maemo.org - Talk - [Announce] Yet another MITM attack script (Yamas-ARM)

Page 9 of 12

« First

< Prev

Next >

Last »

Show 40 post(s) from this thread on one page

maemo.org - Talk (https://talk.maemo.org/index.php)

- Applications (https://talk.maemo.org/forumdisplay.php?f=41)

- - [Announce] Yet another MITM attack script (Yamas-ARM) (https://talk.maemo.org/showthread.php?t=73988)

brokensmile

2011-07-20 18:58

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

wen i rouched the top menu bar line i can see only twp applets in my n900 i.e volume option and battery percentage option... i cant see the all applets like fm transmetter,shortuts,internet,clock,bluetooth etc... the default also went off...how to get it back

and one more....
when i went to setting and then cssu tuner i got dis popup mesg "could not detect community ssu being installed
you may still try to use the cssu tuner

Estel

2011-07-20 20:06

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

How the *holy f.u.c.k* Your totally broken system is supposed to be related to Yamas? 0_o

comaX

2011-07-21 10:07

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

^ This. We might be missing the point though...

efroname

2011-07-22 16:36

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Aaaaaaaaaaaaaaaaaaaaaaaaaaah, I'm freaking out! I have just flashed my N900 and installed only the most necessary applications, but that (censored) (censored) (censored) of a (censored) still gives me the Dissector "dns" not supported (etter.conf line 70) error!

Please, I'm desperate :P

comaX

2011-07-28 17:54

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Hi guys ! It's nice and all to play hackers, but what about network security ?!

So, I decided to do a little write up on how to protect yourself or your visitors from this type of attack. You'll find it here : http://comax.fr/yamas.php and then by clicking "how to protect". Not done yet, but it should be done quite soon !

I'll prolly make a copypasta here ;)

stevomanu

2011-07-28 18:31

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by comaX (Post 1060190)

Hi guys ! It's nice and all to play hackers, but what about network security ?!

So, I decided to do a little write up on how to protect yourself or your visitors from this type of attack. You'll find it here : http://comax.fr/yamas/ and then by clicking "how to protect". Not done yet, but it should be done quite soon !

I'll prolly make a copypasta here ;)

just tryed to go toy you site an this is what i was faced with ??

Code:

Error 403 - Forbidden



L'accès au fichier requiert une autorisation.

comaX

2011-07-28 20:42

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

[QUOTE=stevomanu;1060205]just tryed to go toy you site an this is what i was faced with ??

Code:

Error 403 - Forbidden



L'accès au fichier requiert une autorisation.

F*ck, my bad... I put / instead of .php... bad habits ! It's fixed now !

http://comax.fr/yamas.php !

comaX

2011-07-30 11:59

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Here's the intro :

"Introduction -- How it works.

In the attack Yamas uses, the vector is the poisonning of the victim's ARP cache. ARP is the protocol that will "translate" physical mac adresses into IP adresses on the local network. When an equipement wants to connect to the network, it will ask for the mac of the router's IP, eg : "Who has 192.168.1.1 ? Tell 192.168.1.2". The router then responds "198.168.1.1 [router] is at 11:22:33:44:55:66 [router]". This will be written in the ARP cache of the client. And this is where we come in play. We send spoofed ARP responses : "192.168.1.1 [router] is at 00:11:22:66:66:66 [attacker]". The client will then modify its cache to set the attacker as the router. We then forward the traffic to the real router, which allows us to read, and manilipulate the traffic on-the-fly. That's how we get the passwords. Thanks to sslstrip, we force the clients to send the credentials as clear text, so that we can simply read them.
All right, but now, how do you protect yourself from that to happen to you ? "

Yeah, I'm a cheap bastard, you'll have to click this http://comax.fr/yamas.php?frame=protect.php to know what's next :p

q6600

2011-07-30 13:31

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

ArpON 2.7
will work on n900?

comaX

2011-07-30 16:53

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by q6600 (Post 1061123)

ArpON 2.7
will work on n900?

Dunno... You'll have to see for yourself or wait for someone to try !
If you read the article, could you give me feedback of any sort in PM please ?

