MITM: mitmssh - Revision history

Onnowpurbo at 02:31, 3 October 2018

2018-10-03T02:31:54Z

@@ Line 1: / Line 1: @@
-sumber: https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/
+sumber: https://andrewmichaelsmith.com/2014/03/quick-and-easy-ssh-mitm/
-'''CATATAN:''' SUSAH!!
+ #Generate mitm keys (these go to ~/.mitmkeys)
-Recently during an internal penetration test, I was performing ARP spoofing and i discovered a SSH connection from the administrator computer to another box.
+ ssh localhost -p 2222
-That sounds like the correct way to access remote hosts securely. However, the problem was that the company was using a network switch that was vulnerable to ARP spoofing.
+And ta-da! You should see the raw data sent between client and server in the window you ran mitmproxy_ssh.
 ==Referensi==
 * https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/
 * https://github.com/milo2012/pentest_automation/blob/master/mitmSSH.py
 * http://woff.hu/tools/ssh2-mitm-like-attack-with-jmitm2/

Onnowpurbo at 23:59, 6 April 2017

2017-04-06T23:59:01Z

← Older revision		Revision as of 23:59, 6 April 2017
Line 20:		Line 20:

	Below is the link to the original article.		Below is the link to the original article.
	http://woff.hu/tools/ssh2-mitm-like-attack-with-jmitm2/		http://woff.hu/tools/ssh2-mitm-like-attack-with-jmitm2/

	In the article, the author demonstrates the use of a software called JMITM2 (http://www.david-guembel.de/index.php?id=6) which is sort of like a honey pot that proxies SSH connections between the victim and the target SSH server.		In the article, the author demonstrates the use of a software called JMITM2 (http://www.david-guembel.de/index.php?id=6) which is sort of like a honey pot that proxies SSH connections between the victim and the target SSH server.

Onnowpurbo at 23:27, 6 April 2017

2017-04-06T23:27:04Z

← Older revision		Revision as of 23:27, 6 April 2017
Line 1:		Line 1:
	sumber: https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/		sumber: https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/


			'''CATATAN:''' SUSAH!!

Onnowpurbo: /* Download */

2017-04-06T22:35:22Z

Download

← Older revision		Revision as of 22:35, 6 April 2017
Line 54:		Line 54:
	wget https://raw.githubusercontent.com/milo2012/pentest_automation/master/mitmSSH.py		wget https://raw.githubusercontent.com/milo2012/pentest_automation/master/mitmSSH.py

			mkdir /tmp/tools
			cd /tmp/tools
			wget https://github.com/intercepter-ng/mirror/archive/master.zip
			unzip master.zip
			mv /tmp/tools/mirror-master/* /tmp/tools/
			unzip Intercepter-NG.CE.05.zip

	==Edit source==		==Edit source==

Onnowpurbo: /* Download */

2017-04-06T22:20:41Z

Download

← Older revision		Revision as of 22:20, 6 April 2017
Line 53:		Line 53:

	wget https://raw.githubusercontent.com/milo2012/pentest_automation/master/mitmSSH.py		wget https://raw.githubusercontent.com/milo2012/pentest_automation/master/mitmSSH.py


			==Edit source==

			* line 1: rom > from
			* line currentPath="/tmp1/tools" > currentPath="/tmp/tools"

			Lakukan

			mkdir /tmp/tools

	==Referensi==		==Referensi==

Onnowpurbo: /* Download */

2017-04-06T22:11:59Z

Download

← Older revision		Revision as of 22:11, 6 April 2017
Line 52:		Line 52:
	==Download==		==Download==

	wget https://~~github~~.com/milo2012/pentest_automation~~/blob~~/master/mitmSSH.py		wget https://raw.githubusercontent.com/milo2012/pentest_automation/master/mitmSSH.py






	==Referensi==		==Referensi==

Onnowpurbo at 22:09, 6 April 2017

2017-04-06T22:09:44Z

← Older revision		Revision as of 22:09, 6 April 2017
Line 1:		Line 1:
	sumber: https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/		sumber: https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/






Line 45:		Line 49:
	https://github.com/milo2012/pentest_automation/blob/master/mitmSSH.py		https://github.com/milo2012/pentest_automation/blob/master/mitmSSH.py


			==Download==

			wget https://github.com/milo2012/pentest_automation/blob/master/mitmSSH.py

Onnowpurbo at 21:28, 4 April 2017

2017-04-04T21:28:54Z

← Older revision		Revision as of 21:28, 4 April 2017
Line 17:		Line 17:
	However, there are a number of steps to be done manually to execute this attack during an internal penetration test.		However, there are a number of steps to be done manually to execute this attack during an internal penetration test.

