Skip to content

Commit 24c8bca

Browse files
emtulsemtuls
authored
Merge pull request #1121 from mandiant/internet-detector
Add internet detector utility
2 parents 986ab9e + bcd96b0 commit 24c8bca

10 files changed

+835
-1
lines changed

Diff for: ‎packages/fakenet-ng.vm/fakenet-ng.vm.nuspec

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
33
<metadata>
44
<id>fakenet-ng.vm</id>
5-
<version>3.2.0.20240425</version>
5+
<version>3.2.0.20240902</version>
66
<description>FakeNet-NG is a dynamic network analysis tool.</description>
77
<authors>Mandiant</authors>
88
<dependencies>

Diff for: ‎packages/fakenet-ng.vm/tools/chocolateyinstall.ps1

+6
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ try {
1111
$zipSha256 = "5941a0401830c2310226f0cd2d640e091f1c8bf1b93c5288e6626eecebf20bff"
1212

1313
$toolDir = Join-Path ${Env:RAW_TOOLS_DIR} $toolName
14+
$packageToolDir = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
1415

1516
# Remove files from previous zips for upgrade
1617
VM-Remove-PreviousZipPackage ${Env:chocolateyPackageFolder}
@@ -34,6 +35,11 @@ try {
3435
VM-Install-Shortcut -toolName $toolName -category $category -executablePath $executablePath -executableDir $toolDir -consoleApp $true
3536
Install-BinFile -Name $toolName -Path $executablePath
3637

38+
# Replace `default.ini` with our modified one that includes change for 'internet_detector'.
39+
# IMPORTANT: Keep our modified `default.ini` in-sync on updates to package.
40+
$fakenetConfigDir = Get-ChildItem "C:\Tools\fakenet\*\configs"
41+
Copy-Item "$packageToolDir\default.ini" -Destination $fakenetConfigDir
42+
3743
# Create shortcut in Desktop to FakeNet tool directory
3844
$desktopShortcut = Join-Path ${Env:UserProfile} "Desktop\fakenet_logs.lnk"
3945
Install-ChocolateyShortcut -shortcutFilePath $desktopShortcut -targetPath $toolDir

