1

I have a (test) setup where I want to respond to NBNS broadcasts. The clients sending out the broadcasts are on a different network. I can sniff the traffic using a pivot host on this network. So far I have not found a way to respond to the requests using Responder or Metasploit.

Is there any way to listen/respond to NBNS requests on a different subnet/network? If yes, how can I set this up?

0

since both responder.py and metasploit listen on your host machine for the broadcast nbns packets you need to fool them into thinking they are part of your own network. (assuming the responses are created as udp sockets, otherwise you will need to change that code too)

the way i would trick them is by using tcpdump with a nc on the remote machine and stream it directly into the interface using tcpreply.

you need to forward a port from the remote host back to you, this should be pretty easy using the metasploit port forward, you need to bind a local port to the localhost on the remote machine. inside metasploit:

portfwd -l 1234 -p 1234 -r 127.0.0.1

afterwards you need to use ncat and tcpdump on the remote machine so that nbns traffic will be forwarded back to you (notice that the filter should remove the packets you will be injecting, otherwise you will have a loop):

tcpdump -i [interface number] -vv -s 0 port 137 and ether host ff:ff:ff:ff:ff:ff|ncat -l 127.0.0.1 1234

and then you need to inject it into your own interface, nc is used to stream from the ncat on the windows host and tcpreply is used to inject the packets: nc 127.0.0.1 1234|tcpreply -i lo -

and run your metasploit/responder.py on the lo interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.