Cheers :)

udaychaitanya16

2011-07-30 16:59

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by brokensmile (Post 1054784)

hey wen i rouched the top menu bar line i can see only twp applets in my n900 i.e volume option and battery percentage option... i cant see the all applets like fm transmetter,shortuts,internet,clock,bluetooth etc... how to get it back

i recently posted that why we should not help him.My apologies to all the people.disgusting post in all the threads.moderator please throw him out of TMO.

sr00t

2011-07-31 21:23

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Hi guys!
Everytime I open X-Term and is loading, I see a Yamas screen executing before the prompt loads (then it disappears).
I even uninstalled and purged YAMAS without results.

I uploaded a screencast to youtube so you can see it.

Please help me!

http://youtu.be/VdIG-Pkwj94

colin.stephane

2011-08-02 14:11

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by Unhuman (Post 1028850)

After a discussion with a member of the backtrack forums - comaX he agreed to create this script for the N900.
http://pcsci3nce.info/comax/yamas-arm.png
Current main features are :
- Real-time output of creds without definition files : any credential, from any website whould show up
- Log parsing for user-friendly output.
- Network mapping for host discovery.
- Can save dumped passwords to file as well as the whole log file.
- Support for multiple targets on the network, as well as adding targets after attack is launched.
- Checks for missing dependencies when run with “-d” option and auto installs them.

It is by far the best available for the N900.

To install - apt-get install yamas

More info - http://pcsci3nce.info/?p=291

Video of the script thanks to torpedo48 - http://www.youtube.com/watch?v=9bSq7tXSGAo

If you don't know what sslstrip or ettercap is, don't bother downloading it.

REQUIREMENTS:

iptables
xterm
busybox-power
nmap
python-twisted-web
python-pyopenssl
libpcap0.8
libpcre3
busybox-power
which the script will automatically get when installed from apt-get

+

sslstrip(read how to install below)
ettercap(read how to install below)

Installation guide for ettercap, sslstrip and many other tools can be found at:
http://pcsci3nce.info/?p=9

To run the script - type "yamas" in terminal.AS ROOT.

If you get any errors (beside font warnings) do yamas -d to check for missing dependencies.

Current maintainers are comaX and Christos Saturn - http://maemo.org/packages/view/yamas/

UPDATED June 18 2011 - Now saves all files to /home/user/MyDocs/Yamas
UPDATED June 21 - now automatically creates Yamas directory.
UPDATED June 25 - added dependency check in the begining.
UPDATED June 26 - bash no longer required.
UPDATED June 29 - Now available from repositories thanks to Saturn

Hi,

I have just packaged properly sslstrip, it can be found in extra-devel ...

Installation is trivial, as root, type :

Code:

-bash-2.05b# apt-get install sslstrip && sslstrip --help

Reading package lists... Done

Building dependency tree       

Reading state information... Done

The following NEW packages will be installed:

  sslstrip

0 upgraded, 1 newly installed, 0 to remove and 12 not upgraded.

Need to get 0B/24,6kB of archives.

After this operation, 188kB of additional disk space will be used.

Selecting previously deselected package sslstrip.

(Reading database ... 38855 files and directories currently installed.)

Unpacking sslstrip (from .../sslstrip_0.9-0maemo1_all.deb) ...

Setting up sslstrip (0.9-0maemo1) ...



sslstrip 0.9 by Moxie Marlinspike

Usage: sslstrip <options>



Options:

-w <filename>, --write=<filename> Specify file to log to (optional).

-p , --post                       Log only SSL POSTs. (default)

-s , --ssl                        Log all SSL traffic to and from server.

-a , --all                        Log all SSL and HTTP traffic to and from server.

-l <port>, --listen=<port>        Port to listen on (default 10000).

-f , --favicon                    Substitute a lock favicon on secure requests.

-k , --killsessions               Kill sessions in progress.

-h                                Print this help message.



-bash-2.05b#

Hope it help.

A++

comaX

2011-08-02 19:56

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Nice ! I'll ask Saturn to add it to the dependencies, so it is installed at the same time as the other ones.

Thanks !

