# Pretender | Your MitM Sidekick For Relaying Attacks **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, hacking, freebies\ **Created:** [July 27, 2022, 9:10pm UTC](https://onehack.st/t/pretender-your-mitm-sidekick-for-relaying-attacks/221666 "2022-07-27T21:10:45Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\ **Post date:** [July 27, 2022, 9:10pm UTC](https://onehack.st/t/pretender-your-mitm-sidekick-for-relaying-attacks/221666/1 "2022-07-27T21:10:45Z")
![image](https://onehack.st/uploads/default/original/3X/a/7/a703a9e82b5b094344a91a90ab97e628537a2ef3.jpeg) _Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing_ [![Release](https://camo.githubusercontent.com/da942c927faaa9a4de78e170ad1aca6ad8e1333d09d886d2fa1b4da833f89ae3/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f5265645465616d50656e74657374696e672f70726574656e6465722e7376673f7374796c653d666f722d7468652d6261646765)](https://github.com/RedTeamPentesting/pretender/releases/latest) [![GitHub Action: Check](https://camo.githubusercontent.com/654449f419d135dd1f21ea560d4e1bc3c55271af13d7ce03d4ffce1f577b5451/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f776f726b666c6f772f7374617475732f5265645465616d50656e74657374696e672f70726574656e6465722f436865636b2f6d61696e3f7374796c653d666f722d7468652d6261646765)](https://github.com/RedTeamPentesting/pretender/actions?workflow=Check) [![Software License](https://camo.githubusercontent.com/70b457e1a863fe44499cf972aab08b57cfd447c3191e683288102fdc3c1f8e9d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d627269676874677265656e2e7376673f7374796c653d666f722d7468652d6261646765)](https://github.com/RedTeamPentesting/pretender/blob/main/LICENSE) [![Go Report Card](https://camo.githubusercontent.com/fb877dc455455b515bdaa1b781fbdb942d198ad4ec5f76d196df4cf2064c9579/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f6769746875622e636f6d2f5265645465616d50656e74657374696e672f70726574656e6465723f7374796c653d666f722d7468652d6261646765)](https://goreportcard.com/report/github.com/RedTeamPentesting/pretender) * * * `pretender` is a tool developed by RedTeam Pentesting to obtain machine-in-the-middle positions via spoofed local name resolution and DHCPv6 DNS takeover attacks. `pretender` primarily targets Windows hosts, as it is intended to be used for relaying attacks but can be deployed on Linux, Windows and all other platforms Go supports. Name resolution queries can be answered with arbitrary IPs for situations where the relaying tool runs on a different host than `pretender`. It is designed to work with tools such as [Impacket’s](https://github.com/SecureAuthCorp/impacket) `ntlmrelayx.py` and [krbrelayx](https://github.com/dirkjanm/krbrelayx) that handle the incoming connections for relaying attacks or hash dumping. Read our [blog post](https://blog.redteam-pentesting.de/2022/introducing-pretender/) for more information about DHCPv6 DNS takeover, local name resolution spoofing and relay attacks. * * * ## Usage To get a feel for the situation in the local network, `pretender` can be started in `--dry` mode where it only logs incoming queries and does not answer any of them: pretender -i eth0 --dry pretender -i eth0 --dry --no-ra # without router advertisements To perform local name resolution spoofing via mDNS, LLMNR and NetBIOS-NS as well as a DHCPv6 DNS takeover with router advertisements, simply run `pretender` like this: pretender -i eth0 You can disable certain attacks with `--no-dhcp-dns` (disabled DHCPv6, DNS and router advertisements), `--no-lnr` (disabled mDNS, LLMNR and NetBIOS-NS), `--no-mdns`, `--no-llmnr`, `--no-netbios` and `--no-ra`. If `ntlmrelayx.py` runs on a different host (say `10.0.0.10`/`fe80::5`), run `pretender` like this: pretender -i eth0 -4 10.0.0.10 -6 fe80::5 Pretender can be setup to only respond to queries for certain domains (or all _but_ certain domains) and it can perform the spoofing attacks only