Diff for: ‎packages/fakenet-ng.vm/tools/default.ini

+349
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,349 @@
1+
###############################################################################
2+
# Fakenet Configuration
3+
4+
[FakeNet]
5+
6+
# Specify whether or not FakeNet should divert traffic. Disable if you want to
7+
# just start listeners and direct traffic manually (e.g. modify DNS server)
8+
DivertTraffic: Yes
9+
10+
###############################################################################
11+
# Diverter Configuration
12+
13+
[Diverter]
14+
15+
# Specify what mode of operation to use. Options:
16+
# SingleHost - manipulate local traffic
17+
# MultiHost - manipulate traffic from foreign hosts
18+
# Auto - Use SingleMode on Windows or use MultiHost on Linux
19+
#
20+
# The current support for these modes on each supported platform is as follows:
21+
# | Windows | Linux |
22+
# -----------+------------+--------------+
23+
# SingleHost | Functional | Experimental |
24+
# MultiHost | - | Functional |
25+
# NetworkMode: SingleHost
26+
# NetworkMode: MultiHost
27+
NetworkMode: Auto
28+
29+
# DebugLevel: specify fine-grained debug print flags to enable. Enabling all
30+
# logging when verbose mode is selected results in overwhelming output, hence
31+
# this setting. Valid values (comma-separated) are:
32+
#
33+
# GENPKT Generic packet information
34+
# GENPKTV Packet analysis, displays IP, TCP, UDP fields, very wide output
35+
# CB Diverter packet handler callback start/finish logging
36+
# NONLOC Nonlocal packet verbose logging
37+
# DPF Dynamic port forwarding decisions
38+
# DPFV Dynamic port forwarding table activity
39+
# IPNAT NAT decisions
40+
# MANGLE Packet mangling (modification) activity
41+
# PCAP PCAP writes of original and mangled packets
42+
# IGN Cases where packets are forwarded as is
43+
# FTP FTP-specific logic
44+
# IGN-FTP Cases where packets are forwarded as is due to FTP Active Mode
45+
# MISC Miscellaneous
46+
# NFQUEUE NetfilterQueue activity (Linux only)
47+
# PROCFS Procfs read/write activity (Linux only)
48+
# IPTABLES iptables firewall rule activity (Linux only)
49+
DebugLevel: Off
50+
51+
# Restrict which interface on which Fakenet-NG will intercept and handle
52+
# packets. Specify (only) one interface and Fakenet-NG will ignore all other
53+
# interfaces. This feature only applies to interfaces on different subnets.
54+
# Specify interface by name only (ex: eth0). To disable, set to "Off". In
55+
# order to run multiple instance of Fakenet-NG on different interfaces within
56+
# the same guest, LinuxFlushIptables must be turned off to avoid the latest
57+
# instance flushing the rules associated with other instances or restoring
58+
# rules to an incorrect state upon exit.
59+
LinuxRestrictInterface: Off
60+
61+
# Set LinuxFlushIptables to Yes to have the Linux Diverter flush all iptables
62+
# rules before adding its FakeNet-NG-specific rules to iptables. This setting
63+
# also restores rules via `iptables-restore` when it exits, unless its
64+
# termination is interrupted.
65+
LinuxFlushIptables: Yes
66+
67+
# Incorporated so that users of the binary release may make this work for
68+
# various Linux distros. On Ubuntu, this is `service dns-clean restart`. For
69+
# other distributions, it may be `nscd -I hosts`. Check your manual for
70+
# details.
71+
LinuxFlushDNSCommand: service dns-clean restart
72+
73+
# Specify whether or not to save captured traffic. You can also change
74+
# the file prefix for the generated PCAPs.
75+
DumpPackets: Yes
76+
DumpPacketsFilePrefix: packets
77+
78+
# DHCP server running under VMWare Host-Only networking does not configure
79+
# interface gateway and DNS server. Gateway must be configured to allow
80+
# Windows to attempt to route external traffic so that FakeNet could
81+
# could intercept it. This option will automatically generate and set
82+
# appropriate gateway and DNS addresses to allow normal operation.
83+
FixGateway: Yes
84+
FixDNS: Yes
85+
86+
# Enable 'ModifyLocalDNS' to statically set DNS server to the local machine.
87+
# Linux: Modifies (and restores) /etc/resolv.conf on Linux to make this an
88+
# ephemeral change.
89+
ModifyLocalDNS: Yes
90+
91+
# Enable 'StopDNSService' to stop Windows DNS client to see the actual
92+
# processes resolving domains. This is a no-op on Linux, until such time as DNS
93+
# caching is observed to interfere with finding the pid associated with a DNS
94+
# request.
95+
StopDNSService: Yes
96+
97+
# Enable 'RedirectAllTraffic' to optionally divert traffic going to ports not
98+
