aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2022-08-10bug fixesv2.0.5Kevin Robertson27-371/+763
bug fixes switched .net 4.5 to 4.6.2 switched .net 5.0 to 6.0 added workflow for release assemblies
2022-01-09Update Program.csKevin Robertson1-3/+3
2022-01-09Update HTTPListener.csKevin Robertson1-7/+16
Fix for Negotiate auth
2022-01-03ICMPv6TTL, output levels, bug fixesKevin Robertson1-2/+2
Added ICMPv6TTL parameter for ICMPv6 attacks. more Console parameter output levels, and bug fixes.
2022-01-03ICMPv6TTL, output levels, bug fixesKevin Robertson139-1082/+1996
Added ICMPv6TTL parameter for ICMPv6 attacks. more Console parameter output levels, and bug fixes.
2021-10-25Merge pull request #35 from ↵Kevin Robertson1-2/+2
Kevin-Robertson/dependabot/nuget/Inveigh/System.DirectoryServices.Protocols-5.0.1 Bump System.DirectoryServices.Protocols from 5.0 to 5.0.1 in /Inveigh
2021-10-12Bump System.DirectoryServices.Protocols from 5.0 to 5.0.1 in /Inveighdependabot[bot]1-2/+2
Bumps [System.DirectoryServices.Protocols](https://github.com/dotnet/runtime) from 5.0 to 5.0.1. - [Release notes](https://github.com/dotnet/runtime/releases) - [Commits](https://github.com/dotnet/runtime/compare/v5.0.0...v5.0.1) --- updated-dependencies: - dependency-name: System.DirectoryServices.Protocols dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
2021-07-11bug fixesKevin Robertson8-31/+43
2021-06-21HTTP listener updateKevin Robertson3-26/+2
Remove unneeded code
2021-06-21Update README.mdKevin Robertson1-1/+1
2021-06-21Update README.mdKevin Robertson1-1/+9
2021-06-21Update README.mdKevin Robertson1-4/+12
2021-06-21Update README.mdKevin Robertson1-1/+9
2021-06-21Update README.mdKevin Robertson1-1/+16
2021-06-21Update README.mdKevin Robertson1-1/+9
2021-06-21Update README.mdKevin Robertson1-0/+7
2021-06-21Update README.mdKevin Robertson1-1/+9
2021-06-15Update README.mdKevin Robertson1-6/+6
2021-06-15Update README.mdKevin Robertson1-0/+5
2021-06-15Inveigh 2.02.0Kevin Robertson139-85/+17282
Rebuilt Cross-platform (Windows, Linux, macOS) New listeners (SMB, LDAP, WebDAV, HTTPS) Improved interactive console (tab complete, real time stats)
2021-05-04Update README.mdKevin Robertson1-0/+3
2020-09-20SMB capture fixKevin Robertson1-53/+81
2020-09-08HTTP server capture fixKevin Robertson1-4/+4
2020-05-26Proxy auth fixKevin Robertson1-11/+3
2020-05-25Proxy and HTTPS bug fixKevin Robertson1-8/+5
Fixed a bug that was preventing proxy and https listeners from finding a target.
2020-04-12Proxy auth fixKevin Robertson1-2/+2
https://github.com/Kevin-Robertson/Inveigh/issues/20
2019-08-18bug fixesKevin Robertson1-15/+48
2019-08-04Merge branch 'master' of https://github.com/Kevin-Robertson/InveighKevin Robertson1-1/+1
2019-08-04DNS spoofer fixesKevin Robertson1-4/+4
2019-07-31Update README.mdKevin Robertson1-1/+1
2019-07-31Inveigh 1.51,5Kevin Robertson3-1003/+2249
Added privileged and unprivileged DNS spoofer capable of answering incoming DNS requests. New ADIDNS attack called NS that can add an NS record to direct DNS requests to Inveigh host. Using this with WPAD can bypass the global query block list (GQBL). https://blog.netspi.com/adidns-revisited/ Pcap TCP and UDP output. New packet sniffing output including incoming SYN packets, kerberos auth negotiation, null responses, local DNS requests. Kerberos kirbi output for unconstrained delegation attacks. - https://blog.netspi.com/machineaccountquota-is-useful-sometimes/
2019-02-21Update README.mdKevin Robertson1-1/+1
2019-02-20Bug fixes and readme updateKevin Robertson2-68/+126
2018-09-25Inveigh 1.41.4Kevin Robertson9-6318/+10578
Inveigh Added ADIDNS attacks New detection evasions Inveigh Relay Added session and enumerate attacks Added ability to handle multiple targets with target selection based on the enumerate attack and/or BloodHound imports
2017-04-09Readme updateKevin Robertson1-1/+1
2017-04-09Inveigh 1.3.11.3.1Kevin Robertson2-367/+580
Added try/finally block to shutdown runspaces when using Empire 2.0's "jobs kill" command. Added handling for Firefox popup boxes. Fixed Empire console output. Various other small bug fixes and comment corrections.
2017-04-06Empire output fix, comment updatesKevin Robertson2-106/+153
Fixed the warning handling for running through Empire. Updated some comments where I left out mDNS.
