Linux环境下黑客常用嗅探器分析

linsniffer是一个简单实用的嗅探器。它主要的功能特点是用来捕捉用户名和密码，它在这方面非常出色。 [;zPszPd  
A8 !/XHv  
作者：Mike Edulla S7V+R^m%  
条件: C和IP头文件 fW@-,5{  
配置文件：无 W-67+1  
位置: http://agape.trilidun.org/hack/network-sniffers/linsnifferc >FL,Bb5 I  
安全历史: 无 slNr^ W  
注: 易于使用。但是lnsniffer需要完整的IP头文件，包括常常存储在/usr/include/net和 /usr/include/netinet的头文件，在编译前确保PATH变量包含/usr/include。 1NI"y9sz  
BS' xR~  
使用下面的命令来编译lnsniffer： t!S]lO4D  
Orh Gv  
$cc linsniffer.c -o linsniffer JYFSRy:|\@  
要运行linsniffer，使用下面的命令： &^F@VVX  
^p~?+Bu;  
$linsniffer 9&6rR8GaLb  
yTPM   
启动以后linsniffer将创建一个空文件：tcp.log来存储嗅探结果。 <{v8X4,~  
i`(gz\np  
在测试中我创建一个名为hapless的用户，密码为unaware。然后使用该用户来登录Linux服务器，并进行一些常见的用户操作。下面是进行的一次ftp过程： %3[BtM[ (  
q>H)!W/  
GNSS $ ftp 192.168.0.2 F54Wak;  
Connected to 192.168.0.2. 4=v]}dki"  
v'% P2!  
220 linux.test.net FTP server Wed Aug 19 02:55:52 MST 1998) ready. p7Yrc'ib  
IV[
Bu)'|  
Name (192.168.0.2:root): hapless 5mZB9YWe  
331 Password required for hapless. b*i"D2$oj  
Password: "=HL2 r}  
230 User hapless logged in. F^.of5b[Z  
Remote system type is UNIX. *WSTGh "q
 
Using binary mode to transfer files. xUxeC6(m:]  
ftp> ls -al I\yc7e,  
200 PORT command successful. X`YlWHP'  
150 Opening ASCII mode data connection for /bin/ls. x\3~_t^0  
total 14 <:SJ+U  
drwxrwxr-x 4 hapless hapless 1024 May 20 19:35 . [3,abw
 