for certain hosts (or all _but_ certain hosts). Referencing hosts by hostname relies on the name resolution of the host that runs `pretender`. See the following example: pretender -i eth0 --spoof [example.com](http://example.com) --dont-spoof-for 10.0.0.3,host1.corp,fe80::f --ignore-nofqdn For more information, run `pretender --help`. * * * ## Tips - Make sure to enable IPv6 support in `ntlmrelayx.py` with the `-6` flag - Pretender can be configured to stop after a certain time period for situations where it cannot be aborted manually (`--stop-after` and `main.vendorStopAfter`) - Host info lookup (which relies on the ARP table, IP neighbours and reverse lookups) can be disabled with `--no-host-info` or `main.vendorNoHostInfo` - If you are not sure which interface to choose (especially on Windows), list all interfaces with names and addresses using `--interfaces` - If you want to exclude hosts from local name resolution spoofing, make sure to also exclude their IPv6 addresses or use `--no-ipv6-lnr`/`main.vendorNoIPv6LNR` - DHCPv6 messages usually contain a FQDN option (which can also sometimes contain a hostname which is not a FQDN). This option is used to filter out messages by hostname (`--spoof-for`/`--dont-spoof-for`). You can decide what to do with DHCPv6 messages without FQDN option by setting or omitting `--ignore-nofqdn` - Depending on the build configuration, either the operating system resolver (`CGO_ENABLED=1`) or a Go implementation (`CGO_ENABLED=0`) is used. This can be important for host info collection because the OS resolver may support local name resolution and the Go implementation does not, unless a stub resolver is used. - The host info functionality is currently only available for Windows and Linux. - A custom MAC address vendor list can be compiled into the binary by replacing the default list `hostinfo/mac-vendors.txt`. Only lines with MAC prefixes in the following format are recognized: `FF:FF:FFVendorIDVendor` (the MAC prefix length can be arbitrary). - If you only want to perform Kerberos relaying you can specify `--no-lnr` and `--spoof-types SOA` to ignore any queries that are unrelated to the attack. - When conducting a Kerberos relay attack where `krbrelayx.py` runs on a different host than pretender (relay IPv4 address points to different host that runs `krbrelayx.py`), the host running `krbrelayx.py` will also need to run pretender in order to receive and deny the Dynamic Update query sent to the relay IPv4 address. * * * ## Building and Vendoring Pretender can be build as follows: go build Pretender can also be compiled with pre-configured settings. For this, the `ldflags` have to be modified like this: -ldflags ‘-X main.vendorInterface=eth1’ For example, Pretender can be built for Windows with a specific default interface, without colored output and with a relay IPv4 address configured: ```auto GOOS=windows go build -trimpath -ldflags '-X "main.vendorInterface=Ethernet 2" -X main.vendorNoColor=true -X main.vendorRelayIPv4=10.0.0.10' ``` Full list of vendoring options (see `defaults.go` or `pretender --help` for detailed information): ```auto vendorInterface vendorRelayIPv4 vendorRelayIPv6 vendorSOAHostname vendorNoDHCPv6DNSTakeover vendorNoDHCPv6 vendorNoDNS vendorNoMDNS vendorNoNetBIOS vendorNoLLMNR vendorNoLocalNameResolution vendorNoRA vendorNoIPv6LNR vendorSpoof vendorDontSpoof vendorSpoofFor vendorDontSpoofFor vendorSpoofTypes vendorIgnoreDHCPv6NoFQDN vendorDryMode vendorTTL vendorLeaseLifetime vendorRARouterLifetime vendorRAPeriod vendorStopAfter vendorVerbose vendorNoColor vendorNoTimestamps vendorLogFileName vendorNoHostInfo vendorHideIgnored vendorRedirectStderr vendorListInterfaces ``` ## GitHub: > **[GitHub - RedTeamPentesting/pretender: Your MitM sidekick for relaying attacks featuring...](https://github.com/RedTeamPentesting/pretender)** > > Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing.