lgandx / Responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
GNU General Public License v3.0
5.36k stars 768 forks source link

Enhancement: Microsoft connectivity test and wpad.dat delivery, while using "Serve-Html" #41

Closed mame82 closed 4 years ago

mame82 commented 7 years ago

I'm on a project turning a Raspberry Pi Zero into a stand-alone USB over Ethernet pawning device. To do so the ideas of @samyk and @mubix have been extended. The project relies heavily on Responders capabilities to serve HTML content and to force authentication on requests to "wpad.dat" / "*.pac" or on Proxies after redirection based on wpad.dat. Unfortunately these two capabilities could not be combined (if Serve-Html = On, wpad.dat doesn't get delivered, neither is authentication forced). I have added in an config option to enable the described behavior, called Serve-Html-Provide-WPAD-anyway

Additionally, as I'm (mis)using Responder as stand-alone web server with Serve-Html = On. Targeting Windows machines, there was a need to cope with Microsoft's connectivity tests (f.e. to "http://www.msftncsi.com/ncsi.txt" on Win 7). I added in an option Serve-Html-Simulate-Internet to serve the correct HTTP responses to those requests, while running with Serve-Html = On

Below is a short feature description of my (yet unreleased) project, but I think the Responder modification could be useful for everybody else, thus I'm starting a PR. Merging this would help me again to keep my projects setup script clean, as I would be able to clone from your repo, without further patching.

Feature of my project (see notes on Responder)

# Notes/Features:
#       - A composite device for Ethernet over USB is presented, providing RNDIS for
#       Windows and CDC ECM for Linux/Unix
#       - The windows setup supports automatic driver installation, by adding Microsoft
#       OS Descriptors to the USB descriptor (tested on Windows 7 and Windows 10).
#       - The Setup works well on USB 2.0 Ports (only in some cases on USB3.0)
#       - The script detects if RNDIS or CDC ECM is used, by polling the link state
#       of both internal interfaces. If RNDIS (usb0) is detected to be active CDC ECM gets
#       disabled (usb1). If CDC ECM (usb1) gets link, RNDIS (usb0) will be disabled.
#       If neither one gets link both are disabled after RETRY_COUNT_LINK_DETECTION attempts.
#       - Because only one adapter is used after link detection, the DHCP setup DOESN'T
#       DIFFER BETWEEN Windows and Linux. This comes in handy if this should be used to trigger 
#       reverse connections, as the IP of the Raspberry is always known.
#       - The initial idea was to run NTLM hash stealing, as shown by MUBIX, which unfortunately
#       seems to be addressed by Microsoft with MS16-112.
#       - To allow capturing hashes anyway, the setup has been combined with Samy Kamkar's approach
#       of choosing a large IP subnet (1 Bit network mask) to capture HTTP traffic to all IPs fitting
#       into this network mask. Responder is used to answer HTTP requests with content containing
#       a SMB redirect, which lands at Responder's SMB server again and should help to capture
#       NTLM hashes in a more generic way.
#       - To behave like intended, Responder.py has been patched with the following functionality:
#               1) If "Serve-Html" is set to on, responder delivers the same Page, no matter what is requested.
#               This behavior has been changed, to deliver the Custom WPAD script if "/wpad.dat" or "/*.pac"
#               is requested.
#               2) If Responder runs without upstream (not forwarding to Internet), like in this setup, Windows
#               detects that the new network has no Internet access. An option to answer connection tests in a manner
#               to make Windows believe Internet is accessible, has been added (at time of writing only for Windows 7
#               IPv4, which checks for "http://www.msftncsi.com/ncsi.txt"). This should help to keep the network enabled
#               and traffic flowing through the raspberry.
mame82 commented 7 years ago

Meanwhile the first version of the project is online and heavily relying on Responder: https://github.com/mame82/P4wnP1

Unfotunately I have to use my own branch of Responder in the install script so I hope there is going to be a merge on PR #42