	1. Check if network is vulnerable to ARP spoofing		# Check if network is vulnerable to ARP spoofing
	2. Check if there are any active SSH connections in the network		# Check if there are any active SSH connections in the network
	2. Identify the victim computer and SSH server		# Identify the victim computer and SSH server
	3. Modify the configuration files of JMITM2		# Modify the configuration files of JMITM2
	4. Modifying iptables		# Modifying iptables
	5. ARP spoofing		# ARP spoofing
	6. Checking JMITM2 console for credentials		# Checking JMITM2 console for credentials
	7. Re-arp the router and victim host with the correct MAC addresses of each.		# Re-arp the router and victim host with the correct MAC addresses of each.

	It would save a great amount of time to automate these steps. I wrote a script that does just that.		It would save a great amount of time to automate these steps. I wrote a script that does just that.
Line 30:		Line 30:
	Running the command below checks the network for active SSH connections (via ARP spoofing) and then automates the whole attack to outputs any credentials captured to the console.		Running the command below checks the network for active SSH connections (via ARP spoofing) and then automates the whole attack to outputs any credentials captured to the console.

	python2.7 mitmSSH.py -analyze		python2.7 mitmSSH.py -analyze

	If you know the victim host IP and SSH server, you can use the below command		If you know the victim host IP and SSH server, you can use the below command

	python2.7 mitmSSH.py -host victims -ssh sshServerIP		python2.7 mitmSSH.py -host victims -ssh sshServerIP

	IMG_2025.PNG		IMG_2025.PNG
Line 54:		Line 54:

	* https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/		* https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/
			* https://github.com/milo2012/pentest_automation/blob/master/mitmSSH.py
			* http://woff.hu/tools/ssh2-mitm-like-attack-with-jmitm2/

Onnowpurbo: Created page with "sumber: https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/ Recently during an internal penetration test, I was performing ARP spoofing and..."

2017-04-04T21:12:09Z

Created page with "sumber: https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/ Recently during an internal penetration test, I was performing ARP spoofing and..."

New page

sumber: https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/

Recently during an internal penetration test, I was performing ARP spoofing and i discovered a SSH connection from the administrator computer to another box.

That sounds like the correct way to access remote hosts securely. However, the problem was that the company was using a network switch that was vulnerable to ARP spoofing.

I came across the below article about performing ARP spoofing and MITM SSH connections to steal credentials.

When performing arp spoofing and performing a mitm attack on SSH, the victim does get an alert message saying that there is a key mismatch but most people just ignore them anyway.

Below is the link to the original article.
http://woff.hu/tools/ssh2-mitm-like-attack-with-jmitm2/

In the article, the author demonstrates the use of a software called JMITM2 (http://www.david-guembel.de/index.php?id=6) which is sort of like a honey pot that proxies SSH connections between the victim and the target SSH server.

However, there are a number of steps to be done manually to execute this attack during an internal penetration test.

1. Check if network is vulnerable to ARP spoofing
2. Check if there are any active SSH connections in the network
2. Identify the victim computer and SSH server
3. Modify the configuration files of JMITM2
4. Modifying iptables
5. ARP spoofing
6. Checking JMITM2 console for credentials
7. Re-arp the router and victim host with the correct MAC addresses of each.

It would save a great amount of time to automate these steps. I wrote a script that does just that.

Running the command below checks the network for active SSH connections (via ARP spoofing) and then automates the whole attack to outputs any credentials captured to the console.

python2.7 mitmSSH.py -analyze

If you know the victim host IP and SSH server, you can use the below command

python2.7 mitmSSH.py -host victims -ssh sshServerIP

IMG_2025.PNG
This script has only been tested on Kali Linux.

There are a couple of things that are still in the works to improve the script.
1. Switching from intercepter-ng for ARP spoofing to scapy.

The script can be grabbed from the below link
https://github.com/milo2012/pentest_automation/blob/master/mitmSSH.py

==Referensi==

* https://milo2012.wordpress.com/2014/11/12/automating-man-in-the-middle-sshv2-attacks/