Saturn

2011-08-02 22:00

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by comaX (Post 1062960)

Nice ! I'll ask Saturn to add it to the dependencies, so it is installed at the same time as the other ones.

Thanks !

No problem, it just have to wait for next week when I'm back to my PC.

hope someone picks up ettercap too.

colin.stephane

2011-08-03 01:12

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by Saturn (Post 1063008)

No problem, it just have to wait for next week when I'm back to my PC.

hope someone picks up ettercap too.

You asked ?

Ok, I give it a try to ettercap also.

Look like I'm able to do the thing properly ...

Installation is trivial, as root, type :

Code:

-bash-2.05b# apt-get install ettercap && ettercap --help

Reading package lists... Done

Building dependency tree       

Reading state information... Done

The following extra packages will be installed:

  ettercap-common

The following NEW packages will be installed:

  ettercap ettercap-common

0 upgraded, 2 newly installed, 0 to remove and 12 not upgraded.

Need to get 0B/497kB of archives.

After this operation, 1544kB of additional disk space will be used.

Do you want to continue [Y/n]? y

WARNING: The following packages cannot be authenticated!

  ettercap-common ettercap

Install these packages without verification [y/N]? y

Selecting previously deselected package ettercap-common.

(Reading database ... 38749 files and directories currently installed.)

Unpacking ettercap-common (from .../ettercap-common_1%3a0.7.3-2maemo1_armel.deb) ...

Selecting previously deselected package ettercap.

Unpacking ettercap (from .../ettercap_1%3a0.7.3-2maemo1_armel.deb) ...

Setting up ettercap-common (1:0.7.3-2maemo1) ...

Setting up ettercap (1:0.7.3-2maemo1) ...



ettercap NG-0.7.3 copyright 2001-2004 ALoR & NaGA





Usage: ettercap [OPTIONS] [TARGET1] [TARGET2]



TARGET is in the format MAC/IPs/PORTs (see the man for further detail)



Sniffing and Attack options:

  -M, --mitm <METHOD:ARGS>    perform a mitm attack

  -o, --only-mitm             don't sniff, only perform the mitm attack

  -B, --bridge <IFACE>        use bridged sniff (needs 2 ifaces)

  -p, --nopromisc             do not put the iface in promisc mode

  -u, --unoffensive           do not forward packets

  -r, --read <file>           read data from pcapfile <file>

  -f, --pcapfilter <string>   set the pcap filter <string>

  -R, --reversed              use reversed TARGET matching

  -t, --proto <proto>         sniff only this proto (default is all)



User Interface Type:

  -T, --text                  use text only GUI

       -q, --quiet                 do not display packet contents

       -s, --script <CMD>          issue these commands to the GUI

  -C, --curses                use curses GUI

  -G, --gtk                   use GTK+ GUI

  -D, --daemon                daemonize ettercap (no GUI)



Logging options:

  -w, --write <file>          write sniffed data to pcapfile <file>

  -L, --log <logfile>         log all the traffic to this <logfile>

  -l, --log-info <logfile>    log only passive infos to this <logfile>

  -m, --log-msg <logfile>     log all the messages to this <logfile>

  -c, --compress              use gzip compression on log files



Visualization options:

  -d, --dns                   resolves ip addresses into hostnames

  -V, --visual <format>       set the visualization format

  -e, --regex <regex>         visualize only packets matching this regex

  -E, --ext-headers           print extended header for every pck

  -Q, --superquiet            do not display user and password



General options:

  -i, --iface <iface>         use this network interface

  -I, --iflist                show all the network interfaces

  -n, --netmask <netmask>     force this <netmask> on iface

  -P, --plugin <plugin>       launch this <plugin>

  -F, --filter <file>         load the filter <file> (content filter)

  -z, --silent                do not perform the initial ARP scan

  -j, --load-hosts <file>     load the hosts list from <file>

  -k, --save-hosts <file>     save the hosts list to <file>

  -W, --wep-key <wkey>        use this wep key to decrypt wifi packets

  -a, --config <config>       use the alterative config file <config>



Standard options:

  -U, --update                updates the databases from ettercap website

  -v, --version               prints the version and exit

  -h, --help                  this help screen





-bash-2.05b#

Hope it help.

