Start Inveigh Listener

Description

Starts one or more Inveigh protocol listeners (HTTP, HTTPS, SMB, LDAP, Proxy) to capture NTLM challenge/response hashes from inbound connections.

Overview

Starts Inveigh rogue listeners for the specified protocols. Connecting clients are challenged for NTLM authentication; captured hashes are stored in the Inveigh session and retrievable with Get-InveighCredential. HTTPS requires a certificate. The Proxy listener intercepts HTTP proxy requests.

Arguments

Parameter Type Description
Protocol string[] Listener protocols to start. ValidateSet: HTTP, HTTPS, Proxy, SMB, LDAP.
IPAddress string Local IP address to bind.
HTTPPort int HTTP listener port. Default: 80.
HTTPSPort int HTTPS listener port. Default: 443.
SMBPort int SMB listener port. Default: 445.
LDAPPort int LDAP listener port. Default: 389.
ProxyPort int Proxy listener port. Default: 8492.
HTTPAuth string HTTP auth method. ValidateSet: NTLM, BASIC, ANONYMOUS. Default: NTLM.
WPADAuth string WPAD proxy auth method. ValidateSet: NTLM, BASIC, ANONYMOUS. Default: NTLM.
WPADResponse string Custom WPAD response body returned to clients.
EnableWebDAV bool Enable WebDAV support on the HTTP listener. Default: false.
Challenge string Fixed 8-byte hex NTLM challenge. Leave blank to use a random challenge per connection.
NetbiosDomain string NetBIOS domain name used in NTLM challenges.
ComputerName string Computer name used in NTLM challenges.
DNSDomain string DNS domain used in NTLM challenges.
Cert string Path to certificate file for the HTTPS listener.
CertPassword string Password for the HTTPS certificate file.

Dependencies

  • inveigh

Operating Systems

  • Windows

Example Text Output

Protocol State   StartedAt
-------- -----   ---------
HTTP     Running 4/27/2026 09:02:00
SMB      Running 4/27/2026 09:02:00
LDAP     Running 4/27/2026 09:02:00
Scroll to Top