You take two computers. Connect them both to a hub and the hub to the switch. Run Windows NT or 2000 on one, Linux on the other. Configure the Linux system to ARP route IP traffic to the default network segment gateway. Use DSNIFF (actually several tools, you want to use ARPSPOOF) or Ettercap to spoof the target system. What your are actually doing is telling the target system that you are the default gateway. Now all traffic send from the target to the gateway is actually send to your box. Since your box is on a hub, the second box running Windows can sniff your personal segment. Just pick the SMB traffic from the wire (most guys never bother enabling SMB signing so there you go). Meanwhile your Linux box is forwarding the traffic to the real gateway, which knows how to handle the traffic. Responses from the real gateway will however still go directly to the target system. If you want to get the full flow and do it properly, also spoof the gateway, telling him that you are the target host. Unfortunate I do not have an ARP spoofing tool from a Windows box. Anybody out there which does have one? Make live easier when on a remote prompt of a compromised system in another network segment :-) Erwin -----Original Message----- From: Thad Horak [mailto:thadhorakat_private] Sent: donderdag 13 december 2001 17:06 To: Zwan-van-der.Erwin Subject: RE: SMBRelay issues Here ya go. The zip has both the smbrelay.exe's and the html documentation. Let me know if you have better luck. The ultimate goal is to gather SMB logons from machines homed to the same switch as my attacking machine. How would I go about ARP Spoofing to get the hosts to send the traffic to me? If I could accomplish this, sniffing it is pretty trivial. The last question would be how to route it back to the original destitation? Thanks. Thad ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
This archive was generated by hypermail 2b30 : Thu Dec 13 2001 - 09:50:17 PST