Skip to content

Latest commit

 

History

History
48 lines (33 loc) · 1.62 KB

README.md

File metadata and controls

48 lines (33 loc) · 1.62 KB
Raw

Bridge MITM tools

A collection of shell scripts for performing a MITM attack on bridged TCP traffic.

Example usage

Assuming a local server bound to <server IP>:1337

  1. ./bridge-start.sh -b br0 -l eth0 -r eth1
  2. ./bridge-reroute.sh \
    --bridge br0 \
    --client 10.1.33.6 00:00:00:00:00:00 \
    --server 10.1.33.7 00:00:00:00:00:01 80 \
    --local-port 1337
  3. <tomfoolery>
  4. ./bridge-reroute-undo.sh -b br0 -c 10.1.33.6
  5. ./bridge-stop.sh br0

Works well in combination with hijack-agent!

How it works

Using ebtables and iptables, traffic destined for the server is rerouted to a local dummy interface fake0:<local port> with <server IP+MAC> assigned to it. All other traffic (client-to-server / server-to-client) continues to be routed normally.

Assumptions / TODOs

As these scripts were written for use on a Raspberry Pi, there are some limitations:

  • Only tested on Debian / Raspbian Jessie, other Linuxes will require tweaks
  • May not bridge transparently (see below)
  • TODO: IPv6, UDP
  • TODO: setup script to install required binaries (ip, iptables, ifconfig, modprobe, ebtables)

Pull requests are appreciated!

MITM detectability

Though efforts were made to bridge / hijack transparently:

  • bridge-reroute.sh disables ARP on all relevant interfaces
  • dhcp-disable.sh kills dhclient for a given interface

... complete transparency is not guaranteed, as other processes on the system may attempt to send information onto the network. Please test-drive before use.