drwxr-xr-x 6 root root 1024 May 20 19:28 .. jXbPUD$  
-rw-rw-r-- 1 hapless hapless 96 May 20 19:56 .bash_history C4 Z8!0KR  
-rw-r--r-- 1 hapless hapless 49 Nov 25 1997 .bash_logout  &B%x.!D  
-rw-r--r-- 1 hapless hapless 913 Nov 24 1997 .bashrc @XV_0KO  
-rw-r--r-- 1 hapless hapless 650 Nov 24 1997 .cshrc (X,j )?  
-rw-r--r-- 1 hapless hapless 111 Nov 3 1997 .inputrc 1#$f7/]  
-rwxr-xr-x 1 hapless hapless 186 Sep 1 1998 .kshrc w 1jI
l
0  
-rw-r--r-- 1 hapless hapless 392 Jan 7 1998 .login b<3yVN0p  
-rw-r--r-- 1 hapless hapless 51 Nov 25 1997 .logout z]Hk7m  
-rw-r--r-- 1 hapless hapless 341 Oct 13 1997 .profile ]8 I7k7,S  
-rwxr-xr-x 1 hapless hapless 182 Sep 1 1998 .profile.ksh <xQ6.|K0h  
drwxr-xr-x 2 hapless hapless 1024 May 14 12:16 .seyon XuQ3m!jW  
drwxr-xr-x 3 hapless hapless 1024 May 14 12:15 lg ~ 3Z`q!&  
226 Transfer complete. bve#k([G  
ftp> ls t&l/I|~  
200 PORT command successful. ; gC#1q  
150 Opening ASCII mode data connection for /bin/ls. #@Sw7, -&  
total 14 3W#<LL  
drwxrwxr-x 4 hapless hapless 1024 May 20 19:35 . "pABvo  
drwxr-xr-x 6 root root 1024 May 20 19:28 .. 5Dl#Vau>  
-rw-rw-r-- 1 hapless hapless 96 May 20 19:56 .bash_history ;^Qd}GwyB  
-rw-r--r-- 1 hapless hapless 49 Nov 25 1997 .bash_logout E $<qr  
-rw-r--r-- 1 hapless hapless 913 Nov 24 1997 .bashrc ;6gv|HW@,a  
-rw-r--r-- 1 hapless hapless 650 Nov 24 1997 .cshrc ) ?J!p,iT  
-rw-r--r-- 1 hapless hapless 111 Nov 3 1997 .inputrc Ll_.x..m  
-rwxr-xr-x 1 hapless hapless 186 Sep 1 1998 .kshrc yYc~CHyRn  
-rw-r--r-- 1 hapless hapless 392 Jan 7 1998 .login \{!Ww+r  
-rw-r--r-- 1 hapless hapless 51 Nov 25 1997 .logout OP<D3<C  
-rw-r--r-- 1 hapless hapless 341 Oct 13 1997 .profile 2uc|Vx~<  
-rwxr-xr-x 1 hapless hapless 182 Sep 1 1998 .profile.ksh :v/Y(Q*H  
drwxr-xr-x 2 hapless hapless 1024 May 14 12:16 .seyon _`IG%&h^0  
drwxr-xr-x 3 hapless hapless 1024 May 14 12:15 lg +*(}Nh/Y  
226 Transfer complete. $|~2Nk1[  
ftp> ls -F Oh,/hQ a}<  
200 PORT command successful. ; q,@m P8  
150 Opening ASCII mode data connection for /bin/ls. K,! `V  
total 14 .&R]rUy=N  
drwxrwxr-x 4 hapless hapless 1024 May 20 19:35 ./ Kj&L  
drwxr-xr-x 6 root root 1024 May 20 19:28 ../rw-rw-r-- 1 hapless hapless 96 May 20 19:56 .bash_history  <xGk  
-rw-r--r-- 1 hapless hapless 49 Nov 25 1997 .bash_logout dS/Q$qTC}  
-rw-r--r-- 1 hapless hapless 913 Nov 24 1997 .bashrc 4qBU"}p7  
-rw-r--r-- 1 hapless hapless 650 Nov 24 1997 .cshrc VElS8b!:  
-rw-r--r-- 1 hapless hapless 111 Nov 3 1997 .inputrc ?Csx|+*0  
-rwxr-xr-x 1 hapless hapless 186 Sep 1 1998 .kshrc* ~SQ!XB=W  
-rw-r--r-- 1 hapless hapless 392 Jan 7 1998 .login y@Rb #'  
-rw-r--r-- 1 hapless hapless 51 Nov 25 1997 .logout }nZVFDj  
-rw-r--r-- 1 hapless hapless 341 Oct 13 1997 .profile Kr ]E8d`G  
-rwxr-xr-x 1 hapless hapless 182 Sep 1 1998 .profile.ksh* Lp.4oWi+  
drwxr-xr-x 2 hapless hapless 1024 May 14 12:16 .seyon/ 4: Z)AYd  
drwxr-xr-x 3 hapless hapless 1024 May 14 12:15 lg/ O46[Ovp  
226 Transfer complete. 'zHsgEu  
ftp> cd lg V/yUV>`  
250 CWD command successful. k\v#7  
ftp> ls -F }yI>&0D  
200 PORT command successful. eS4Q'Wk  
150 Opening ASCII mode data connection for /bin/ls. =$5';4,G&  
total 8 qbZ Hb&}  
drwxr-xr-x 3 hapless hapless 1024 May 14 12:15 ./ ~+J2f>&LcO  
drwxrwxr-x 4 hapless hapless 1024 May 20 19:35 ../rw-r--r-- 1 hapless hapless 70 Aug 22 1998 lg3_colors OBSV2JTVl  
-rw-r--r-- 1 hapless hapless 629 Aug 22 1998 lg3_prefs Ar+H9{NO  
-rw-r--r-- 1 hapless hapless 728 Aug 22 1998 lg3_soundPref E`o^ZVq  
-rw-r--r-- 1 hapless hapless 2024 Aug 22 1998 lg3_startup 3u(UOt-L  
drwxr-xr-x 2 hapless hapless 1024 May 14 12:15 lg_layouts/ ^==hA^B  
226 Transfer complete. $1R @zW^  
ftp> cd lg_layouts .V_] 4-B8=  
250 CWD command successful. Z@i<!  
wJba m-  
这是一个典型的用户操作过程。现在我们看看linsniffer产生的嗅探结果: 6E]W*B6;R  
)k)_1#Lt  
gnss => linux.test.net [21] /S(=^Hz@  
USER hapless Tx@HqI}kR  
PASS unaware H#84  
SYST %Fg}* 0  
PORT 172,16,0,1,4,192 :; 12qGx  
LIST -al ]t {tNn
F  
PORT 172,16,0,1,4,193 @pA@2[a\  
LIST o>(Icc|`P  
PORT 172,16,0,1,4,194 k p%hQ4  
LIST -F 4=,-,5g8"  
CWD lg S on`n  
PORT 172,16,0,1,4,195 U"KZj-   
LIST -F R["4|SBr  
ktX\(,Z K  
输出的内容是很直观的。首先它记录这是从GNSS到Linux主机的FTP连接： nZmQ$ g5f  
Hv|G@M/  
gnss => linux.test.net [21] 6 2sM17  
^ 'VKWA  
然后，linsniffer捕获了hapless的用户名和密码。 Q#|bmGW  
8=}$32h  
USER hapless 9=YXw| -  
PASS unaware .61rYsk  
m 4c' *  
最后，linsniffer记录了hapless使用的每一个命令： n@x? &K  
m/at
IBN +  
SYST >3ps$  
PORT 172,16,0,1,4,192 V4g&lzfs[  
LIST -al 0g_2M9  
PORT 172,16,0,1,4,193 UP3FG1$  
LIST Y%<;7!&  
PORT 172,16,0,1,4,194 ngh7nt7*  
LIST -F "PIy:;gQS  
CWD lg r2^8oOK=C  
PORT 172,16,0,1,4,195 9Wb/>q<DU:  
LIST -F )Z-fP7F~  
[c804NvV  
输出结果非常简介并且非常适于窃听密码及记录常见的活动。但是不适合于进行更加复杂的分析。这时候你也许会需要linux_sniffe。 yQn3D  
QQq&B!  
linux_sniffer &<{YWup*  
&
@IwMo g  
linux_sniffer提供相对更复杂的探测结果。