A++

n900shamie

2011-08-03 01:59

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

hii,

i have installed Yamas via ''faster app manager'' but i dont have Yamas directory(folder) in MyDocs,,,so i cant access saved results,,and i also dont get any info about any visited sites e.g facebook,yet i installed everything succesfully,,,any ideas thx

haffid

2011-08-03 04:05

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

the route is /home/user/yamas/ not in MyDocs

Quote:

Originally Posted by n900shamie (Post 1063071)

g0r	2011-08-03 10:03

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by n900shamie (Post 1063071)

hii,

i also dont get any info about any visited sites e.g facebook,yet i installed everything succesfully,,,any ideas thx

If you get any errors (beside font warnings) do yamas -d to check for missing dependencies. (taken from the first post)

EDIT: also read the first post

carbonjha

2011-08-08 11:29

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

after fixing all the dependencies of ettercap then reinstalling sslstrip now the YAMAS working nicely. Thanks everyone working in this project.

efroname

2011-08-08 14:09

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

FIXED THE "Dissector dns not supported" ERROR!
Just follow these steps: http://talk.maemo.org/showthread.php?p=1018150 :D

te37v

2011-08-08 23:49

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Ettercap has a missing dependency - libldtl3

bluehash

2011-08-09 01:03

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

First thanks for the script. everything is up and installed well. However I dont see any o/p on the console when i login to facebook or any other sites.

Do you have any suggestions?

meLi	2011-08-09 05:56

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

1 Attachment(s)

I have problem with ettercap shutting down terminated. also dns not supported etter.conf line 70. Anybody can help me ?

TQ

adhrie

2011-08-09 07:30

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

@meLi

why dont you take a look at what efroname had posted just several posts above you (first post of this page to be exact) about a solution to disector dns problem

Daneel

2011-08-09 11:24

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Already did that, still have the "Dissector dns not supported" error.

Quote:

Originally Posted by adhrie (Post 1066424)

@meLi

why dont you take a look at what efroname had posted just several posts above you (first post of this page to be exact) about a solution to disector dns problem

Saturn

2011-08-09 15:28

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

FYI, uploaded new version (0.9.8-1) with the sslstrip and ettercap as dependencies (as previously discussed).

Installation goes fine in a clean system. nevertheless now I also get the "Dissector DNS not supported".

Will try to research if the cause is the new ettrcap or something else. In the meantime, non-testers (or people with limited skills) should not upgrade..

ivgalvez

2011-08-09 16:05

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Package ettercap is not installable, depends on libltdl3 which seems not to be present in the repositories.

adhrie

2011-08-09 16:56

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

disector dns problem didnt occur if i run yamas from xterm by previously becoming root via the sudo gainroot command

but if become root with the command 'root' or 'sudo yamas' i will still get the disector dns problem

maybe somebody knows the difference between those command and come up with a solution to this problem

carbonjha

2011-08-09 17:10

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by ivgalvez (Post 1066672)

Package ettercap is not installable, depends on libltdl3 which seems not to be present in the repositories.

Download the "libltdl3" from the link below then install the package through xterm:
dpkg -i libltdl3_1.5.26-3maemo1_armel.deb

http://repository.maemo.org/pool/maemo5.0/free/libt/libtool/libltdl3_

Saturn

2011-08-09 17:15

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by ivgalvez (Post 1066672)

Package ettercap is not installable, depends on libltdl3 which seems not to be present in the repositories.

Yes, big mess still.

Get it from here in the meantime:
http://talk.maemo.org/showpost.php?p...2&postcount=17

Maybe Colin can help us here..

ivgalvez

2011-08-09 17:55

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by Saturn (Post 1066703)

Yes, big mess still.

Get it from here in the meantime:
http://talk.maemo.org/showpost.php?p...2&postcount=17

Maybe Colin can help us here..

Thank you both, I had already installed manually, just pointing it.

