InveighZero: C# LLMNR/NBNS/mDNS/DNS spoofer and man-in-the-middle tool

by do son · August 5, 2019

InveighZero

InveighZero is a C# LLMNR/NBNS/mDNS/DNS spoofer and man-in-the-middle tool designed to assist penetration testers/red teamers that find themselves limited to a Windows system. This version shares many features with the PowerShell version of Inveigh.

Privileged Mode Features (elevated admin required)

SMB capture – packet sniffer based
LLMNR spoofer – packet sniffer based
NBNS spoofer – packet sniffer based
mDNS spoofer – packet sniffer based
DNS spoofer – packet sniffer based
Pcap output – TCP and UDP packets
Packet sniffer console output – SYN packets, SMB Kerberos negotiation, etc

Unprivileged Mode Features

LLMNR spoofer – UDP listener based
NBNS spoofer – UDP listener based
mDNS spoofer – UDP listener based
DNS spoofer – UDP listener based
Note: The NBNS spoofer should work on all systems even with NBNS enabled. The LLMNR and mDNS spoofers seem to work on Windows 10 and Server 2016 with those services already enabled. Firewalls can still get in the way of everything.

Other Features

HTTP capture – TCP listener based
Proxy auth capture – TCP listener based

Notable Missing Features

ADIDNS attacks
HTTP to SMB Relay
HTTPS listener
Kerberos kirbi output

Notable Differences

Capture and log data can be imported from previous output files. The PowerShell version stores data in a global variable that persists within the PowerShell instance.
InveighZero does not execute in the background. Instead, a console is accessible while InveighZero is running. The console has commands that have similar functionality to Inveigh’s Get-Inveigh, Watch-Inveigh, and Stop-Inveigh support functions.