forked from mubix/FakeNetBIOS
-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathREADME_FakeNetbiosNS.txt
103 lines (71 loc) · 3.21 KB
/
README_FakeNetbiosNS.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
--------------------------------------------------------------------------
| |
| FakeNetbiosNS V. 0.91 |
| |
| Simulation of NetBIOS hosts (Windows-like) on NetBIOS Name Service (NS) |
| |
--------------------------------------------------------------------------
Copyright © Patrick Chambet 2004-2005
DISCLAMER
=========
This is provided as a simulation tool only for educational purposes
and testing by authorized individuals with permission to do so.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
INTRO
=====
FakeNetbiosNS is a NetBIOS Name Service daemon, listening on port UDP 137.
It can be used as a standalone tool or as a honeyd responder.
It responds to NetBIOS Name requests like real Windows computers:
for example 'ping -a', 'nbtstat -A' and 'nbtstat -a', etc.
- Note: when you use FakeNetbiosNS in daemon mode on Windows, you have to
disable NBT on the network adapter you listen on.
To do that:
- Open Network and Dial-up Connections
- Open your network adpater properties
- Select "Internet Protocol (TCP/IP)"
- Click on "Properties", then on "Advanced"
- Goto the "WINS" tab
- Select the "Disable NetBIOS over TCP/IP" radio button
- Click "OK" 3 times
- You do not need to reboot usually. You should now be able to bind to port UDP 137.
COMPILE
=======
The source code compiles on Win32 AND on Linux.
Yes, it is on purpose. No, it isn't always easy.
USAGE
=====
Usage: FakeNetbiosNS [options]
IP options:
-s [source IP] Source IP address (on which we also listen)
-Note 1: your system must support raw IP
-Note 2: Windows XP SP2 & Windows 2003 with Windows
Firewall enabled silently drop packets with
spoofed source address...
-d [destination IP] Broadcast IP address
NetBIOS options:
-D [Domain/Workgroup] Target Domain/Workgroup (default: WORKGROUP)
-N [names prefix] Host names prefix (default: HOST)
-f [file path] Use a configuration file (default: none)
-r [NB svc hex code] Send Release packet and quit
Misc. options:
-H Activate Honeyd mode
-v Verbose mode (do not use with Honeyd mode)
-h This text
EXAMPLES
========
FakeNetbiosNS -s 192.168.0.1 -d 192.168.0.255 -D NTDOM -N ALLYOURBASE -v
FakeNetbiosNS -d 192.168.0.255 -f FakeNetbiosNS.ini -H
TO DO
=====
- Add more BROWSE and NETLOGON commands
- Add more Server types
WHO
===
Patrick Chambet <patrick@chambet.com>
Greetings to:
- Barzoc <barzoc@rstack.org>
- Francis Hauguet <francis.hauguet@eads.com>
- The French Honeynet Project (FHP) <http://www.frenchhoneynet.org>
- Rstack team <http://www.rstack.org>