Inveigh는 침투 테스터를 위한 크로스 플랫폼 .NET IPv4/IPv6 중간자 공격 도구입니다. 이 저장소에는 기본 C# 버전과 레거시 PowerShell 버전이 포함되어 있습니다.
Inveigh는 패킷 스니핑과 프로토콜별 리스너/소켓을 통해 스푸핑 공격과 해시/자격 증명 캡처를 수행합니다. 이 도구의 원래 PowerShell 버전의 기반이었던 패킷 스니핑 방식은 다음과 같은 장점이 있습니다:
주요 단점은 상승된 액세스 권한이 필요하다는 것입니다.
현재 Windows 버전에서는 기본적으로 실행되는 UDP 서비스가 포트 재사용을 허용합니다. 따라서 패킷 스니핑은 사용 중인 UDP 포트를 우회하는 데 더 이상 이점을 제공하지 않습니다. Inveigh의 UDP 리스너는 모두 포트 재사용을 활용하도록 구성되어 있습니다.
Inveigh의 C# 버전은 다음 프로토콜에 대한 공격을 포함합니다:
Inveigh는 기본 프로토콜에서 두 가지를 모두 지원하는 경우 IPv4와 IPv6 모두에서 작동합니다.
Inveigh의 SDK 스타일 프로젝트 파일은 .NET 3.5, 4.6.2 및 6.0용으로 설정되어 있으며, 6.0은 Linux 및 macOS에서도 작동하는 버전입니다.
<TargetFrameworks>net35;net62;net6.0</TargetFrameworks>
sudo route -nv add -net ff02::1:2 -interface en0dotnet Inveigh.dll
대상 시스템에 .NET 6.0이 설치된 경우
dotnet publish -r linux-x64 -f net8.0 -p:AssemblyName=inveigh
dotnet publish -r osx-x64 -f net8.0 -p:AssemblyName=inveigh
대상 시스템에 .NET 6.0이 설치되지 않은 경우
dotnet publish --self-contained=true -p:PublishSingleFile=true -r linux-x64 -f net8.0 -p:AssemblyName=inveigh
dotnet publish --self-contained=true -p:PublishSingleFile=true -r osx-x64 -f net8.0 -p:AssemblyName=inveigh
기본 매개변수 값은 Program.cs의 시작 부분에 있습니다. 컴파일하기 전에 모든 내용을 검토하여 필요에 맞게 설정할 것을 권장합니다. 모든 활성화/비활성화 매개변수는 Y/N 값으로 설정할 수 있습니다.```
//begin parameters - set defaults as needed before compile
public static string argCert = "MIIKaQIBAzCCC..."
public static string argCertPassword = "password";
public static string argChallenge = "";
public static string argConsole = "5";
public static string argConsoleLimit = "-1";
public static string argConsoleStatus = "0";
public static string argConsoleUnique = "Y";
public static string argDHCPv6 = "N";
public static string argDHCPv6TTL = "30";
public static string argDNS = "Y";
...
//end parameters
### 매개변수 도움말```
.\Inveigh.exe -?
Control:
-Inspect Default=Disabled: (Y/N) inspect traffic only.
-IPv4 Default=Enabled: (Y/N) IPv4 spoofing/capture.
-IPv6 Default=Enabled: (Y/N) IPv6 spoofing/capture.
-RunCount Default=Unlimited: Number of NetNTLM captures to perform before auto-exiting.
-RunTime Default=Unlimited: Run time duration in minutes.
Output:
-Console Default=5: Set the level for console output. (0=none, 1=only captures/spoofs, 2=no disabled, no informational, 3=no disabled, no filtered, 4=no disabled, 5=all)
-ConsoleLimit Default=Unlimited: Limit to queued console entries.
-ConsoleStatus Default=Disabled: Interval in minutes for auto-displaying capture details.
-ConsoleUnique Default=Enabled: (Y/N) displaying only unique (user and system combination) hashes at time of capture.
-FileDirectory Default=Working Directory: Valid path to an output directory for enabled file output.
-FileOutput Default=Enabled: (Y/N) real time file output.
-FilePrefix Default=Inveigh: Prefix for all output files.
