n0mad1k
ccc6b729de
Full BigBrother network implant - passive SOC + active exploitation. Personal identifiers removed; all capabilities intact. See README.md for setup and docs/deployment.md for detailed deployment.
71 lines
2.0 KiB
Django/Jinja
71 lines
2.0 KiB
Django/Jinja
{# BigBrother Responder.conf template
|
|
Jinja2 variables:
|
|
protocols: dict of protocol toggles (LLMNR, NBT-NS, mDNS, HTTP, SMB, etc.)
|
|
relay_targets: set of IPs excluded from SMB auth (for ntlm_relay)
|
|
interface: network interface
|
|
#}
|
|
[Responder Core]
|
|
|
|
; Servers to start
|
|
SQL = {{ 'On' if protocols.get('SQL', false) else 'Off' }}
|
|
SMB = {{ 'On' if protocols.get('SMB', true) else 'Off' }}
|
|
RDP = Off
|
|
Kerberos = Off
|
|
FTP = {{ 'On' if protocols.get('FTP', false) else 'Off' }}
|
|
POP = {{ 'On' if protocols.get('POP', false) else 'Off' }}
|
|
SMTP = {{ 'On' if protocols.get('SMTP', false) else 'Off' }}
|
|
IMAP = {{ 'On' if protocols.get('IMAP', false) else 'Off' }}
|
|
HTTP = {{ 'On' if protocols.get('HTTP', true) else 'Off' }}
|
|
HTTPS = {{ 'On' if protocols.get('HTTP', true) else 'Off' }}
|
|
DNS = Off
|
|
LDAP = {{ 'On' if protocols.get('LDAP', false) else 'Off' }}
|
|
DCERPC = Off
|
|
WinRM = Off
|
|
SNMP = Off
|
|
MQTT = Off
|
|
|
|
; Custom challenge — Random is stealthier than fixed
|
|
Challenge = Random
|
|
|
|
; Set specific interface
|
|
; Interface = {{ interface }}
|
|
|
|
; WPAD configuration
|
|
WPADScript = function FindProxyForURL(url, host){return "DIRECT";}
|
|
{% if protocols.get('WPAD', true) %}
|
|
; WPAD rogue proxy enabled
|
|
Serve-Html = On
|
|
Serve-Exe = Off
|
|
{% endif %}
|
|
|
|
; Force WPAD auth for hash capture
|
|
Force-WPAD-Auth = {{ 'On' if protocols.get('WPAD', true) else 'Off' }}
|
|
|
|
; Downgrade to NTLMv1 (more crackable but more detectable)
|
|
; Set to On only when specifically targeting NTLMv1
|
|
Downgrade-To-NTLMv1 = Off
|
|
|
|
; Don't respond to these machines (comma-separated hostnames)
|
|
DontRespondToNames =
|
|
|
|
{% if relay_targets %}
|
|
; Hosts excluded from SMB auth — being relayed by ntlmrelayx
|
|
; These IPs should get auth forwarded to ntlmrelayx, not captured locally
|
|
DontRespondTo = {{ relay_targets | join(', ') }}
|
|
{% else %}
|
|
DontRespondTo =
|
|
{% endif %}
|
|
|
|
[HTTP Server]
|
|
; Custom HTML to serve for WPAD/HTTP auth
|
|
HTMLToInject =
|
|
; Serve a custom EXE
|
|
Serve-Always = Off
|
|
Filename =
|
|
ExecParams =
|
|
|
|
[HTTPS Server]
|
|
; Self-signed cert params
|
|
SSLCert = certs/responder.crt
|
|
SSLKey = certs/responder.key
|