.png)
3 years ago
203 
StreamDivert is a tool to man-in-the-middle or relay in and outgoing network connections on a system. It has the ability to, for example, relay all incoming SMB connections to port 445 to another server, or only relay specific incoming SMB connections from a specific set of source IP's to another server. Summed up, StreamDivert is able to:
Relay all incoming connections to a specific port to another destination. Relay incoming connections from a specific source IP to a port to another destination. Relay incoming connections to a SOCKS(4/5) server. Relay all outgoing connections to a specific port to another destination. Relay outgoing connections to a specific IP and port to another destination. Handle TCP, UDP and ICMP traffic over IPv4 and IPv6. Force redirected packets over a specific network interface.Download Binaries
Pre-compiled binaries for StreamDivert can be downloaded here.
Usage
How do you use StreamDivert? Run the the tool with administrative privileges:
The config file contains entries for streams you want to have diverted. En example config file:
The [-f] flag, when present, will modify the Windows Firewall to add an exception for the application to properly redirect incoming traffic to another port. The [-v] flag control the logging verbosity. When provided, StreamDivert will log details about redirected packets and streams.
Some Use Cases
Diverting outbound C&C traffic to a local socket for dynamic malware analysis. Diverting inbound SMB connections of a compromised host to Responder/ ntlmrelayx (usefull in penetration tests). Routing traffic over reserved ports. Usefull when a network firewall is in between. For example... Routing a meterpreter shell over port 445. Running a SOCKS server on port 3389. ...Help! My packets/ connections are not correctly diverted!
One thing to keep in mind when configuring diverted connections is that you don't have conflicting diverted streams. Given the following example config file:
Those two diverted streams will conflict with eachother, as packets for the first diverted stream will also be picked up by the second packet 'diverter'. Generally you will only run into these issues with UDP and ICMP and using wildcards.
Also note that diverting an IPv4 to an IPv6 address and vice versa is not supported for UDP and ICMP traffic.
Contributing to StreamDivert
Features wanted:
IP range support ...
Bengali (Bangladesh) · 
English (United States) ·