Updating ettercap NG-0.7.3 -> 0.7.4.1

[Garland]

Since I've been playing around with the OpenWRT toolchain (on a Kali Linux VM) I thought I would take a crack at updating the ettercap package to a more recent version.

Ettercap 0.7.5 was the first version to switch to 'cmake'. Currently building 'cmake' packages (outside of the source directory) with the OpenWRT toolchain is a mystery to me, so I settled on attempting to cross-compile the last non-cmake version, which is 0.7.4.1.

All of this takes place on my Kali Linux VM, with the OpenWRT toolchain installed:

First I copied the ettercap-NG-0.7.3.tar.gz from /root/openwrt/attitude_adjustment/dl/ and placed it in a directory with a copy of ettercap-0.7.4.1.tar.gz, then I ran this script:

#!/bin/sh

rm -rf ./ettercap-NG-0.7.3/

rm -rf ./ettercap-0.7.4.1/

tar xvfz ./ettercap-NG-0.7.3.tar.gz

tar xvfz ./ettercap-0.7.4.1.tar.gz

rm -rf ./ettercap-NG-0.7.3/include

cp -r ./ettercap-0.7.4.1/include ./ettercap-NG-0.7.3/

cp -r ./ettercap-0.7.4.1/libltdl ./ettercap-NG-0.7.3/

rm -rf ./ettercap-NG-0.7.3/man

cp -r ./ettercap-0.7.4.1/man ./ettercap-NG-0.7.3/

rm -rf ./ettercap-NG-0.7.3/plug-ins

cp -r ./ettercap-0.7.4.1/plug-ins ./ettercap-NG-0.7.3/

rm -rf ./ettercap-NG-0.7.3/share

cp -r ./ettercap-0.7.4.1/share ./ettercap-NG-0.7.3/

rm -rf ./ettercap-NG-0.7.3/src

cp -r ./ettercap-0.7.4.1/src ./ettercap-NG-0.7.3/

rm -rf ./ettercap-NG-0.7.3/utils

cp -r ./ettercap-0.7.4.1/utils ./ettercap-NG-0.7.3/

..and then manually applied the patch files (found in /root/openwrt/attitude_adjustment/feeds/packages/net/ettercap/patches) for the ettercap-NG-0.7.3 (with the exception of the last one from patch file 003), renamed the directory from ettercap-NG-0.7.3 to ettercap-0.7.4.1 and then tar-ed and gziped the directory into a new ettercap-0.7.4.1.tar.gz file and dropped that into "/root/openwrt/attitude_adjustment/dl/". Next I generated a new md5sum for this file (34f95caea07c47c31ae1f564f7734b8c) and lastly I updated the /root/openwrt/attitude_adjustment/feeds/packages/net/ettercap/Makefile, so the beginning of it looks like this:

PKG_NAME:=ettercap

PKG_VERSION:=0.7.4.1

PKG_RELEASE:=1

PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz

PKG_SOURCE_URL:=@SF/ettercap

PKG_MD5SUM:=34f95caea07c47c31ae1f564f7734b8c

...after all of that I ran 'make' and the toolchain generated the ettercap-0.7.4.1-1_ar71xx.ipk file. Of course this package is unofficial. I'm not responsible if it doesn't work or ends up bricking your device. That being said, I'm running it without any issues so far. Ideally you should compile this package yourself; however if people want to try it, you may find it here:

http://www.qfpost.com/file/d?g=UOZdy3dKg

To update to this version of ettercap, just scp the file over to your pineapple and then run:

opkg remove ettercap
opkg install ./ettercap-0.7.4.1-1_ar71xx.ipk

Good luck,

-Garland

Edited November 4, 2013 by Garland

[Garland]

Looking at the ettercap changelog, you can see what switching to 0.7.4.1 gains you:

https://github.com/Ettercap/ettercap/blob/master/CHANGELOG

First, the NG-0.7.4 (2005) update adds a radius dissector, so now there are 40 protocol dissectors, instead of 39. The 0.7.4.1 (2011) update seems to fix several memory and buffer overflow issues, which is good thing.

If anyone is wishing to build from source, you may find my modified source files here:

http://www.qfpost.com/file/d?g=J97Yh4YDU

Oh, and welcome to 2011... ;)

-Garland

Edited November 4, 2013 by Garland

[Sebkinne]

Depending on how well this runs, we'll roll this into our repositories.

Speaking off, we are re-building them soon with more up-to-date binaries anyway.

Best Regards,

Sebkinne

[Garland]

Having spent a bit more time with this, I have sorted out exactly which patches are necessary to get 0.4.7.1 to compile (where before I could only compile it by leaving all of the old build files from NG-0.7.3).

The issue was in the acinclude.m4 file, so I made a patch to correct that file.

Here is the Makefile, patches and source:

http://www.qfpost.com/file/d?g=bLManu7nx

...and here is the resulting package:

http://www.qfpost.com/file/d?g=24gQvEcX2

I would test using this version of the package instead of the one I posted yesterday.

Thank you,

-Garland

Edited November 4, 2013 by Garland