LocutusOfBorg
commented
10 years ago Two things: 1) please try with the latest git, compile with Debug set and send here your ettercap log (you can run it by ./src/ettercap and you will have a log file inside. 2) for the redir_command si glad to hear the new version, I'll push it on the configuration file, but without any script.
The redir_command_on should be executed once, if it isn't we should fix it. Period :)
I don't see any good point in doing things twice!
For the curses stuff I'll wait for some other developers :)
Pandoxie
ryandesign
eaescob
I tried to gather some information about the ettercap debug. This is about the "GTK no focus and cannot quit MITM ARP" problem. I took a peek into the log but cannot find anything abnormal myself:) Hope you guys could get something out of it. BTW, I cannot get anything out of gdb, no core found(I tried to cd to /bin, no good). I also don't know what this ' (gdb) r your_parameters_here' means, so I did not do the gdb stuff...
koeppea
Have been playing with MITM softwares for a while. After toying with MITMPROXY, the author suggested me to ettercap to know more about multi-protocol sniffing. It is really awesome and handy. But I just found some issues with the Ncurses GUI. My platform is OSx 10.9.1 Mavericks, I uses homebrew to build the sources.
Symptom:
After I select MITM items eg, ARP poisoning, A parameter input box comes up and I think this is the place to type in command line parameters like arp ([remote],[oneway]). So I just typed in remote, oneway inside the box and ARP poisoning is turned on.
I believed that worked since no error was generated, but It turned out something was wrong. I know this because when I tried to turn on ICMP redirecting, I typed naturally (MAC/IP) into the box. But the error came up.
The parameters I typed in did not actually get in the system somehow, as if NOTHING was inputed! I confirmed this by looking into the router's ARP table ( I am using DDWRT) and the router was also spoofed although I specified oneway!
So, please tell me what to do the next and Thanks a ton!
BTW, the ettercap instruction about turning on https MITM was outdated. The IPFW commanded is deprecated and pfctl is the new lover. I am new to shell programming but after some observation, I came up with the following script and it worked well.
redir_command_on = "sh /usr/local/etc/ettercap/pf.sh %iface %port %rport" redir_command_off = "sh /usr/local/etc/ettercap/pfunload.sh"
pf.sh--->
!/bin/sh
cd /usr/local/etc/ettercap/ touch EtterPF.conf touch Ettertoken.txt isOldItem=
cat EtterPF.conf | grep "rdr pass on $1 inet proto tcp from any to any port $2 -> localhost port $3"if [ -z "$isOldItem" ]; then printf "rdr pass on $1 inet proto tcp from any to any port $2 -> localhost port $3\n" >>EtterPF.conf else printf "Old Item Found, Just Reload\n" >> EtterLog.log 2>&1 fiToken=
cat Ettertoken.txt | grep 'Token' | awk '{ print $3 }'if [ -n "$Token" ]; then printf "Revoke Old Token: $Token\n" >> EtterLog.log 2>&1 pfctl -a sslsniff -Fa -X $Token >> EtterLog.log 2>&1 fi pfctl -a sslsniff -E -f "EtterPF.conf" &> Ettertoken.txt Token=cat Ettertoken.txt | grep 'Token' | awk '{ print $3 }'printf "\n\nNewly Add Token: $Token\n" >> EtterLog.log 2>&1pfunload.sh
!/bin/sh
cd /usr/local/etc/ettercap/ Token=
cat Ettertoken.txt | grep 'Token' | awk '{ print $3 }'if [ -n "$Token" ]; then printf "Revoke Old Token: $Token\n" >> EtterLog.log 2>&1 pfctl -a sslsniff -Fa -X $Token >> EtterLog.log 2>&1 printf "Flushed\n" &> Ettertoken.txt fiI am doing the stupid if because I found redir_command_on was executed several times at program launch. In order not to mess up with the OSx's pf load, I just did it the stupid way... Enjoy.