# specifically listed in one of the listeners below. 'DefaultTCPListener' and
99+
# 'DefaultUDPListener' will handle TCP and UDP traffic going to unspecified ports.
100+
#
101+
# NOTE: Setting default UDP listener will intercept all DNS traffic unless you
102+
# enable a dedicated UDP port 53 DNS listener or add UDP port 53 to the
103+
# 'BlackListPortsUDP' below so that system's default DNS server is used instead.
104+
105+
RedirectAllTraffic: Yes
106+
DefaultTCPListener: ProxyTCPListener
107+
DefaultUDPListener: ProxyUDPListener
108+
109+
# Specify TCP and UDP ports to ignore when diverting packets.
110+
# For example, you may want to avoid diverting UDP port 53 (DNS) traffic
111+
# when trying to intercept a specific process while allowing the rest to
112+
# function normally
113+
#
114+
# NOTE: This setting is only honored when 'RedirectAllTraffic' is enabled.
115+
116+
BlackListPortsTCP: 139
117+
BlackListPortsUDP: 67, 68, 137, 138, 443, 1900, 5355, 53
118+
119+
# Specify processes to ignore when diverting traffic. Windows example used
120+
# here.
121+
ProcessBlackList: internet_detector.exe
122+
123+
# Specify processes to consider when diverting traffic (others will be
124+
# ignored). Linux examples used here.
125+
# ProcessWhiteList: wget, nc
126+
127+
# Specify hosts to ignore when diverting traffic.
128+
# HostBlackList: 6.6.6.6
129+
130+
###############################################################################
131+
# Listener Configuration
132+
#
133+
# Listener configuration consists of generic settings used by the diverter which
134+
# are the same for all listeners and listener specific settings.
135+
#
136+
# NOTE: Listener section names will be used for logging.
137+
#
138+
# NOTE: Settings labels are not case-sensitive.
139+
#
140+
# The following settings are available for all listeners:
141+
# * Enabled - specify whether or not the listener is enabled.
142+
# * Port - TCP or UDP port to listen on.
143+
# * Protocol - TCP or UDP
144+
# * Listener - Listener name to handle traffic.
145+
# * ProcessWhiteList - Only traffic from these processes will be modified
146+
# and the rest will simply be forwarded.
147+
# * ProcessBlackList - Traffic from all but these processes will be simply forwarded
148+
# and the rest will be modified as needed.
149+
# * HostWhiteList - Only traffic to these hosts will be modified and
150+
# the rest will be simply forwarded.
151+
# * HostBlackList - Traffic to these hosts will be simply forwarded
152+
# and the rest will be modified as needed.
153+
# * ExecuteCmd - Execute command on the first connection packet. This is feature is useful
154+
# for extending FakeNet-NG's functionality (e.g. launch a debugger on the
155+
# connecting pid to help with unpacking and decoding.)
156+
#
157+
# The following format string variables are made available:
158+
# * {pid} - process id
159+
# * {procname} - process executable name
160+
# * {src_addr} - source address
161+
# * {src_port} - source port
162+
# * {dst_addr} - destination address
163+
# * {dst_port} - destination port
164+
#
165+
# Listener entry which does not specify a specific listener service
166+
# will still redirect all packets to the local machine on the specified port and
167+
# subject to all the filters (processes, hosts, etc.). However, you must set-up a
168+
# third party service (e.g. proxy servers) to accept these connections. This feature can be
169+
# used to provide FakeNet-NG's passive traffic diverting and filtering capabilities to other
170+
# applications.
171+
#
172+
# Listener specific settings:
173+
#
174+
# * Timeout - Set connection timeout for any listeners that support
175+
# TCP connections (e.g. RawListener, DNSListener, HTTPListener
176+
# SMTPListener).
177+
# * UseSSL - Enable SSL support on the listener (RawListener, HTTPListener)
178+
# * Webroot - Set webroot path for HTTPListener.
179+
# * DumpHTTPPosts - Store HTTP Post requests for the HTTPListener.
180+
# * DumpHTTPPostsFilePrefix - File prefix for the stored HTTP Post requests used by the HTTPListener.
181+
# * TFTPFilePrefix - File prefix for the stored tftp uploads used by the TFTPListener.
182+
# * DNSResponse - IP address to respond with for A record DNS queries. (DNSListener)
183+
# * NXDomains - A number of DNS requests to ignore to let the malware cycle through
184+
# all of the backup C2 servers. (DNSListener)
185+
# * Banner - FTPListener, IRCListener: FTP or IRC banner to display.
186+
# Valid settings are any banner string, or !<key> where
187+
# <key> is a valid key in the BANNERS dictionary within
188+
# FTPListener.py or IRCListener.py, or !random to
189+
