InveighZero: C# LLMNR/NBNS/mDNS/DNS spoofer and man-in-the-middle tool
InveighZero
InveighZero is a C# LLMNR/NBNS/mDNS/DNS spoofer and man-in-the-middle tool designed to assist penetration testers/red teamers that find themselves limited to a Windows system. This version shares many features with the PowerShell version of Inveigh.
Privileged Mode Features (elevated admin required)
- SMB capture – packet sniffer based
- LLMNR spoofer – packet sniffer based
- NBNS spoofer – packet sniffer based
- mDNS spoofer – packet sniffer based
- DNS spoofer – packet sniffer based
- Pcap output – TCP and UDP packets
- Packet sniffer console output – SYN packets, SMB Kerberos negotiation, etc
Unprivileged Mode Features
- LLMNR spoofer – UDP listener based
- NBNS spoofer – UDP listener based
- mDNS spoofer – UDP listener based
- DNS spoofer – UDP listener based
- Note: The NBNS spoofer should work on all systems even with NBNS enabled. The LLMNR and mDNS spoofers seem to work on Windows 10 and Server 2016 with those services already enabled. Firewalls can still get in the way of everything.
Other Features
- HTTP capture – TCP listener based
- Proxy auth capture – TCP listener based
Notable Missing Features
- ADIDNS attacks
- HTTP to SMB Relay
- HTTPS listener
- Kerberos kirbi output
Notable Differences
- Capture and log data can be imported from previous output files. The PowerShell version stores data in a global variable that persists within the PowerShell instance.
- InveighZero does not execute in the background. Instead, a console is accessible while InveighZero is running. The console has commands that have similar functionality to Inveigh’s Get-Inveigh, Watch-Inveigh, and Stop-Inveigh support functions.
Download && Use
Copyright (c) 2018, Kevin Robertson
