Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhancement: Microsoft connectivity test and wpad.dat delivery, while using "Serve-Html" #41

Closed
mame82 opened this issue Feb 21, 2017 · 1 comment

Comments

@mame82
Copy link

mame82 commented Feb 21, 2017

I'm on a project turning a Raspberry Pi Zero into a stand-alone USB over Ethernet pawning device.
To do so the ideas of @samyk and @mubix have been extended. The project relies heavily on Responders capabilities to serve HTML content and to force authentication on requests to "wpad.dat" / "*.pac" or on Proxies after redirection based on wpad.dat.
Unfortunately these two capabilities could not be combined (if Serve-Html = On, wpad.dat doesn't get delivered, neither is authentication forced). I have added in an config option to enable the described behavior, called Serve-Html-Provide-WPAD-anyway

Additionally, as I'm (mis)using Responder as stand-alone web server with Serve-Html = On. Targeting Windows machines, there was a need to cope with Microsoft's connectivity tests (f.e. to "http://www.msftncsi.com/ncsi.txt" on Win 7). I added in an option Serve-Html-Simulate-Internet to serve the correct HTTP responses to those requests, while running with Serve-Html = On

Below is a short feature description of my (yet unreleased) project, but I think the Responder modification could be useful for everybody else, thus I'm starting a PR. Merging this would help me again to keep my projects setup script clean, as I would be able to clone from your repo, without further patching.

Feature of my project (see notes on Responder)

# Notes/Features:
#       - A composite device for Ethernet over USB is presented, providing RNDIS for
#       Windows and CDC ECM for Linux/Unix
#       - The windows setup supports automatic driver installation, by adding Microsoft
#       OS Descriptors to the USB descriptor (tested on Windows 7 and Windows 10).
#       - The Setup works well on USB 2.0 Ports (only in some cases on USB3.0)
#       - The script detects if RNDIS or CDC ECM is used, by polling the link state
#       of both internal interfaces. If RNDIS (usb0) is detected to be active CDC ECM gets
#       disabled (usb1). If CDC ECM (usb1) gets link, RNDIS (usb0) will be disabled.
#       If neither one gets link both are disabled after RETRY_COUNT_LINK_DETECTION attempts.
#       - Because only one adapter is used after link detection, the DHCP setup DOESN'T
#       DIFFER BETWEEN Windows and Linux. This comes in handy if this should be used to trigger 
#       reverse connections, as the IP of the Raspberry is always known.
#       - The initial idea was to run NTLM hash stealing, as shown by MUBIX, which unfortunately
#       seems to be addressed by Microsoft with MS16-112.
#       - To allow capturing hashes anyway, the setup has been combined with Samy Kamkar's approach
#       of choosing a large IP subnet (1 Bit network mask) to capture HTTP traffic to all IPs fitting
#       into this network mask. Responder is used to answer HTTP requests with content containing
#       a SMB redirect, which lands at Responder's SMB server again and should help to capture
#       NTLM hashes in a more generic way.
#       - To behave like intended, Responder.py has been patched with the following functionality:
#               1) If "Serve-Html" is set to on, responder delivers the same Page, no matter what is requested.
#               This behavior has been changed, to deliver the Custom WPAD script if "/wpad.dat" or "/*.pac"
#               is requested.
#               2) If Responder runs without upstream (not forwarding to Internet), like in this setup, Windows
#               detects that the new network has no Internet access. An option to answer connection tests in a manner
#               to make Windows believe Internet is accessible, has been added (at time of writing only for Windows 7
#               IPv4, which checks for "http://www.msftncsi.com/ncsi.txt"). This should help to keep the network enabled
#               and traffic flowing through the raspberry.

@mame82
Copy link
Author

mame82 commented Feb 26, 2017

Meanwhile the first version of the project is online and heavily relying on Responder: https://github.com/mame82/P4wnP1

Unfotunately I have to use my own branch of Responder in the install script so I hope there is going to be a merge on PR #42

@lgandx lgandx closed this as completed Aug 17, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants