mw3demo Posted April 9, 2015 Share Posted April 9, 2015 (edited) Looks like a new release will be coming out soon, but even more exciting is the MITMf integration that is on the cards (Unless this is going to be in the next release!). MITMf will replace some of the infusions we have come to love and hate, and replace them with a one stop shop framework. This will hopefully solve some of the issues we were having running multiple infusions impacting the network. Now we will have the best of hardware and software MITM in one sweet pineapple! Some functionality may not make it due to being CPU intensive (FilePwn), regardless, this is going to be a giant leap! MITMf V0.9.5 Framework for Man-In-The-Middle attacks Availible plugins Responder - LLMNR, NBT-NS and MDNS poisoner SSLstrip+ - Partially bypass HSTS Spoof - Redirect traffic using ARP Spoofing, ICMP Redirects or DHCP Spoofing and modify DNS queries Sniffer - Sniffs for various protocol login and auth attempts BeEFAutorun - Autoruns BeEF modules based on clients OS or browser type AppCachePoison - Perform app cache poison attacks SessionHijacking - Performs session hijacking attacks, and stores cookies in a firefox profile BrowserProfiler - Attempts to enumerate all browser plugins of connected clients CacheKill - Kills page caching by modifying headers FilePwn - Backdoor executables being sent over http using bdfactory Inject - Inject arbitrary content into HTML content JavaPwn - Performs drive-by attacks on clients with out-of-date java browser plugins jskeylogger - Injects a javascript keylogger into clients webpages Replace - Replace arbitary content in HTML content SMBAuth - Evoke SMB challenge-response auth attempts Upsidedownternet - Flips images 180 degrees Changelog Addition of the Sniffer plugin which integrates Net-Creds currently supported protocols are: FTP, IRC, POP, IMAP, Telnet, SMTP, SNMP (community strings), NTLMv1/v2 (all supported protocols like HTTP, SMB, LDAP etc..) and Kerberos Integrated Responder to poison LLMNR, NBT-NS and MDNS, and act as a WPAD rogue server. Integrated SSLstrip+ by Leonardo Nve to partially bypass HSTS as demonstrated at BlackHat Asia 2014 Addition of the SessionHijacking plugin, which uses code from FireLamb to store cookies in a Firefox profile Spoof plugin now supports ICMP, ARP and DHCP spoofing along with DNS tampering Spoof plugin can now exploit the 'ShellShock' bug when DHCP spoofing! Usage of third party tools has been completely removed (e.g. ettercap) FilePwn plugin re-written to backdoor executables and zip files on the fly by using the-backdoor-factory and code from BDFProxy Added msfrpc.py for interfacing with Metasploits rpc server Added beefapi.py for interfacing with BeEF's RESTfulAPI Addition of the app-cache poisoning attack by Krzysztof Kotowicz (blogpost explaining the attack here http://blog.kotowicz.net/2010/12/squid-imposter-phishing-websites.html) Links: https://twitter.com/hak5darren/status/585168796739964928 https://twitter.com/sebkinne/status/585550844260700162 https://github.com/byt3bl33d3r/MITMf/ Edited April 9, 2015 by mw3demo Quote Link to comment Share on other sites More sharing options...
Sebkinne Posted April 9, 2015 Share Posted April 9, 2015 Oh, finally we are getting a new firmware, it's been a while.. That Pineapple developer is sure taking a long time...! Quote Link to comment Share on other sites More sharing options...
newbi3 Posted April 9, 2015 Share Posted April 9, 2015 (edited) Oh, finally we are getting a new firmware, it's been a while.. That Pineapple developer is sure taking a long time...! Well stackoverflow can only respond to all of the topics he creates so fast. It takes a while. And then he was to figure out how to compile which takes even longer Edited April 9, 2015 by newbi3 Quote Link to comment Share on other sites More sharing options...
mw3demo Posted April 9, 2015 Author Share Posted April 9, 2015 Quote Link to comment Share on other sites More sharing options...
DataHead Posted April 9, 2015 Share Posted April 9, 2015 Oh, finally we are getting a new firmware, it's been a while.. That Pineapple developer is sure taking a long time...! BAH! We all just want to see the new codename art Darren comes up with ;-) Quote Link to comment Share on other sites More sharing options...
Sebkinne Posted April 9, 2015 Share Posted April 9, 2015 BAH! We all just want to see the new codename art Darren comes up with ;-) I just told the dev on IRC. He started crying I think. Yall to cruel. Quote Link to comment Share on other sites More sharing options...
Declined Posted April 9, 2015 Share Posted April 9, 2015 Nice! Can't wait. Haven't taken my ultra bundle off since I got it about 1 week ago. I eat sleep shit with this thing. wait....that can't be good? or can it? Quote Link to comment Share on other sites More sharing options...
r6uur6nr6u5ur56 Posted April 9, 2015 Share Posted April 9, 2015 Nice! Can't wait. Haven't taken my ultra bundle off since I got it about 1 week ago. I eat sleep shit with this thing. wait....that can't be good? or can it? eat sleep shit play with pineapple repeat ? completely normal :) Quote Link to comment Share on other sites More sharing options...
Declined Posted April 9, 2015 Share Posted April 9, 2015 eat sleep shit play with pineapple repeat ? completely normal :) Quote Link to comment Share on other sites More sharing options...
DataHead Posted April 9, 2015 Share Posted April 9, 2015 eat sleep shit play with pineapple repeat ? completely normal :) not the most normal thing I've ever heard at all. I'd get checked out by a doctor if it escalates further. Quote Link to comment Share on other sites More sharing options...
DataHead Posted April 10, 2015 Share Posted April 10, 2015 (edited) Is the new fw coming today? That's the word on the street ;-) Edited April 10, 2015 by DataHead Quote Link to comment Share on other sites More sharing options...
WallE Posted April 11, 2015 Share Posted April 11, 2015 What a great new. Finally an update to fix DNS spoof. I will take out the dust from my mark V just for this! Very impatient to play with this! So tell us more please when will it be out? Anyway, nice job guys! Quote Link to comment Share on other sites More sharing options...
anonymailbelgium Posted April 17, 2015 Share Posted April 17, 2015 Hi guys, Is there news about update? Quote Link to comment Share on other sites More sharing options...
Rkiver Posted April 17, 2015 Share Posted April 17, 2015 Soon. In the future. When there are robots. Quote Link to comment Share on other sites More sharing options...
sud0nick Posted April 17, 2015 Share Posted April 17, 2015 Soon. In the future. When there are robots. But robots exist now... Quote Link to comment Share on other sites More sharing options...
Rkiver Posted April 17, 2015 Share Posted April 17, 2015 And they will exist in the future too. Quote Link to comment Share on other sites More sharing options...
sud0nick Posted April 17, 2015 Share Posted April 17, 2015 How do you know? Have you been there? Are you a robot? Do you and your robot friends have plans to exist forever and wipe out humanity? Quote Link to comment Share on other sites More sharing options...
Sebkinne Posted April 17, 2015 Share Posted April 17, 2015 How do you know? Have you been there? Are you a robot? Do you and your robot friends have plans to exist forever and wipe out humanity? Yes. Quote Link to comment Share on other sites More sharing options...
sud0nick Posted April 17, 2015 Share Posted April 17, 2015 Very well. In that case, I would gladly welcome our robot overlords if they would only gift us with wonderful new firmware. Quote Link to comment Share on other sites More sharing options...
rek2wilds Posted April 23, 2015 Share Posted April 23, 2015 Any news about this release? Quote Link to comment Share on other sites More sharing options...
BeNe Posted April 24, 2015 Share Posted April 24, 2015 There is no offical release day. So you still have to wait. A more interesting question: Will the pineapple be a able to handle the Framework and do a stable Man-In-the-Middle-Attack ? Since i have many random reboots a day on the MarkV without a tons of infusions i can't believe it. The 400 Mhz and the 64 MB RAM is just that low to bring in a stable device for such an attack. But yeah – we will see! Quote Link to comment Share on other sites More sharing options...
BeNe Posted April 26, 2015 Share Posted April 26, 2015 2.3.0 - Codename: Logasaurus is out - and voila, no MITMf on board.... So it was a wrong info from mw3demo ?! Quote Link to comment Share on other sites More sharing options...
Rkiver Posted April 26, 2015 Share Posted April 26, 2015 The only people who can say for sure what is coming in a new firmware are those who develop it. Quote Link to comment Share on other sites More sharing options...
Sebkinne Posted April 26, 2015 Share Posted April 26, 2015 2.3.0 - Codename: Logasaurus is out - and voila, no MITMf on board.... So it was a wrong info from mw3demo ?! We always said it wouldn't make it into this one, but we are aiming for the next one. Lots of fun stuff lined up :) Quote Link to comment Share on other sites More sharing options...
anonymailbelgium Posted April 26, 2015 Share Posted April 26, 2015 so it s impossible to grabb credential for now ? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.