It's really close to be a single click install.

lost_bro

2011-08-09 20:45

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by meLi (Post 1066401)

I have problem with ettercap shutting down terminated. also dns not supported etter.conf line 70. Anybody can help me ?

TQ

Good Day Meli
I had a similar problem (crashing-ettercap terminating xterm window), and I went to re-install nmap.
The DNS error is non-related to ettercap crashing.
Actually I did a downgrade because the auto-updates had upgraded my n900 nmap to ver. Beta something.

code:
apt-get -f install nmap=5.50-2

This will downgrade to a compatible nmap.

I hope this will help you.

I have upgraded to the 'New' Yamas today, leaving the old NMAP, and It works superbly even with the DNS ettercap error.

lost_bro

lost_bro

2011-08-09 20:53

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by adhrie (Post 1066696)

Good afternoon:

Yes, I have always gotten the DNS error message on the Ettercap xterm.

I have tried 'Sudo Gainroot' 'Root' and the Desktop shortcut. ALL three give the same error.
I have tried all versions of Ettercap and Ettercap-GTK. ALL versions give the same DNS error.

The strange part is that I CAN recover the Logins and Passwords just fine. Have tested successfully with ie: Facebook, yahoo.mail, etc.

So: for me, ettercap IS functional with the DNS error, and I have always had this DNS since I first installed Yamas many weeks ago.

I would be interested to know WHY the error occurs.

Take care
lost_bro

mr_pingu

2011-08-09 20:59

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by lost_bro (Post 1066828)

Same for me, always had that error but no problems.
I can also confirm that the nmap=5.59BETA is giving problems with the script and ettercap!

Version 5.50-2 works OK :D

Edit: Something I found out:
Also when logging in on gmail from FF using saved password, so all text is filled in and you only have to click log in, or something. SSLstrip cannot capture/snif it when using this script. However if you TYPE the password it GET's sniffed by this scripted.

lost_bro

2011-08-09 21:27

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by mr_pingu (Post 1066830)

Edit: Something I found out:
Also when logging in on gmail from FF using saved password, so all text is filled in and you only have to click log in, or something. SSLstrip cannot capture/snif it when using this script. However if you TYPE the password it GET's sniffed by this scripted.

Yes: This is same for me.

If the password is saved in the field beforehand, SSLstrip does not decode it.

If the password is entered into the field in real-time, Ettercap will capture it and SSLstrip will decode it.

I believe this is because the P/W is NOT being relayed/sent in real-time as it is already stored for use. Please correct me if I am wrong in this assumption.

lost_bro

mr_pingu

2011-08-09 21:44

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by lost_bro (Post 1066842)

I think you are right, but Im not as experienced and have that much knowledge as ComaX, hope he can confirm or explain why this is happening.

Did you also used firefox?

comaX

2011-08-09 22:00

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

Quote:

Originally Posted by mr_pingu (Post 1066855)

I think you are right, but Im not as experienced and have that much knowledge as ComaX, hope he can confirm or explain why this is happening.

Did you also used firefox?

That's very nice of you to say that, but I wouldn't say I know too much either.

Anyway, in this case I think a cookie is sent instead of encrypted or plain text. The only way to know for sure is to manually check the whole log (so at the end of the attack, you say yes to keep it, and then search for the pass you entered). Well I'm pretty sure it's that tough, because I already did this check for the same reason.

It's worth giving it a shot on your side though ;)

mr_pingu

2011-08-09 22:04

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

I see, well if it are cookies then they can be intercepted too. Think of sidejacking(or HTTP session hijacking).

Will check it out tomorrow, as I am now laying in my bed with only my n900 and I don't wanna perform the attack on my parents :P

K9999

2011-08-10 09:36

Re: [Announce] Yet another MITM attack script (Yamas-ARM)

as far as I know, back in Back Track, they used to say this error appears when the version 64bits installed. but now ettercap on N900 doing the same thing? that was not the problem then.

p/s: I'm also having that dissector error line but I can still get logins. I only dun get anything if the hosts are many, or at a large number of users within the network.

All times are GMT. The time now is 16:34.

Page 9 of 12

Show 40 post(s) from this thread on one page

vBulletin® Version 3.8.8