bug fixes

high CPU usage with sniffer ICMPv6 socket graceful exit NTLMv2 parsing issue
Kevin-Robertson · Aug 28, 2022 · 0294aa1 · 0294aa1
1 parent 0fecc18
commit 0294aa1
Show file tree

Hide file tree

Showing 9 changed files with 79 additions and 17 deletions.
diff --git a/Inveigh/Listeners/SMBListener.cs b/Inveigh/Listeners/SMBListener.cs
@@ -54,7 +54,7 @@ protected override void OutputNegotiation(string protocol, string listenerPort,
         protected override void OutputError(Exception ex, int port)
         {
 
-            if (ex.Message.ToString().Equals("An attempt was made to access a socket in a way forbidden by its access permissions."))
+            if (ex.Message.ToString().Contains("An attempt was made to access a socket in a way forbidden by its access permissions"))
             {
                 Output.Queue(String.Format("[!] Failed to start SMB listener on port {0}, check IP and port usage.", port));
             }

diff --git a/Inveigh/Program.cs b/Inveigh/Program.cs
@@ -174,7 +174,7 @@ class Program
         public static string netbiosDomain = Environment.UserDomainName;
         public static string dnsDomain = "";    
         public static ulong smb2Session = 5548434740922023936; // todo check
-        public static string version = "2.0.5";
+        public static string version = "2.0.6";
 
         static void Main(string[] arguments)
         {

diff --git a/Inveigh/Protocols/Quiddity/Quiddity/Listeners/LLMNRListener.cs b/Inveigh/Protocols/Quiddity/Quiddity/Listeners/LLMNRListener.cs
@@ -31,6 +31,7 @@
  */
 using Quiddity.LLMNR;
 using System;
+using System.Diagnostics;
 using System.Net;
 using System.Net.Sockets;
 using System.Threading;
@@ -46,11 +47,22 @@ public LLMNRListener()
         }
 
         public new void Start(IPAddress ipAddress, string replyIP, string replyIPv6)
+        {
+            Start(ipAddress, replyIP, replyIPv6, 0);
+        }
+
+        public void Start(IPAddress ipAddress, string replyIP, string replyIPv6, int runTime)
         {
             UDPListener listener = new UDPListener(AddressFamily.InterNetwork);
             IPEndPoint ipEndPoint = new IPEndPoint(ipAddress, 5355);
             isRunning = true;
             IAsyncResult udpAsync;
+            Stopwatch stopwatchRunTime = new Stopwatch();
+
+            if (runTime > 0)
+            {
+                stopwatchRunTime.Start();
+            }
 
             if (String.Equals(ipAddress.AddressFamily.ToString(), "InterNetwork"))
             {
@@ -75,8 +87,9 @@ public LLMNRListener()
                     {
                         Thread.Sleep(10);
 
-                        if (!isRunning)
+                        if (!isRunning || stopwatchRunTime.IsRunning && stopwatchRunTime.Elapsed.Minutes >= runTime)
                         {
+                            isRunning = false;
                             break;
                         }
 

diff --git a/Inveigh/Protocols/Quiddity/Quiddity/Listeners/MDNSListener.cs b/Inveigh/Protocols/Quiddity/Quiddity/Listeners/MDNSListener.cs
@@ -31,6 +31,7 @@
  */
 using Quiddity.MDNS;
 using System;
+using System.Diagnostics;
 using System.Net;
 using System.Net.Sockets;
 using System.Threading;
@@ -53,11 +54,17 @@ public MDNSListener(uint ttl, bool unicastOnly)
         }
 
         public new void Start(IPAddress ipAddress, string replyIP, string replyIPv6)
+        {
+            Start(ipAddress, replyIP, replyIPv6, 0);
+        }
+
+        public void Start(IPAddress ipAddress, string replyIP, string replyIPv6, int runTime)
         {
             UDPListener listener = new UDPListener(AddressFamily.InterNetwork);
             IPEndPoint ipEndPoint = new IPEndPoint(ipAddress, 5353);
             isRunning = true;
             IAsyncResult udpAsync;
+            Stopwatch stopwatchRunTime = new Stopwatch();
 
             if (string.Equals(ipAddress.AddressFamily.ToString(), "InterNetwork"))
             {
@@ -82,8 +89,9 @@ public MDNSListener(uint ttl, bool unicastOnly)
                     {
                         Thread.Sleep(10);
 
