You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm on a project turning a Raspberry Pi Zero into a stand-alone USB over Ethernet pawning device.
To do so the ideas of @samyk and @mubix have been extended. The project relies heavily on Responders capabilities to serve HTML content and to force authentication on requests to "wpad.dat" / "*.pac" or on Proxies after redirection based on wpad.dat.
Unfortunately these two capabilities could not be combined (if Serve-Html = On, wpad.dat doesn't get delivered, neither is authentication forced). I have added in an config option to enable the described behavior, called Serve-Html-Provide-WPAD-anyway
Additionally, as I'm (mis)using Responder as stand-alone web server with Serve-Html = On. Targeting Windows machines, there was a need to cope with Microsoft's connectivity tests (f.e. to "http://www.msftncsi.com/ncsi.txt" on Win 7). I added in an option Serve-Html-Simulate-Internet to serve the correct HTTP responses to those requests, while running with Serve-Html = On
Below is a short feature description of my (yet unreleased) project, but I think the Responder modification could be useful for everybody else, thus I'm starting a PR. Merging this would help me again to keep my projects setup script clean, as I would be able to clone from your repo, without further patching.
Feature of my project (see notes on Responder)
# Notes/Features:
# - A composite device for Ethernet over USB is presented, providing RNDIS for
# Windows and CDC ECM for Linux/Unix
# - The windows setup supports automatic driver installation, by adding Microsoft
# OS Descriptors to the USB descriptor (tested on Windows 7 and Windows 10).
# - The Setup works well on USB 2.0 Ports (only in some cases on USB3.0)
# - The script detects if RNDIS or CDC ECM is used, by polling the link state
# of both internal interfaces. If RNDIS (usb0) is detected to be active CDC ECM gets
# disabled (usb1). If CDC ECM (usb1) gets link, RNDIS (usb0) will be disabled.
# If neither one gets link both are disabled after RETRY_COUNT_LINK_DETECTION attempts.
# - Because only one adapter is used after link detection, the DHCP setup DOESN'T
# DIFFER BETWEEN Windows and Linux. This comes in handy if this should be used to trigger
# reverse connections, as the IP of the Raspberry is always known.
# - The initial idea was to run NTLM hash stealing, as shown by MUBIX, which unfortunately
# seems to be addressed by Microsoft with MS16-112.
# - To allow capturing hashes anyway, the setup has been combined with Samy Kamkar's approach
# of choosing a large IP subnet (1 Bit network mask) to capture HTTP traffic to all IPs fitting
# into this network mask. Responder is used to answer HTTP requests with content containing
# a SMB redirect, which lands at Responder's SMB server again and should help to capture
# NTLM hashes in a more generic way.
# - To behave like intended, Responder.py has been patched with the following functionality:
# 1) If "Serve-Html" is set to on, responder delivers the same Page, no matter what is requested.
# This behavior has been changed, to deliver the Custom WPAD script if "/wpad.dat" or "/*.pac"
# is requested.
# 2) If Responder runs without upstream (not forwarding to Internet), like in this setup, Windows
# detects that the new network has no Internet access. An option to answer connection tests in a manner
# to make Windows believe Internet is accessible, has been added (at time of writing only for Windows 7
# IPv4, which checks for "http://www.msftncsi.com/ncsi.txt"). This should help to keep the network enabled
# and traffic flowing through the raspberry.
The text was updated successfully, but these errors were encountered:
I'm on a project turning a Raspberry Pi Zero into a stand-alone USB over Ethernet pawning device.
To do so the ideas of @samyk and @mubix have been extended. The project relies heavily on Responders capabilities to serve HTML content and to force authentication on requests to "wpad.dat" / "*.pac" or on Proxies after redirection based on wpad.dat.
Unfortunately these two capabilities could not be combined (if Serve-Html = On, wpad.dat doesn't get delivered, neither is authentication forced). I have added in an config option to enable the described behavior, called
Serve-Html-Provide-WPAD-anyway
Additionally, as I'm (mis)using Responder as stand-alone web server with
Serve-Html = On
. Targeting Windows machines, there was a need to cope with Microsoft's connectivity tests (f.e. to "http://www.msftncsi.com/ncsi.txt" on Win 7). I added in an optionServe-Html-Simulate-Internet
to serve the correct HTTP responses to those requests, while running withServe-Html = On
Below is a short feature description of my (yet unreleased) project, but I think the Responder modification could be useful for everybody else, thus I'm starting a PR. Merging this would help me again to keep my projects setup script clean, as I would be able to clone from your repo, without further patching.
Feature of my project (see notes on Responder)
The text was updated successfully, but these errors were encountered: