Friday
06Mar2009

Arp poisining – Man in the middle attack in linux using Ettercap-gtk

  This article is for demonstration purposes only. If you decide to follow these instructions you should only do so on a network that you own.

 

  This is a method I somtimes use to demonstrate the ease of a man in the middle attack. There are many tools to use to accomplish this but I prefer Ettercap-GTK. It has a nice user interface and it works quite well. This application is available for windows, mac and linux. Throughout this article I will be refering to my wireless card which is 'wlan0'. Change this to match your connected interface.

 

  The first thing you want to do is install ettercap-gtk. This will install everything you need. Install it through your package manager, or if you are using a debian based system just type into a terminal

 

sudo apt-get install ettercap-gtk

 

 

You will want to launch it from a terminal with this command

 

Code:

sudo ettercap-gtk -i wlan0 -G 

 

 

  The capital G option will give you the gtk interface. Now you can select 'Unified Sniffing' from the 'Sniff' menu. Next you will be asked for your ethernet interface.

 

  Click on 'Hosts' and select 'Scan for hosts'. This will scan your network for ip addresses. Now you can click on 'Mitm' and select 'Arp Poisoning'. Check the box that says 'Sniff remote connections'. Now click on 'Hosts' and select 'Hosts list'. Highlight the ip address that you want to poison and click on 'Add to Target 1'. Now highlight the ipaddress of your router and click on the 'Add to Target 2' button. Click on 'Start' and select 'Start Sniffing'. Now you are poisoning the target machine and all of their network traffic will be routed through your network interface card. Now click on 'Veiw' 'Connections'. This will give you a list of all of the current connections of the target computer.

 

  If you see any interesting connections on the target computer you can just double click on the connection and you will see a split screen with a bunch of information in them. Most of it may look like garbage but you may just find something interesting in there. If you click on an msn messenger connection you will be supprised what you can see. Also pay close attention to the bottom of the Ettercap screen. If logon credentials are used in clear text they will be displayed on the bottom of your screen.

 

 

Friday
06Mar2009

How to fix Bashpodder / wget and Libsyn file extensions

 

  Those who have had very long jiberish file extensions attached to the files downloaded from libsyn my be interested in this information. Recently libsyn added some extra information to their files to control how the downloads are handled.I found that the conflict is with “wget” which is used by many of the linux/unix podcast clients from what I understand. I communicated with libsyn via email a few times and they were very helpful in trying to find a solution to the problem. The program I use is Bashpodder which of course uses wget. I have found it to be an amazing utility for downloading my list of many podcasts until recently. I am not interested in trying several different podcast clients. I just want Bashpodder to work again.

 

  Within some of the emails from libsyn I was sent the code to a script from the tech team which used the curl application. It did work fine for single downloads of podcasts from libsyn but I got it to work with Bashpodder it seemed to break all of my other podcast downloads. I spent most of my spare time the next few days trying to figure it out and now I have a solution. I was able to find the part of the Bashpodder script that called wget and changed it to point to a script that I wrote to take care of the actual downloads. I use a modified version of Bashpodder so it took some time to make this work but looking back now, it wasn't that hard.

 

  Here is a copy of the Bashpodder script that I use.

 


#!/bin/bash

# By Linc 10/1/2004

# Find the latest script at http://linc.homeunix.org:8080/scripts/bashpodder

# If you use this and have made improvements or have comments

# drop me an email at linc dot fessenden at gmail dot com

# I'd appreciate it!

#

# This revision by Brian Hefferan 2004/02/06, adding configuration options.

# No warranty. It seems to work for me, I hope it works for you.

# Questions /corrections on the additions by Brian Hefferan can be sent to

# brian at heftone dot com



#default values can be set here. Command-line flags override theses.

verbose=true

#wget_quiet='-q' #default is -q

wget_quiet='--tries=1 -q' #default is -q

wget_continue=

catchup_all=

first_only=

unix2dos=

usetorrents=

sync_disks=

fetchlist='bp.conf'







function usage

{

echo "

Usage: $0 [OPTIONS]

Options are:

-v, --verbose display verbose messages. Also enables wget's continue

option.

--catchup_all write all urls to the log file without downloading the

actual podcasts. This is useful if you want to subscribe

to some podcasts but don't want to download all the back

issues. You can edit the podcast.log file afterwards to

delete any url you still wish to download next time

bashpodder is run.

--first_only grab only the first new enclosed file found in each feed.

The --catchup_all flag won't work with this option. If

you want to download the first file and also permanently

ignore the other files, run bashpodder with this option,

and then run it again with --catchup_all.

-bt --bittorrent launch bittorrent for any .torrent files downloaded.

Bittorrent must be installed for this to work. The

the script and bittorrent process will continue running

in the foreground indefinitely. You can use ctr-c to

kill it when you want to stop participating in the

torrent.

--sync_disks run the "sync" command twice when finished. This helps

makes sure all data is written to disk. Recommended if

data is being written directly to a portable player or

other removable media.

-u, --url_list ignore bp.conf, instead use url(s) provided on the

command line. The urls should point to rss feeds.

If used, this needs to be the last option on the

command line. This can be used to quickly download just

a favorite podcast, or to take a few new podcasts for a

trial spin.

-h, --help display this help message



"

}



if [ -n "$verbose" ]; then wget_quiet='';wget_continue='-c';fi

if test -f urls.temp;then rm urls.temp;fi



# Make script crontab friendly:

cd $(dirname $0)



while [ "$1" != "" ];do

case $1 in

-v|--verbose ) verbose=1

wget_continue='-c'

wget_quiet=''

;;

-u|--url_list ) shift

while [ "$1" != "" ];do

echo "$1" >> urls.temp

shift

done

if test ! -f urls.temp

then

echo "Error: -u or --url_list option specified, but no urls given on command line. quitting."

exit 1;

fi

fetchlist='urls.temp'

;;

--catchup_all ) catchup_all=1

;;

--first_only ) first_only=1

;;

--bittorrent ) usetorrents=1

;;

--sync_disks ) sync_disks=1

;;

-h|--help ) usage

exit

;;

esac

shift

done



# datadir is the directory you want podcasts saved to:

datadir=$(date +%Y-%m-%d)



# Check for and create datadir if necessary:

if test ! -d $datadir

then

mkdir $datadir

fi



if test ! -f bp.conf && test ! -f urls.temp;

then

echo "Sorry no bp.conf found, and no urls in command line. Run $0 -h for usage."

exit

fi



# Read the bp.conf file and wget any url not already in the podcast.log file:

while read podcast

do

# Skip lines beginning with '#' as comment lines - from Rick Slater

if echo $podcast | grep '^#' > /dev/null

then

continue

fi


seenfirst=

if [ -n "$verbose" ]; then echo "fetching rss $podcast...";fi;

for url in $(wget -q "$podcast" -O - | tr '\r' '\n' | tr \' \" | \

sed -n 's/.*url *= *"\([^"]*\)".*/\1/p' )

do

if [ -n "$first_only" ] && [ -n "$seenfirst" ]; then break;fi

echo $url >> temp.log

if [ -n "$catchup_all" ];

then

if [ -n "$verbose" ]; then echo " catching up $url...";fi

elif ! grep "$url" podcast.log > /dev/null ;

then

if [ -n "$verbose" ]; then echo " downloading $url...";fi

myscript "$url" $wget_continue $wget_quiet -P $datadir "$url"

fi

seenfirst=1

done

done < $fetchlist



if test ! -f temp.log && [ -n "$verbose" ];then echo "nothing to download.";fi



if test -f urls.temp; then rm urls.temp;fi



# Move dynamically created log file to permanent log file:

cat podcast.log >> temp.log

sort temp.log | uniq > podcast.log

rm temp.log



# Use bittorrent to download any files pointed from bittorrent files:

if [ "$usetorrents" ]

then

if ls $datadir/*.torrent 2> /dev/null

then

btlaunchmany.py $datadir

fi

fi



# Create an m3u playlist:

ls -1rc $datadir | grep -v m3u > $datadir/podcast${datadir}.m3u

if [ -n "$unix2dos" ];then unix2dos $datadir/podcast${datadir}.m3u;fi;



if [ -n "$sync_disks" ]

then

if [ -n "$verbose" ]; then echo "running sync..";fi;

sync

if [ -n "$verbose" ]; then echo "running sync again..";fi;

sync

fi



if [ -n "$verbose" ]; then echo "done.";fi;



You will notice the line that says

 

wget $wget_continue $wget_quiet -P $datadir "$url"

 

This is the line that I had to change. It now looks like this

 

myscript "$url" $wget_continue $wget_quiet -P $datadir "$url"

 

 

This will tell Bashpodder to download with my script using a program called “snarf”.

If you are using ubuntu you can just install snarf from synaptic or from the command line using

 sudo apt-get install snarf

Here is a copy of the script that I have written.

 

 

#! /bin/bash
URL=$1
datadir=$(date +%Y-%m-%d)

# Check for and create datadir if necessary:
if test ! -d $datadir
then
mkdir $datadir
fi

cd $datadir
snarf -v $URL

  Save this to a file and name it whatever you like. Make it executable and copy it to your /usr/bin directory. Or if you have followed my previous post here you can put it in your /home/username/bin directory. Next time you run bashpodder you will have the files downloaded properly and no file extension issues. I hope that this will help the other people that are having the same trouble I have experienced. If anyone has any ideas to make this better or would like to share what they have done to take care of the issue, please let me know – drew at my brain runs linux dot com -

 

 

UPDATE:

I contacted Link of the LinuxLinkTechShow and he informed me that this is an old version of the bashpodder script.

If you upgrade to the new script it will take care of the libsyn problem.

If you insist on using the old version like mine, my solution is still working perfectly.

 

 

Friday
06Mar2009

How to install Hamachi on Ubuntu (All) as a service

 

  This procedre will make hamachi start as a service without any interaction from the user on ubuntu 8.04, 8.10, 9.04, 32 and 64 bit versions.