-FileUnique Default=Enabled: (Y/N) outputting only unique (user and system combination) hashes.
-LogOutput Default=Disabled: (Y/N) outputting log entries.
Spoofers:
-DHCPV6 Default=Disabled: (Y/N) DHCPv6 spoofing.
-DHCPv6TTL Default=300: Lease lifetime in seconds.
-DNS Default=Enabled: (Y/N) DNS spoofing.
-DNSHost Fully qualified hostname to use SOA/SRV responses.
-DNSSRV Default=LDAP: Comma separated list of SRV request services to answer.
-DNSSuffix DNS search suffix to include in DHCPv6/ICMPv6 responses.
-DNSTTL Default=30: DNS TTL in seconds.
-DNSTYPES Default=A: (A, AAAA, SOA, SRV) Comma separated list of DNS types to spoof.
-ICMPv6 Default=Enabled: (Y/N) sending ICMPv6 router advertisements.
-ICMPv6Interval Default=200: ICMPv6 RA interval in seconds.
-ICMPv6TTL Default=300: ICMPv6 TTL in seconds.
-IgnoreDomains Default=None: Comma separated list of domains to ignore when spoofing.
-IgnoreIPs Default=Local: Comma separated list of source IP addresses to ignore when spoofing.
-IgnoreMACs Default=Local: Comma separated list of MAC addresses to ignore when DHCPv6 spoofing.
-IgnoreQueries Default=None: Comma separated list of name queries to ignore when spoofing.
-Local Default=Disabled: (Y/N) performing spoofing attacks against the host system.
-LLMNR Default=Enabled: (Y/N) LLMNR spoofing.
-LLMNRTTL Default=30: LLMNR TTL in seconds.
-MAC Local MAC address for DHCPv6.
-MDNS Default=Enabled: (Y/N) mDNS spoofing.
-MDNSQuestions Default=QU,QM: Comma separated list of question types to spoof. (QU,QM)
-MDNSTTL Default=120: mDNS TTL in seconds.
-MDNSTypes Default=A: Comma separated list of mDNS record types to spoof. (A,AAAA,ANY)
-MDNSUnicast Default=Enabled: (Y/N) sending a unicast only response to a QM request.
-NBNS Default=Disabled: (Y/N) NBNS spoofing.
-NBNSTTL Default=165: NBNS TTL in seconds.
-NBNSTypes Default=00,20: Comma separated list of NBNS types to spoof. (00,03,20,1B)
-ReplyToDomains Default=All: Comma separated list of domains to respond to when spoofing.
-ReplyToIPs Default=All: Comma separated list of source IP addresses to respond to when spoofing.
-ReplyToMACs Default=All: Comma separated list of MAC addresses to respond to when DHCPv6 spoofing.
-ReplyToQueries Default=All: Comma separated list of name queries to respond to when spoofing.
-SpooferIP Default=Autoassign: IP address included in spoofing responses.
-SpooferIPv6 Default=Autoassign: IPv6 address included in spoofing responses.
-Repeat Default=Enabled: (Y/N) repeated spoofing attacks against a system after NetNTLM capture.
Capture:
-Cert Base64 certificate for TLS.
-CertPassword Base64 certificate password for TLS.
-Challenge Default=Random per request: 16 character hex NetNTLM challenge for use with the TCP listeners.
-HTTP Default=Enabled: (Y/N) HTTP listener.
-HTTPAuth Default=NTLM: (Anonymous/Basic/NTLM) HTTP/HTTPS listener authentication.
-HTTPPorts Default=80: Comma seperated list of TCP ports for the HTTP listener.
-HTTPRealm Default=ADFS: Basic authentication realm.
-HTTPResponse Content to serve as the default HTTP/HTTPS/Proxy response.
-HTTPS Default=Enabled: (Y/N) HTTPS listener.
-HTTPSPorts Default=443: Comma separated list of TCP ports for the HTTPS listener.
-IgnoreAgents Default=Firefox: Comma separated list of HTTP user agents to ignore with wpad and proxy auth.
-LDAP Default=Enabled: (Y/N) LDAP listener.
-LDAPPorts Default=389: Comma separated list of TCP ports for the LDAP listener.
-ListenerIP Default=Any: IP address for all listeners.