# randomize among the banners in the BANNERS dictionary.
190+
# The default value if none is specified is !generic,
191+
# which selects the banner in the BANNERS dictionary going
192+
# by that key. Banner string may specify the following
193+
# escapes/insertions:
194+
# {servername} - ServerName setting value
195+
# {tz} - Time zone, currently hard-coded to 'UTC'
196+
# * ServerName - FTPListener, IRCListener: FTP or IRC server name for
197+
# insertion into selected default banners or into a
198+
# user-specified banner string. Valid settings are any
199+
# hostname string, !hostname to insert the actual hostname
200+
# of the system, or !random to generate a random hostname
201+
# between 1 and 15 characters (inclusive).
202+
203+
[ProxyTCPListener]
204+
Enabled: True
205+
Protocol: TCP
206+
Listener: ProxyListener
207+
Port: 38926
208+
Listeners: HTTPListener, RawListener, FTPListener, DNSListener, POPListener, SMTPListener, TFTPListener, IRCListener
209+
Hidden: False
210+
211+
[ProxyUDPListener]
212+
Enabled: True
213+
Protocol: UDP
214+
Listener: ProxyListener
215+
Port: 38926
216+
Listeners: RawListener, DNSListener, TFTPListener, FTPListener
217+
Hidden: False
218+
219+
[Forwarder]
220+
Enabled: False
221+
Port: 8080
222+
Protocol: TCP
223+
ProcessWhiteList: chrome.exe
224+
Hidden: False
225+
226+
[RawTCPListener]
227+
Enabled: True
228+
Port: 1337
229+
Protocol: TCP
230+
Listener: RawListener
231+
UseSSL: No
232+
Timeout: 10
233+
Hidden: False
234+
# To read about customizing responses, see docs/CustomResponse.md
235+
# Custom: sample_custom_response.ini
236+
237+
[RawUDPListener]
238+
Enabled: True
239+
Port: 1337
240+
Protocol: UDP
241+
Listener: RawListener
242+
UseSSL: No
243+
Timeout: 10
244+
Hidden: False
245+
# To read about customizing responses, see docs/CustomResponse.md
246+
# Custom: sample_custom_response.ini
247+
248+
[FilteredListener]
249+
Enabled: False
250+
Port: 31337
251+
Protocol: TCP
252+
Listener: RawListener
253+
UseSSL: No
254+
Timeout: 10
255+
ProcessWhiteList: ncat.exe, nc.exe
256+
HostBlackList: 5.5.5.5
257+
Hidden: False
258+
259+
[DNS Server]
260+
Enabled: True
261+
Port: 53
262+
Protocol: UDP
263+
Listener: DNSListener
264+
ResponseA: 192.0.2.123
265+
ResponseMX: mail.evil2.com
266+
ResponseTXT: FAKENET
267+
NXDomains: 0
268+
Hidden: False
269+
270+
[HTTPListener80]
271+
Enabled: True
272+
Port: 80
273+
Protocol: TCP
274+
Listener: HTTPListener
275+
UseSSL: No
276+
Webroot: defaultFiles/
277+
Timeout: 10
278+
DumpHTTPPosts: Yes
279+
DumpHTTPPostsFilePrefix: http
280+
Hidden: False
281+
# To read about customizing responses, see docs/CustomResponse.md
282+
# Custom: sample_custom_response.ini
283+
284+
[HTTPListener443]
285+
Enabled: True
286+
Port: 443
287+
Protocol: TCP
288+
Listener: HTTPListener
289+
UseSSL: Yes
290+
Webroot: defaultFiles/
291+
Timeout: 10
292+
DumpHTTPPosts: Yes
293+
DumpHTTPPostsFilePrefix: http
294+
Hidden: False
295+
296+
[SMTPListener]
297+
Enabled: True
298+
Port: 25
299+
Protocol: TCP
300+
Listener: SMTPListener
301+
UseSSL: No
302+
Hidden: False
303+
304+
[FTPListener21]
305+
Enabled: True
306+
Port: 21
307+
Protocol: TCP
308+
Listener: FTPListener
309+
UseSSL: No
310+
FTProot: defaultFiles/
311+
PasvPorts: 60000-60010
312+
Hidden: False
313+
Banner: !generic
314+
ServerName: !gethostname
315+
316+
[FTPListenerPASV]
317+
Enabled: True
318+
Port: 60000-60010
319+
Protocol: TCP
320+
Hidden: False
321+
322+
[IRCServer]
323+
Enabled: True
324+
Port: 6667
325+
Protocol: TCP
326+
Listener: IRCListener
327+
UseSSL: No
328+
Banner: !generic
329+
ServerName: !gethostname
330+
Timeout: 30
331+
Hidden: False
332+
333+
[TFTPListener]
334+
Enabled: True
335+
Port: 69
336+
Protocol: UDP
337+
Listener: TFTPListener
338+
TFTPRoot: defaultFiles/
339+
Hidden: False
340+
TFTPFilePrefix: tftp
341+
342+
[POPServer]
343+
Enabled: True
344+
Port: 110
345+
Protocol: TCP
346+
Listener: POPListener
347+
UseSSL: No
348+
Hidden: False
349+

Diff for: ‎packages/internet_detector.vm/internet_detector.vm.nuspec

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
3+
<metadata>
4+
<id>internet_detector.vm</id>
5+
<version>1.0.0</version>
6+
<authors>Elliot Chernofsky and Ana Martinez Gomez</authors>
7+
<description>Tool that changes the background and a taskbar icon if it detects internet connectivity</description>
8+
<dependencies>
9+
<dependency id="common.vm" version="0.0.0.20240821" />
10+
<dependency id="libraries.python3.vm" version="0.0.0.20240726" />
11+
<dependency id="fakenet-ng.vm" version="3.2.0.20240902" />
12+
</dependencies>
13+
</metadata>
14+
</package>

0 commit comments

Comments
 (0)