SSLStrip & Ettercap not playing nicely together in BT5R1

[ericmilam]

As i stated in a previous post in this thread thier are two versions of ettercap available for bt5/bt5r1 ,all you did was reinstall the same verion you had.You need to uninstall/remove your current ettercap version and install ettercap version 0.7.4-bt7! To do that run the following commands in terminal (you will need to have internet connection to download that package).


apt-get remove ettercap-desktop
apt-get remove ettercap-gtk
apt-get remove ettercap-common
apt-get install ettercap

OK...thanks, but as I already stated...this DID NOT work for me. And it does not seem to be working for others either. I kind of know what I'm doing so I am pretty sure I would know.

Everything is cool with kernel 2.6.38, but 2.6.39 is when the errors start.

[ericmilam]

OK...so I did it again...just to be ABSOLUTELY sure....see the attached screen shot

[DeserTEagLe]

OK...so I did it again...just to be ABSOLUTELY sure....see the attached screen shot

I forgot to mention , but i also installed libnet_1.1.2.1.orig.tar.gz I downed it from the link below.

https://launchpadlibrarian.net/1221263/libnet_1.1.2.1.orig.tar.gz

[ericmilam]

OK...that may make a difference since the error is a libnet error being thrown. I'll give that a try.

Also, everything worked on my home Kubuntu system...so I checked the kernel and it is also 2.6.38. And the BT5-R1 disk from BlackHat works fine too, its kernel? 2.6.38

[zimmaro]

hi,
fully confirms the thesis of Eric! I tested bt5r1 (blackhat edition kernel 2.6.38) I made a video too! but bt5r1 official (2.6.39.4) do not work late!
about ...... I wanted to offer my most cherished compliments to ericmilam for his works! bye
Regards Zimmaro

[MattMarquis]

So that is the problem then, so what is the fix? Just to use BT 4 for now, when they both worked? I don't have the CD from BH, just what you can download from the site, which I assume will not work. I am sure if I scour I can find a working link to BT4R2 which was the last working version that I used.

[g0tmi1k]

So that is the problem then, so what is the fix? Just to use BT 4 for now, when they both worked? I don't have the CD from BH, just what you can download from the site, which I assume will not work. I am sure if I scour I can find a working link to BT4R2 which was the last working version that I used.

Since the release of backtrack 5, support for Backtrack 4 R2 and below has stop. If you wish to use it - you are on your own.

[MattMarquis]

Oh, I know support for it has stopped. But this just happens to be one of the things that I test alot out with. If it dosent work on the later version of BT, seems to be like the reasonable thing to do is go back to the last working copy. I'm sure the great people that put this together will eventually fix it, but for now, using a version that works that is no longer supported seems to be the better solution to using something that does not work properly as of yet, but a fix is I am sure in the works. I mean, the problem is binary, it either works, or not, hehe.

I mean, despite the few people on this particular post that use these two programs together, we can't be the 'only' ones that care about getting sslstrip and ettercap to work in tandem.

[Carnacior]

No damn fix... for this issue... not even a point in a direction
And im stuck badly because cant even go back to bt4r2 because only bt5r1 works since its the first kernel with vga_switcheroo integrated so i can turn of one of my dual gpus.

[ericmilam]

You can always boot BT5 into the other kernel version.... 2.6.38. It's not like it got deleted... :-)

I am still working to find a fix. From what I can see, it does still work. Traffic still passes, passwords still get collected. My first instinct is to comment out the error report from source so I don't see it, but that's not a fix.

Me, purehate & Alex are working to see what we can find out. Everything points to something changing with the kernel, however, the error is from a libnet issue. So until we can isolate the actual issue being thrown, we can't fix it for certain.

I can tell you that from my wireshark dump I did see some packets without proper headers, so I am thinking that may be it. And since libnet writes the packets, I still think its libnet.

The best thing is just to keep digging, if you find out something else, post here. Every bread crumb helps ;-)

Happy hunting

JB