Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am doing ARP Spoof experimentation with arpspoof and have successfully set up a man in the middle between two machines.

We set up IP Forwarding using:

echo 1 > /proc/sys/net/ipv4/ip_forward

This allows us to analyze communications using, for example, Wireshark. In theory, we should be able to modify traffic as well. I am aware of tools like Ettercap and SSLstrip, but how would I manually impersonate the target server?

To rephrase the question: client A is talking to server B. Attacker C (that's me) is in between and currently forwarding packets both ways. How does C, at a low level, redirect requests meant for B to my own machine?

All systems involved are using BackTrack.

Update:

My arpspoof commands (on attack machine, C):

arpspoof -i eth0 -t 8.0.0.2 8.0.0.3 # Tell 8.0.0.2 (A) that I am 8.0.0.3 (B)
arpspoof -i eth0 -t 8.0.0.3 8.0.0.2 # Tell 8.0.0.3 (B) that I am 8.0.0.2 (A)

My netcat commands for testing:

nc -p 5555 -l # Run on target B, listen on port 5555
nc -p 5555 -l # Run same thing on attack machine
nc 8.0.0.3 5555 # Run on A; connect to B.

My goal is to get C to pose as B when A runs the last command.

If IP forwarding is on, A connects to B. If IP forwarding is off, A fails to connect with: (UNKNOWN) [8.0.0.3] 5555 (?) : Connection timed out. The issue is that the IP layer does not respond to a packet meant for another IP address; so although C receives the packet at a lower level, it does not get passed "up" the stack. My goal is to get this up the stack.

share|improve this question
    
Are you asking how to do it using the tools? Or the theory on how the techniques works? –  schroeder Jan 31 '12 at 18:32
    
I was looking for the quickest way to do this sort of thing on BackTrack. From your answer, it looks like Ettercap may do more than I thought before; I will look at that some more. I think I understand the theory, but I may well be missing something. –  dafrazzman Jan 31 '12 at 19:53
    
the links I provided are tutorials for the tools –  schroeder Jan 31 '12 at 19:58
    
I'm using netcat for communication between A and B, and want C's netcat command to be used instead. So I want to do something like nc -l 5555 or nc -p 5555 -l on both B and C, then nc IPAddressForC 5555 and get a response from B rather than C. –  dafrazzman Jan 31 '12 at 19:59
    
Assuming you got the computer names mixed up in your comment, then arpspoof does exactly what you say. B and C are listening on 5555, A connects to IPAddressForB 5555 and gets C instead. C has overwrtitten A's arp cache to redirect A's communication to B to C's mac address. –  schroeder Jan 31 '12 at 20:19
show 4 more comments

2 Answers

up vote 2 down vote accepted

This involves writing a bit of code, but the mechanism is pretty simple.

You write a program that listens for connections outbound from your target. Use typical socket programming techniques. As before, use ARP spoofing to get the traffic to your computer, and possibly DNAT rewriting if necessary so that your application recognizes the traffic if your network configuration doesn't jive with the inbound packets. Then you make a separate outbound connection to wherever the traffic was originally going. And simply parrot the traffic from one host to the other, monitoring and/or modifying as you go along, using SNAT if that's necessary for what you're trying to accomplish.

Alternatively, you can do some really cool vooodoo with libnetfilter_queue. Essentially what you do is set up an iptables rule that sends the traffic to the target QUEUE. You then write a userspace tool that receives those packets, makes whatever modifications you want, and then optionally pushes them back onto the network stack. This mechanism is way more elegant in a certain regard, but also fairly low-level. It works at the packet level, so for example all the magic TCP does for you may have to be accounted for in your code, depending on what you're trying to accomplish.

share|improve this answer
    
Thanks, this is a little bit out of my time frame for this experiment, but that is good to know. I guess this is why the pre-built tools exist. I haven't done much socket programming, but maybe that needs to change. –  dafrazzman Feb 2 '12 at 2:39
add comment

Once you have intercepted the communication, you can perform an edit on the plain text in the packets being sent, so you can change what a website says, for instance. A search/replace using regex works for this purpose.

To do this efficiently, ettercap has many tools to help you out.

Depending on what you want to accomplish, BeEF is another great example, which in included in Backtrack. It allows you to spoof entire websites and make modifications. It also has some impressive client attack tools, but I think that's not in the scope of what you want to do.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.