foxglovesec / Potato

685 stars 166 forks source link

Potato not hearing NBNS requests? #8

Open tfriesen opened 6 years ago

tfriesen commented 6 years ago

Since there are no instructions on how to 'install' the tool, I got Potato working by downloading the .exe and the two .dlls from Potato/source/Potato/Potato/bin/Release/

I ran the tool as suggested on my Win7 machine, and here is my output:

c:\Users***\Downloads>Potato.exe -ip -cmd "" -disable_exhaust true Starting NBNS spoofer...WPAD = 127.0.0.1 Clearing dns and nbns cache... Listening... Clearing dns and nbns cache... Clearing dns and nbns cache... Clearing dns and nbns cache...

Continuing on like that until I hit ctrl+c. If I open up wireshark, I can see the NBNS broadcast requests for WPAD from my host hitting the network. Naturally, I don't see any repsonses as Wireshark cannot monitor the loopback interface on Windows.

I would expect to see the 'Got 127.0.0.1' in the output, but it never shows up. I've tried with and without admin privs, and with and without the Windows firewall enabled, and on two different Win7 machines with same results.

I've also tried setting diable_exhaust to false. In this case, my internet dies as all DNS requests from the host are failing.

Have I missed some steps in the setup? It looks to me like Potato is not receiving the NBNS or DNS requsts, but I verfied that UDP port 137 is listenening after I run Potato, but not before.