on the list will not be relayed.
2015-09-13Checked SMB relayKevin Robertson1-2/+2
2015-09-13Added SMB relay noteKevin Robertson1-0/+1
2015-09-13SMB relay added, runspace changesKevin Robertson1-0/+0
This version contains the first pass at SMB relay. It will currently relay HTTP/HTTPS NTLMv2 to SMB. It will perform a psexec style, command only (no file upload) execution. It will attempt to delete the temp service after the service is started. Launching shells directly through the command may delay or prevent the service deletion. In the event that manual deletion is needed, the display name of the added service is IVSRV plus some random characters. The error/status checking needs a lot of work. The current messages cannot be completely trusted. The spoofer/sniffer loop has been placed in a runspace to permit interaction with the console while Inveigh is running. Pressing enter will now bring up a prompt. In addition to ctrl+c, Inveigh can be exited using the quit command. Avoid using ctrl+c while the prompt is open since it will bypass the shutdown function.
2015-09-13Old versionKevin Robertson6-0/+72
Keeping the older version easily accessible until the new version is tested more.
2015-08-05Added parameter for controlling output directory. Added first version of ↵Kevin Robertson3-5/+82
loader script for easier execution as a payload. Added '-OutputDir' parameter for controlling the output directory. Added 'Inveigh-Loader.ps1' script which has additional options for running Inveigh as an unattended payload. Performed some cleanup. Updated screenshot in readme.
2015-08-05Added requirements sectionKevin Robertson1-0/+3
2015-08-05Fixed SMB capture bug, added parameter for specifying separate listening and ↵Kevin Robertson1-0/+0
LLMNR/NBNS spoofing IPs. Fixed a bug that prevented SMB server challenges from being captured when NBNS spoofing was disabled. The listening IP can now be set with the '-IP' parameter and the LLMNR/NBNS spoofing IP can be set with '-SpooferIP'. Both parameters are optional. If not set, the listening IP will be used for '-SpooferIP'. Replaced the one write-host with a write-warning. Removed the '-help' parameter.
2015-08-01Added new parameterKevin Robertson1-2/+2
2015-08-01Added ability to enabled/disable spoofing specific NBNS typesKevin Robertson1-0/+0
Added ability to enabled/disable spoofing specific NBNS types with the -NBNSTypes parameter. Cleaned up parameter validation code.
2015-07-28Create LICENSE.mdKevin Robertson1-0/+31
2015-07-14Added output control optionKevin Robertson1-0/+0
Added '-Output' option to enable/disable most console output and all file output. 0 = Console Enabled/File Enabled, 1 = Console Enabled/File Disabled, 2 = Console Disabled/File Enabled. 0 is default.
2015-07-12Added HTTPS optionKevin Robertson1-1/+1
2015-07-12Added HTTPS listenerKevin Robertson3-1/+1
HTTPS captures can now be enabled. The default setting is disabled. Note that if HTTPS is enabled, the cert file needs to be in the same directory as the script. The cert will be installed in the local machine certificate store and bound to port 443. The script should remove the cert from the store and delete the binding on exit. If needed, see HTTPS parameter comments in the script or execute "Get-help .\Inveigh.ps1 -parameter https" for manual cert cleanup instructions.
2015-07-11Added test for new optionsKevin Robertson1-4/+3
2015-07-11Added ForceWPADAuth option and switched NBNS spoofing to disabled by defaultKevin Robertson1-0/+0
ForceWPADAuth matches Responder option to enable/disable authentication for wpad.dat GET requests. Disabling can prevent browser login prompts. The option is currently enabled by default.
2015-06-10Comment updateKevin Robertson1-0/+0
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-31 23:34:26 +0000