Hi, and welcome back to Section five Blackhead Tricks with Net Cat.
In this video we're going to talk about rogue tunnel attacks.
In penetration tests,
we have some obstacles that dute the penetration and
a way to bypass them is to explore some misconfiguration in the firewall
or compromise another system inside the network that has
high permissions,
and then avoid the firewall and continue in the attack in one
attack scenario. When the network administrator knows that there is uh,
some external IP attacking the network,
a rule can be created to deny all traffic originated from this ip.
The Unix world,
a very popular software used as firewall to have a control of
the out traffic is called IP tables.
IP tables is the base firewall used in the UNIX systems programming
in C language, which allows blocking,
redirecting and other operations when you receive package and our
operation is through the command line.
If we have a firewall block in any connection to a target host with a specific
IP coming from an attack host,
a good option is to exploit another host in this network and use it to
four four wall all traffic,
avoiding the firewall rules to attack the target host,
and then creating a tunnel with net CAT between the target
host and the exploit host as the connection
between net CAT in the seven mode and client mode.
As we saw before in this course,
the common IP table is possible to use some options to get more details.
For example,
the option b l to get a list of rules,
the option Z to get more detailed information in variable mode
and the option N to display IP address in
port in numeric format.
Another possibility is to use attack called arpc
poisoning or ARP spoofing.
ARP means address resolution protocol and is used to
determine which make address correspond to a particular ip,
address a device,
send an a broadcast packet to the network to
every device on its broadcast domain in hopes that correct
device will respond. We have two packets in the A procedure,
ARP request, and ARP response.
This attack works by saying the art messenger to a switch
or a router with fake me address.
This is useful to intercept the traffic of another host using
this attack.
This spoofing will change all communication designated to the target host
that has a block into the avoiding any connection from the attack,
for example,
and will be passed to the exploited host that we have control.
We have the common arc with some options, for example,
v to our post mode and to get numerical addresses and
a to shows entirely of the specific host.
Here we have Kylie Linux environment and you see some operations using
the IP tables and the ARB command.
So here I have the option IP tables
and for a simple call for the software is common,
it's possible to see the version of the IP tables. We no common specify.
If we input some options, for example,
IP table and the option V N L for example,
and we, we have to get the root access.
So we use pseudo for this,
and now it's possible to see more informations about the rules that are present
in this firewall.
If I clean this screen and use
more detailed information for line number for example,
it's possible to get more information
in a number of lines here. For example, 1, 2, 3.
This is more organizing mode to get information. What we are seeing in,
in on screen, we have some,
some rules for what we have for input for forward, for example,
or output. And we have some specific rules.
For example, here for the input,
we don't have any rule for any specific ip, for example.
So all the hosts are able to send information and
we don't have any blocks, for example,
but we have some information to docker.
Docker is a technology that's possible to like to
visualize a small quantity of software to run
and to deploy some software system. For example,
if we are developing a tool, for example,
we have to deploy this tool on the internet and we have
to signalize every requirement to store and
then run our software. For example, using Docker,
we can create image of this tool with all the requirements,
for example,
and any user can download this image and
run this image in a docker. We have docker client, for example,
like a player,
and this docker will instantiate iage from
I image to a con like a container running our software.
So this is a very interesting way to distribute our
software, our system, for example,
and any container that's I instantiation of ih for example,
any container can communicate with other containers.
So this is a, I call a Docker network.
So here I have a docker stolen in my
machine here. This is not the scope of our course here,
but for example,
if I use like this one here, I, I can show my, the,
the version running, uh, install in my machine here.
So at the moment of the installation of Docker,
we have some rules by the full and to slight synchronization
of diesel installation for the docker.
So we have some specific rules for Docker here, okay,
but for any external ip,
we didn't have no IP rule here,
but as we saw before, if a host is blocking,
if we have a firewall, for example,
if we have IP rule for a specific external ip,
we can exploit another host in this network.
And then for this new machine exploited,
we can curate a tunnel is a, a net cat common as we saw before,
the server and the client and exploit a target host.
So this is possible to create this, this tunnel or,
or disconnector as we saw before in the course.
It's only a connection between two hosts using netcat. Okay?
Our other option that we saw was using a art as we
saw a means address resolution protocol.
So is used to get more information about uh,
one device and on the end and other devices. So for example, we have uh, FU
common arb here, and this is my, this is the,
we have a host that is running my here
and for the arp we have some informations about the ip,
the MAC address, and the IP from the, from some of the devices. For example,
let me use the option in to get the
ip. So I have this host here in my network.
This is the My gateway. My gateway here.
I know that from this IP here I have this MEC address.
Okay? So we have like a arc table here
to identify, hey, this device here has this ip,
this address the interface here
and we have some information.
So the attack here that we saw arc is spoofing,
is to say, Hey router,
you have this IP here and this me address,
but I will masquerade the me of my device, my host,
and I'll use ARP spoofing and I will pass another
IP for this same MEC address.
So it's like we have two make address the same me
address but the different ips.
So I'm spoofing this me address.
So my information arrive from a device, the packet,
the other information will be sent from both devices.
So these are way to get information because I'm spoofing a MEC
from another device. For example, here we saw that in our ARP table,
we have only one information from the full gateway in the final
off IP one 15.1, okay?
In this IP here, in this address here,
but in the same machine, in the same network.
Here I have another host is a Microsoft Windows machine
and the IP of this address of this host
and means 15.
So I'll use a common pinging like this to ping
this machine. Okay?
So pinging and the IP of this host
and they're pinging this host here. Okay?
And now if I use the same common ARB dash n,
now I have a new host in my arc table.
This is my new IP from this new device and I have
this new MEC address from this host.
So my, A table was in this version here,
only one, only containing one host.
Now I have this,
a new host here and they are poofing work
like this. Like we have, for example, I have a new, uh,
they say machine that's in Mac address.
I have this host host and when I use this attack,
I will have another IP here, but using the same Mac address.
So that's mean that all the information that we send for this Mac address will
be received in this host and the new host here.
So this is another option to create
like a rogue tone tunnel to spoofing and to get information
when we have this situation,
a firewall blocking external ip, but we have
possibility to exploit other hosts in this network
and we can use this booth attack or we can use ARP
spoofing or ARP cache poisoning or creating,
trying to creating a tunnel between the target host,
host, and this exploited host. In this video,
we saw how it's possible to avoid obstacle in the network to have
access to the target host. In the next video,
we'll take a look at back doors and shell, I hope to see you there.