Inveigh

Inveigh est un outil .NET multiplateforme de type machine-in-the-middle pour IPv4/IPv6 destiné aux testeurs d'intrusion. Ce dépôt contient la version principale en C# ainsi que la version PowerShell historique.

Overview

Inveigh mène des attaques par usurpation et capture des hachages/mots de passe via l'écoute de paquets et des écouteurs/sockets spécifiques aux protocoles. La méthode d'écoute de paquets, qui était à la base de la version PowerShell originale de cet outil, présente les avantages suivants :

Captures de challenge/réponse NTLM SMB via le service SMB de Windows
Moins de liaisons de ports visibles sur le système hôte

Le principal inconvénient est la nécessité d'un accès élevé.

Sur les versions actuelles de Windows, les services UDP par défaut autorisent la réutilisation des ports. Par conséquent, l'écoute de paquets n'offre plus d'avantage pour contourner les ports UDP déjà utilisés. Tous les écouteurs UDP d'Inveigh sont configurés pour tirer parti de la réutilisation des ports.

Version Descriptions

PowerShell Inveigh - version originale développée sur de nombreuses années. Pour l'instant du moins, cette version (1.506) ne recevra pas de mises à jour supplémentaires. La documentation se trouve ici.
C# Inveigh (alias InveighZero) - code POC C# original combiné à un portage C# de la majeure partie du code de la version PowerShell. Cette version a maintenant été reconstruite en C# et devient la version principale.

Features

La version C# d'Inveigh contient des attaques pour les protocoles suivants :

### Aide sur les paramètres``` .\Inveigh.exe -? Control: -Inspect Default=Disabled: (Y/N) inspect traffic only. -IPv4 Default=Enabled: (Y/N) IPv4 spoofing/capture. -IPv6 Default=Enabled: (Y/N) IPv6 spoofing/capture. -RunCount Default=Unlimited: Number of NetNTLM captures to perform before auto-exiting. -RunTime Default=Unlimited: Run time duration in minutes. Output: -Console Default=5: Set the level for console output. (0=none, 1=only captures/spoofs, 2=no disabled, no informational, 3=no disabled, no filtered, 4=no disabled, 5=all) -ConsoleLimit Default=Unlimited: Limit to queued console entries. -ConsoleStatus Default=Disabled: Interval in minutes for auto-displaying capture details. -ConsoleUnique Default=Enabled: (Y/N) displaying only unique (user and system combination) hashes at time of capture. -FileDirectory Default=Working Directory: Valid path to an output directory for enabled file output. -FileOutput Default=Enabled: (Y/N) real time file output. -FilePrefix Default=Inveigh: Prefix for all output files. -FileUnique Default=Enabled: (Y/N) outputting only unique (user and system combination) hashes. -LogOutput Default=Disabled: (Y/N) outputting log entries. Spoofers: -DHCPV6 Default=Disabled: (Y/N) DHCPv6 spoofing. -DHCPv6TTL Default=300: Lease lifetime in seconds. -DNS Default=Enabled: (Y/N) DNS spoofing. -DNSHost Fully qualified hostname to use SOA/SRV responses. -DNSSRV Default=LDAP: Comma separated list of SRV request services to answer. -DNSSuffix DNS search suffix to include in DHCPv6/ICMPv6 responses. -DNSTTL Default=30: DNS TTL in seconds. -DNSTYPES Default=A: (A, AAAA, SOA, SRV) Comma separated list of DNS types to spoof. -ICMPv6 Default=Enabled: (Y/N) sending ICMPv6 router advertisements. -ICMPv6Interval Default=200: ICMPv6 RA interval in seconds. -ICMPv6TTL Default=300: ICMPv6 TTL in seconds. -IgnoreDomains Default=None: Comma separated list of domains to ignore when spoofing. -IgnoreIPs Default=Local: Comma separated list of source IP addresses to ignore when spoofing. -IgnoreMACs Default=Local: Comma separated list of MAC addresses to ignore when DHCPv6 spoofing. -IgnoreQueries Default=None: Comma separated list of name queries to ignore when spoofing. -Local Default=Disabled: (Y/N) performing spoofing attacks against the host system. -LLMNR Default=Enabled: (Y/N) LLMNR spoofing. -LLMNRTTL Default=30: LLMNR TTL in seconds. -MAC Local MAC address for DHCPv6. -MDNS Default=Enabled: (Y/N) mDNS spoofing. -MDNSQuestions Default=QU,QM: Comma separated list of question types to spoof. (QU,QM) -MDNSTTL Default=120: mDNS TTL in seconds. -MDNSTypes Default=A: Comma separated list of mDNS record types to spoof. (A,AAAA,ANY) -MDNSUnicast Default=Enabled: (Y/N) sending a unicast only response to a QM request. -NBNS Default=Disabled: (Y/N) NBNS spoofing. -NBNSTTL Default=165: NBNS TTL in seconds. -NBNSTypes Default=00,20: Comma separated list of NBNS types to spoof. (00,03,20,1B) -ReplyToDomains Default=All: Comma separated list of domains to respond to when spoofing. -ReplyToIPs Default=All: Comma separated list of source IP addresses to respond to when spoofing. -ReplyToMACs Default=All: Comma separated list of MAC addresses to respond to when DHCPv6 spoofing. -ReplyToQueries Default=All: Comma separated list of name queries to respond to when spoofing. -SpooferIP Default=Autoassign: IP address included in spoofing responses. -SpooferIPv6 Default=Autoassign: IPv6 address included in spoofing responses. -Repeat Default=Enabled: (Y/N) repeated spoofing attacks against a system after NetNTLM capture. Capture: -Cert Base64 certificate for TLS. -CertPassword Base64 certificate password for TLS. -Challenge Default=Random per request: 16 character hex NetNTLM challenge for use with the TCP listeners. -HTTP Default=Enabled: (Y/N) HTTP listener. -HTTPAuth Default=NTLM: (Anonymous/Basic/NTLM) HTTP/HTTPS listener authentication. -HTTPPorts Default=80: Comma seperated list of TCP ports for the HTTP listener. -HTTPRealm Default=ADFS: Basic authentication realm. -HTTPResponse Content to serve as the default HTTP/HTTPS/Proxy response. -HTTPS Default=Enabled: (Y/N) HTTPS listener. -HTTPSPorts Default=443: Comma separated list of TCP ports for the HTTPS listener. -IgnoreAgents Default=Firefox: Comma separated list of HTTP user agents to ignore with wpad and proxy auth. -LDAP Default=Enabled: (Y/N) LDAP listener. -LDAPPorts Default=389: Comma separated list of TCP ports for the LDAP listener. -ListenerIP Default=Any: IP address for all listeners. -ListenerIPv6 Default=Any: IPv6 address for all listeners. -MachineAccount Default=Enabled: (Y/N) machine account NetNTLM captures. -Proxy Default=Disabled: (Y/N) proxy listener authentication captures. -ProxyAuth Default=NTLM: (Basic/NTLM) Proxy authentication. -ProxyPort Default=8492: Port for the proxy listener. -SMB Default=Enabled: (Y/N) SMB sniffer/listener. -SMBPorts Default=445: Port for the SMB listener. -SnifferIP Default=Autoassign: IP address included in spoofing responses. -SnifferIPv6 Default=Autoassign: IPv6 address included in spoofing responses. -WebDAV Default=Enabled: (Y/N) serving WebDAV over HTTP/HTTPS listener. -WebDAVAuth Default=NTLM: (Anonymous/Basic/NTLM) WebDAV authentication. -WPADAuth Default=Enabled: (Y/N) authentication type for wpad.dat requests. (Anonymous/Basic/NTLM) -WPADResponse Default=Autogenerated: Contents of wpad.dat responses.

