Woo! Hacking is fun! We've been playing with the dsniff tools today in our little testbed and got most of that stuff working great. The setup here is Cayce and Porcelina NATed through Michael.
First we had my little dlink switch hooked up. Unfortunately, it doesn't "fail open" and turn in to a hub. That didn't really matter too much because arpspoof worked great. We had Porcelina attack Cacyce to make Cayce think Porcelina was Michael (the gateway) so any traffic Cayce put out went through Porcelina anyhow :P Then, using dsniff, we could easily pull plain-text passwords from ftp and http logins. We just didn't have the software setup on the client side for popping mail, but I'm sure that would have worked as well.
We also tried mail/file-spoof to trap email messages and NFS file transfers, but didn't have any luck there. Stuck a hub in instead of the switch, but still no luck. Feh.
Then we moved up to the Man In The Middle (MITM a.k.a. "Monkey In The Middle") attack. We had Porcelina successfully hijack Cayce's SSH login. It was awesome. The username and password showed up in plain-text all like "oh, here's how to get in to this weak system" and then ex (who was running the setup) had a user login right there. He could just wander around and do whatever his persimmons allowed. It was great.
But we'll be back and more attacks will ensue.
Subscribe to:
Post Comments (Atom)
Popular Posts
-
For anyone who's had to cleanup some mail problems with Postfix configuration (or more often with other things, like anti-spam, tied in ...
-
In the course of troubleshooting the office Jabber server the other day, I came across some interesting info about the various caches that O...
-
For everyone who uses cron, you are familiar with the job schedule form: min hr day-of-month month day-of-week <command> A problem...
No comments:
Post a Comment