 

  Hamachi is a vpn solution that will not require any firewall port forwarding. I use this program to connect to my work computer from home and vice versa. I have been using it for a couple of years and I find that I could not live without it. Through many months of searching and testing I have created an easy way to get hamachi to run as a service in ubuntu. Normally you would have to run /sbin/tuncfg with sudo to get hamachi to run. If you are logged in to a remote location and you rebooted the remote machine, there was no way to log back in until someone ran “sudo /sbin/tuncfg”, and “hamachi start” from the keyboard of the remote machine.

 

 I have been using a script that I found in the ubuntu forums that works perfectly. I have gone a step further and made another script to automate the process of installation. Below you will find two files that are needed to install hamachi from scratch. The first file is my script, and the second is a text file.

 

  The first thing you will have to do is download both files posted below and save them to your home directory. On line #5 in the text file it reads

 

USER=username

 

  You have to change 'username' to the user you are logged in as. Ie: drew

  You will also have to edit line #9 in the script to reflect the username that you are logged in as.

 

  Before running the script you must make it executable by typing

  chmod +x autostarthamachi

  You will need to run the script with sudo, so you can run the script by typing

 

sudo ./autostarthamachi

 

The script will download and install hamachi from sourceforge.net and install it as well as create the files needed to run hamachi as a service.

 

Now it is time to setup hamachi. First you will need to run

sudo tuncfg

And then run

 

hamachi-init

 

This will generate the keys for hamachi

Then you will need to start hamachi

 

hamachi start

 

Then run

 

hamachi login

 

to put the daemon online and to create an account.

 

hamachi join <network> 

 

to join the network.

 

hamachi go-online <network> 

 

to go online in the network.

 

hamachi list 

 

to list network members and their status.

  Once you have hamachi installed and running you can reboot your machine and check that hamachi is running and logged in by typing

 

hamachi list

 

  If hamachi does not complain then everything was a success.

  If you would like to try a very nice gui, I highly recommend 'hamachi-gui'

 

 

Friday
06Mar2009

Snarf

  I have been using a program lately called snarf. I always use it with the -v option. I have incorporated it into my version of bashpodder and I also use it for all of my command line downloads. Snarf is not included by default in ubuntu, so you will have to manually install it.

sudo apt-get install snarf

  Here is an example of how I would use it.

 

snarf -v http://hydrogen.oshean.org/psw-airpwn.m4v

 

the output should look something like this

 

drew@laptop:~$ snarf -v http://hydrogen.oshean.org/psw-airpwn.m4v
HTTP/1.1 200 OK
Date: Tue, 09 Sep 2008 02:01:35 GMT
Server: Apache
Last-Modified: Mon, 09 Oct 2006 00:10:48 GMT
ETag: "1eb407a-3305d52-45299388"
Accept-Ranges: bytes
Content-Length: 53501266
Connection: close
Content-Type: text/plain; charset=iso-8859-1

http://hydrogen.oshe
an.org/psw-airpwn.m4v (52247K)
psw-airpwn.m4v [#### ] 10927K | 291.38K/ss

 

  As you can see the ###'s are the progress bar. If you look at the beginning of the output you can see what kind of server it is running on.

  Snarf is a good tool for information gathering bacause snarf will usually output a lot of information about the server you are downloading from. If you are trying to assess the server without doing say, an nmap or port scan you could just "snarf -v" the website's homepage.

  Let's try another one.

drew@laptop:~$ snarf -v twit.tv
HTTP/1.1 200 OK
Date: Tue, 09 Sep 2008 02:11:26 GMT
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: PHP/5.2.6
Set-Cookie: SESS75d408f2ce389493e4955f4b0d50c557=gamt7i1jcg52e1c60qd15aksa0; expires=Thu, 02 Oct 2008 05:44:46 GMT; path=/; domain=.twit.tv
Last-Modified: Tue, 09 Sep 2008 02:06:41 GMT
ETag: "1a906da29faa3716f27d19c6d8073eab"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Connection: close
Content-Type: text/html; charset=utf-8

http://twit.tv (unknown size)
index.html [-] 32K
33753 bytes transferred in 0.22 sec (147.33k/sec)

  Here we can see that the server is running apache version 2.0.52 on a red hat machine. If you know some redhat or apache vulnerabilities ...

 

Friday
06Mar2009

Nbtscan

 

  Nbtscan is a program for scanning networks for NetBIOS name information. It works very quickly and can be usefull for information gathering about the network you are connected to. Nbtscan is not installed by default in Ubuntu so you will have to install it. Use synaptic or just use the command

sudo apt-get install nbtscan

  I have made a script and put it in my /home/drew/bin/ directory so that all I have to do is type the name of the script into a terminal and I get instant results.

  Here is a copy of my script

 

#! /bin/bash
sudo nbtscan -hv 192.168.1.0/24 > test.txt && gedit test.txt



  This will send the output to a text file and open it with mousepad ( which is not installed by default as well - Just use gedit if you want to)

  The reason I use mousepad is to demonstrate how quickly the nbtscan actually runs.

  Try typing

man nbtscan

into a terminal to learn more about this program.

  Test it for yourself and have fun with it.

  Feel free to comment or make a suggestion.