-                        if (!isRunning)
+                        if (!isRunning || stopwatchRunTime.IsRunning && stopwatchRunTime.Elapsed.Minutes >= runTime)
                         {
+                            isRunning = false;
                             break;
                         }
 

diff --git a/Inveigh/Protocols/Quiddity/Quiddity/Listeners/NetBIOSNSListener.cs b/Inveigh/Protocols/Quiddity/Quiddity/Listeners/NetBIOSNSListener.cs
@@ -31,6 +31,7 @@
  */
 using Quiddity.NetBIOS;
 using System;
+using System.Diagnostics;
 using System.Net;
 using System.Net.Sockets;
 using System.Threading;
@@ -49,12 +50,24 @@ public NetBIOSNSListener(uint ttl)
             this.TTL = ttl;
         }
 
-        public void Start(IPAddress ipAddress, string replyIP)
+        public new void Start(IPAddress ipAddress, string replyIP)
+        {
+            Start(ipAddress, replyIP, 0);
+        }
+
+        public void Start(IPAddress ipAddress, string replyIP, int runTime)
         {
             UDPListener listener = new UDPListener(AddressFamily.InterNetwork);
             IPEndPoint ipEndPoint = new IPEndPoint(ipAddress, 137);
             isRunning = true;
             IAsyncResult udpAsync;
+            Stopwatch stopwatchRunTime = new Stopwatch();
+
+            if (runTime > 0)
+            {
+                stopwatchRunTime.Start();
+            }
+
             listener.Client.Bind(ipEndPoint);
 
             while (isRunning)
@@ -68,7 +81,7 @@ public void Start(IPAddress ipAddress, string replyIP)
                     {
                         Thread.Sleep(10);
 
-                        if (!isRunning)
+                        if (!isRunning || stopwatchRunTime.IsRunning && stopwatchRunTime.Elapsed.Minutes >= runTime)
                         {
                             break;
                         }

diff --git a/Inveigh/Protocols/Quiddity/Quiddity/Protocols/MDNS/MDNSChecker.cs b/Inveigh/Protocols/Quiddity/Quiddity/Protocols/MDNS/MDNSChecker.cs
@@ -71,7 +71,7 @@ public virtual bool Check(string name, string question, string type, string clie
 
         public bool QuestionIsAllowed(string question)
         {
-
+ 
             if (!Utilities.ArrayIsNullOrEmpty(this.Questions) && !Array.Exists(this.Questions, element => element == question.ToUpper()))
             {
                 return false;

diff --git a/Inveigh/Protocols/Quiddity/Quiddity/Protocols/NTLM/NTLMResponse.cs b/Inveigh/Protocols/Quiddity/Quiddity/Protocols/NTLM/NTLMResponse.cs
@@ -164,19 +164,21 @@ public void ReadBytes(byte[] data)
                 this.EncryptedRandomSessionKeyBufferOffset = packetReader.ReadUInt32();
                 this.NegotiateFlags = packetReader.ReadBytes(4);
 
+
                 string flags = Convert.ToString(BitConverter.ToUInt32(this.NegotiateFlags, 0), 2).PadLeft(this.NegotiateFlags.Length * 8, '0');
 
                 if (String.Equals(flags.Substring(6, 1), "1"))
                 {
                     this.Version = packetReader.ReadBytes(8);
                 }
 
-                if (String.Equals(flags.Substring(1, 1), "1"))
+                if (String.Equals(flags.Substring(16, 1), "1"))
                 {
                     this.MIC = packetReader.ReadBytes(16);
                 }
 
                 this.Payload = packetReader.ReadBytes(data.Length - (int)this.DomainNameBufferOffset);
+
             }
 