## Console Inveigh contient une console accessible pendant que l'outil est en cours d'exécution (appuyez sur Échap pour entrer et sortir). La console offre un accès facile aux informations d'identification/hashes capturés et à diverses autres informations. L'invite de la console fournit des mises à jour en temps réel des comptes de texte clair, NTLMv1 et NTLMv2 sous le format unique:total. Notez que la console peut être inaccessible lors d'une exécution via C2. ### Aide de la console interactive - entrez ? ou HELP``` =============================================== Inveigh Console Commands =============================================== Command Description ======================================================================================================================== GET CONSOLE | get queued console output GET DHCPv6Leases | get DHCPv6 assigned IPv6 addresses GET LOG | get log entries; add search string to filter results GET NTLMV1 | get captured NTLMv1 hashes; add search string to filter results GET NTLMV2 | get captured NTLMv2 hashes; add search string to filter results GET NTLMV1UNIQUE | get one captured NTLMv1 hash per user; add search string to filter results GET NTLMV2UNIQUE | get one captured NTLMv2 hash per user; add search string to filter results GET NTLMV1USERNAMES | get usernames and source IPs/hostnames for captured NTLMv1 hashes GET NTLMV2USERNAMES | get usernames and source IPs/hostnames for captured NTLMv2 hashes GET CLEARTEXT | get captured cleartext credentials GET CLEARTEXTUNIQUE | get unique captured cleartext credentials GET REPLYTODOMAINS | get ReplyToDomains parameter startup values GET REPLYTOIPS | get ReplyToIPs parameter startup values GET REPLYTOMACS | get ReplyToMACs parameter startup values GET REPLYTOQUERIES | get ReplyToQueries parameter startup values GET IGNOREDOMAINS | get IgnoreDomains parameter startup values GET IGNOREIPS | get IgnoreIPs parameter startup values GET IGNOREMACS | get IgnoreMACs parameter startup values GET IGNOREQUERIES | get IgnoreQueries parameter startup values SET CONSOLE | set Console parameter value HISTORY | get command history RESUME | resume real time console output STOP | stop Inveigh

Inveigh

Populaires

Cross-Platform Support

Known Issues

Execution

Linux/macOS Platform Targeted Builds

Usage

Par défaut (détection automatique des IP locales)```

DHCPv6

DNS

mDNS

NBNS

SMB

LDAP

Authentification proxy

Invite de console interactive