Brief Overview
There is more to “Man in the Middle” attacks than just getting/collecting/harvesting emails/passwords/cookies. For example, the attacker could manipulate & alter the target’s traffic to have some “malicious fun” (even though some scripts are “borderline childish”), to highlight the dangers of a “Man In The Middle” attack and what other abilities/options are available to the attacker. Below is a breakdown of the scripts demonstrated:
Requirements
* Nmap – Can be found in BackTrack 4-R2
*
Squid –
Can be found in the BackTrack repository
*
Apache –
Can be found in BackTrack 4-R2
*
DansGuardian –
Can be installed via allPornInternet.sh
*
ARPSpoof –
Part of the DSniff suite which can be found in the BackTrack 4-R2
* A Text Editor –
Kate can be found in BackTrack 4-R2
* The collection of scripts –
See “Links”
Method
*
Start network services and
obtain an IP address
*
Download,
install and
configure Squid proxy
*
Check the
configuration and
dependence for the script
* Set file & folder
permissions
*
Configure and
perform a man in the middle attack
*
Game Over
*
Edit Squid configuration and restart service
*
Game Over ...again
*
Download & “
configure”
DansGuardian
*
Restart Squid
*
Game Over ...once more!
Walk-through
The attacker installs
Squid3 cache proxy via the Operating System (
Backtrack 4 R2) repository. Squid is the “backbone” to this attack and after configuring it to work on the Local Area Network (LAN) and to be
transparent (the proxy “works” without any configuration to the browser), the attacker chooses which script to first try out (asciiImages.pl is the first one) and adds it to the configuration file.
The attacker then opens the script up to verify its location as well as any requirements, which in this case is
ImageMagick,
Ghostscript and
jp2a. At the same time, the attacker checks the variables to match their local machine's configuration. For example, the attacker checks if:
- "$debug" mode is needed for any diagnostics reasons. ("1" = enabled, "0" = disabled. The log file is placed in /tmp/[scriptname]_debug.log)
- "$ourIP" matches the attacker's IP address. (ifconfig [interface])
- "$baseDir" is a local path for a folder that is accessible to the webserver and is writeable by "nobody" - as Squid is running at this user level and it executes the perl scripts. (Apache default web path is /var/www/. However the attacker creates a subfolder, "tmp/" to use)
- "$baseURL" would be the visible path for "$baseDir". (http://[ip]/anysubfolders)
- "$convert" , "$convert" and "$jp2a" are the paths to the necessarily programs (whereis [programsname])
Note: The variables depend on each script. The example above was taken from "asciiImages.pl".
After this, the attacker moves on to configure the files and folder
permissions to allow the necessary
daemons to be able to interact correctly. The daemons are then restarted to re-load the configuration files in the new environment. The last stage in preparing the attacker’s machine is to manage the
ports, as the standard HTTP port for web traffic is on port 80, however Squid is running on 3128 on the attacker’s machine (and their web server, which is needed, is also on port 80). The attacker redirects the traffic into the proxy, therefore squid is used. This is achieved with
iptables.
The attacker does a quick sweep of the network using
nmap to check that the target is online. After they have been located, the attacker performs a
MITM attack via
ARP cache poisoning via
arpspoof
Everything is now in place… Game over.
[Video] Playing With Traffic (Squid)
Re: [Video] Playing With Traffic (Squid)
Re: [Video] Playing With Traffic (Squid)
Re: [Video] Playing With Traffic (Squid)
Originally Posted by akuj1n