         }

diff --git a/Inveigh/Sniffer/Sniffer.cs b/Inveigh/Sniffer/Sniffer.cs
@@ -33,6 +33,7 @@ public static void Start(string protocol, string snifferIP, bool isIPV6)
             IPEndPoint snifferIPEndPoint;
             EndPoint snifferEndPoint;
             AddressFamily addressFamily = AddressFamily.InterNetwork;
+            IAsyncResult ipAsync;
 
             if (isIPV6)
             {
@@ -70,9 +71,7 @@ public static void Start(string protocol, string snifferIP, bool isIPV6)
                 snifferIPEndPoint = new IPEndPoint(IPAddress.Parse(snifferIP), 0);
                 snifferSocket.ReceiveBufferSize = 4096;
                 snifferSocket.Bind(snifferIPEndPoint);
-                snifferSocket.Blocking = false;
                 snifferSocket.IOControl(IOControlCode.ReceiveAll, snifferIn, snifferOut);
-
             }
             catch (Exception ex)
             {
@@ -91,7 +90,7 @@ public static void Start(string protocol, string snifferIP, bool isIPV6)
                 throw;
             }         
 
-            int packetLength;
+            int packetLength = 0;
             isRunning = true;
 
             while (isRunning)
@@ -103,10 +102,28 @@ public static void Start(string protocol, string snifferIP, bool isIPV6)
                     SocketFlags socketFlags = SocketFlags.None;
 
                     try
-                    {                     
-                        packetLength = snifferSocket.ReceiveMessageFrom(snifferBuffer, 0, snifferBuffer.Length, ref socketFlags, ref snifferEndPoint, out packetInformation);
-                        snifferData = new byte[packetLength];
-                        Buffer.BlockCopy(snifferBuffer, 0, snifferData, 0, packetLength);
+                    {
+                        ipAsync = snifferSocket.BeginReceiveMessageFrom(snifferBuffer, 0, snifferBuffer.Length, socketFlags, ref snifferEndPoint, null, null);
+
+                        do
+                        {
+                            Thread.Sleep(10);
+
+                            if (!isRunning)
+                            {
+                                break;
+                            }
+
+                        }
+                        while (!ipAsync.IsCompleted);
+
+                        if (isRunning)
+                        {
+                            packetLength = snifferSocket.EndReceiveMessageFrom(ipAsync, ref socketFlags, ref snifferEndPoint, out packetInformation);
+                            snifferData = new byte[packetLength];
+                            Buffer.BlockCopy(snifferBuffer, 0, snifferData, 0, packetLength);
+                        }
+
                     }
                     catch
                     {

diff --git a/Inveigh/Sockets/ICMPv6Socket.cs b/Inveigh/Sockets/ICMPv6Socket.cs
@@ -1,6 +1,7 @@
 using Quiddity.ICMPv6;
 using Quiddity.Support;
 using System;
+using System.Diagnostics;
 using System.Linq;
 using System.Net;
 using System.Net.Sockets;
@@ -12,9 +13,10 @@ class ICMPv6Socket
     {
         internal void Start()
         {
-            Program.icmpv6Interval *= 1000;
             string responseMessage = " ";
             byte[] spooferIPv6Data = IPAddress.Parse(Program.argSpooferIPv6).GetAddressBytes();
+            Stopwatch stopwatchInterval = new Stopwatch();
+            stopwatchInterval.Start();
 
             while (Program.isRunning && Program.enabledICMPv6)
             {
@@ -91,7 +93,14 @@ internal void Start()
 
                 if (Program.icmpv6Interval > 0)
                 {
-                    Thread.Sleep(Program.icmpv6Interval);
+
+                    while (Program.isRunning && stopwatchInterval.Elapsed.Seconds <= Program.icmpv6Interval)
+                    {
+                        Thread.Sleep(10);
+                    }
+
+                    stopwatchInterval.Reset();
+                    stopwatchInterval.Start();
                 }
                 else
                 {