2017-04-05Inveigh 1.31.3Kevin Robertson7-4479/+6050
Inveigh.ps1 Merged Inveigh and Inveigh-Unprivileged. The new module will run the correct functions based on the detected privilege level or ElevatedPrivilege parameter setting. Added proxy auth capture. (thanks to @lgandx and @mubix for the idea from https://github.com/lgandx/Responder) Added mDNS spoofer. Added limited ability to attack browsers of proxy auth targets. Added the ability to set the content type header for HTTPReponse, or files from disk through HTTPDir, for better support for HTA, etc. Added the ability to capture POST requests. Inveigh-Relay.ps1 Refactored the module. Switched to a TCPListener based HTTP listener so that the module can be run with an unprivileged user. If running unprivileged, the Inveigh host can be targeted with relay for privesc. Added support for longer commands to execute on the target. The module is now Empire 2.0 launcher friendly. Added SMB2 support. The module will negotiate by default and can be forced into SMB1 with the SMB1 switch. Added proxy auth capture and relay. Added NTLMv1 relay support. Added RelayAutoExit parameter to stop any running Inveigh modules after a successful relay. Inveigh.ps1 and Inveigh-Relay.ps1 Added a new HTTPS certificate install method that does not require a certificate file. (thanks to @subTee for code example from https://github.com/subTee/Interceptor) Added user agent and host header details to console/file output. Added ability to filter out specific browsers by user agent for wpad and proxy auth. Added console output levels. Added control over in memory log file and console queue. Inveigh-Unprivileged.ps1 This module has been removed.
2017-01-30Typo fixesKevin Robertson1-2/+2
Thanks to @clr2of8 for reporting the typos.
2016-11-29Updated readmeKevin Robertson1-1/+4
Added PowerUpSQL, PoshC2, and pupy to the 'Included In' section of the readme
2016-10-18Minor fixes for when ports are in use and checks are disabledKevin Robertson1-17/+32
2016-10-17Removed try from NBNS spoofer startupKevin Robertson1-12/+2
2016-10-17Fixes for startup checksKevin Robertson3-20/+109
Added @6cyril's improved netstat checks. Added StartupChecks parameter for an easy way to disable checks if they get in the way.
2016-10-13Updated responder linkKevin Robertson1-1/+1
2016-09-14Typo fixesKevin Robertson2-7/+7
2016-09-14LLMNR learning fixKevin Robertson1-1/+1
Fixed a bad if statement that was preventing Inveigh from sending out LLMNR requests with SpooferLearning enabled.
2016-09-13Correcting Inveigh-BruteForce's survival of the syncKevin Robertson1-1749/+0
2016-09-13Inveigh 1.21.2Kevin Robertson8-1434/+4400
1. Added Inveigh-Unprivileged.ps1 (replaces Inveigh-BruteForce.ps1) – This script contains only LLMNR/NBNS spoofing and hash capture methods that do not require local admin access. The NBNS spoofer can be used without disabling the local NBNS service. The LLMNR spoofer does require stopping (needs admin) the local service and freeing up port 5355. It will work without admin on a system with LLMNR disabled. Note that there can still be systems configurations that will prevent Inveigh-Unprivileged from working, and require admin access to change (e.g. local firewall blocking traffic, LLMNR enabled). This script replaces Inveigh-BruteForce and contains the same functionality. 2. Inveigh.ps1 Updates - Added a learning mode (SpooferLearning parameter) to Invoke-Inveigh that will attempt to avoid spoofing requests for valid hostnames. If enabled, Inveigh will send out LLMNR/NBNS requests for hostnames received through incoming LLMNR/NBNS requests. If Inveigh receives a response for a sent requests, it will add the hostname to a blacklist. Added some some code to help keep track or the SMB capture sequence. Removed the ability to launch Invoke-InveighRelay directly from an Invoke-Inveigh command line. 3. Inveigh-Relay.ps1 Status - This one is due for an overhhaul. I'm also considering trying to convert it to not require admin access. No real changes on this pass though. It will work with either Invoke-Inveigh (-HTTP N and/or -HTTPS N) or Invoke-InveighUnprivileged (-HTTP N) as long as the target system supports SMB1. 4. Support Functions - Merged all of the small Get functions into Get-Inveigh. 5. Extras – Added an extras directory for functions that don’t fit the main scripts. a. Send-NBNSResponse – This function sends a crafted NBNS response packet to a specific target. For name resolution to be successful, the specified TargetIP, Hostname, and TransactionID must match a very (very very) recent NBNS request. You must have an external method (wireshark,etc) of viewing the required NBNS request fields for traffic on the target subnet. The odds of pulling this attack off manually are slim due to the narrow response window. I've only been able to get it to work manually by watching tshark with the the transaction ID being listed in the output. Ideally, this function would be fed by another script. b. Send-LLMNResponse – Just like Send-NBNSResponse but even harder to use manually. c. Invoke-NBNSC2 - Invoke-NBNSC2 will listen for NBNS requests and execute set commands if requests for specific hostnames are received. The function must be supplied with an even number of Hostnames and Commands. NBNS requests can be sent from a NBNS enabled system on the same subnet using ping, etc.
2016-08-02Windows Firewall check and readme updateKevin Robertson4-4/+47
Added a warning for when the Windows Firewall is enabled. Added a note about the June patches likely breaking features of Invoke-InveighBruteForce.
2016-07-24Merge pull request #7 from joncave/NTLMSSP-parsingKevin Robertson1-89/+95
Fix NTLMSSP message parsing
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-27 23:57:40 +0000