2

I was wondering if there was a way to stop a packet, edit what you want, then send it, like a MiTM attack.

Example:

10.0.0.1 has a ncat listener (ncat -lnvp 1234)

10.0.0.2 connects to 10.0.0.1 (nc 10.0.0.1 1234) and sends hello

Here's the network packet:

0000   a2 02 e1 1f ee 24 ec 88 92 65 7f 69 08 00 45 00  .....$...e.i..E.
0010   00 3a af 36 40 00 40 06 77 85 0a 00 00 02 0a 00  .:.6@.@.w.......
0020   00 01 b1 ab 04 d2 5f a8 bf 71 89 2a 75 28 80 18  ......_..q.*u(..
0030   01 57 ec 1b 00 00 01 01 08 0a 00 07 11 84 00 1b  .W..............
0040   4b cd 68 65 6c 6c 6f 0a                          K.hello.

10.0.0.3 sniffs the packet, then edits it to:

0000   a2 02 e1 1f ee 24 ec 88 92 65 7f 69 08 00 45 00  .....$...e.i..E.
0010   00 46 af 37 40 00 40 06 77 78 0a 00 00 02 0a 00  .F.7@.@.wx......
0020   00 01 b1 ab 04 d2 5f a8 bf 77 89 2a 75 28 80 18  ......_..w.*u(..
0030   01 57 b7 c5 00 00 01 01 08 0a 00 07 64 5a 00 1b  .W..........dZ..
0040   58 78 49 20 64 6f 6e 27 74 20 6c 69 6b 65 20 79  XxI don't like y
0050   6f 75 21 0a                                      ou!.

So 10.0.0.1 receives the message: I don't like you!

How would I do this on Windows 10?

  • 1
    Just pick one of the packet editors that are available for Windows. Like WireEdit or Ostinato. But iḿ not sure if you are aware of the whole topic as you can't just 'stop' a connection. And definitly not in the timeframe you are suggesting by altering an IRC. – Matte Aug 5 '17 at 13:40
  • 1
    this is not like a MITM attack, it is a MITM attack - you are looking for mitm proxies – schroeder Dec 5 '17 at 11:10
1

There a few differents way to do this:

  • On windows there are the tool windiver who can modify packets on the fly
  • You can also use a virtual machine with Linux to use several tools like netsed, hexinject, proxyshark, mallory,...
  • On the Linux VM, you can use MITM framework which have many features like intercept packets on the fly and edit it, sometimes it can inject shellcode in binary,... One popular framework is MITMf
0

Canape from Context Information Security is an open-source network interception tool for Windows. It allows you to define what packets you want to catch and what you want to do with them (including inspect, modify, redirect, etc.), and is fully programmable (use the .NET language of your choice, including [Iron]Python). I've used to intercept and modify binary protocols before; it does quite well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.