‫So look at the page seen in the slide, this is the manual page of the Mac of command.
‫Mecca is a command line tool mainly used to flood the switch on a local network with random Mac addresses.
‫So as I mentioned before, when the Switch receives a frame, it creates a new entry in its Mac address
‫table for these Mac addresses.
‫Once the Switch is Mac, address table is full and it cannot save any more Mac addresses, it generally
‫enters into a fail open mode and it starts behaving like a network up.
‫So let's see.
‫Mac of command in action.
‫So here's a network that I created in G and S3.
‫Well, the IP addresses are different from the one that I created in the previous lectures, but not
‫to worry.
‫It's completely identical with that network.
‫So in addition, I've added some other VMware VMS, OWASP Broken Web applications and Metasploit BBL
‫in the same way with Carly now just a little word of caution while you're adding a VMware VM to Ghana's
‫three network.
‫Do not forget to create a new custom network mode such as VM Net two, because all VMS need a separate
‫custom network mode.
‫Remember that?
‫OK, so now I'll go to Carly, since Carly is a part of the Jeunesse Three Network.
‫Its network settings is custom, so it's not in that mode right now.
‫Have a look at the IP address using if config.
‫OK, so it's in one nine two one six eight one zero zero 24 IP block.
‫So now check the entire network.
‫I go over to the other teams and look at the interface configurations.
‫These are the IP addresses of all the VMS.
‫Now go to college and ping them.
‫The results are pretty good.
‫We got the reply packets for Ping request.
‫So now I open another terminal screen and scan these two VMS and see the open ports and running services.
‫So I'll simply use the map command with the IP address only, so it'll be a sin scan and the top 1000
‫ports will be scanned.
‫Here are the results.
‫Ten not one one has nine open ports and ten point one two has 23.
‫And as you see here, Telnet port of the one nine two one six eight one zero one two is open.
‫So let's go to the VRMs.
‫11:50 is Metasploit Bill and 10. 11 is OWASP BW.
‫Now we know the Telnet service is running on Metasploit, so to create some traffic and let the switch
‫fill the Mac address table.
‫I'll start up a Telnet connection from OWASP, BWR to Metasploit about.
‫Type Telnet and the IP address of Metasploit will enter the username and password, which are already
‫given as a welcome message here.
‫And we got the session.
‫OK, so we can exit now.
‫Now I'll go to the console of the switch and type show Mac address table dynamic to see the dynamic
‫records of the Mac address table.
‫Now here there are six Port and Mac mappings for now.
‫Run the command again.
‫And now we have two rows.
‫So it seems by the look at this, that the Mac address table aging is 10 or 15 seconds.
‫OK, you ready for this?
‫This is the time of Max letting.
‫So now I'm in a terminal screen oncology.
‫Have a look at the manual of Mac of Command first, so type men.
‫Mac of and hit at her.
‫Makeover is a tool that's used to flood the local network with random Mac addresses.
‫And here are the options.
‫I to identify the network interface, to attack and to specify the number of packets to send D to specify
‫the destination systems, IP address, etc..
‫So let's create the command.
‫Of course, the first command I'll send is Mac of.
‫I the interface it's used to attack will take that in as easy zero d, the destination, the Ether Switch
‫router.
‫Now we're ready to run a command.
‫So hit enter.
‫And the Mac flood started and Mac of sends tens of packets and seconds.
‫Now, let me go to the Ether Switch router console and look at the dynamic Mac address table again.
‫You can call the last command by using the up haruki.
‫And as you see, there are a lot of rows for our fast Ethernet one zero port, which is used for calling.
‫So while Markov is running, let's run Wireshark and try to listen in to the traffic on the telnet of
‫Kylie's own network interface.
‫Now, to see only to tell them that traffic type telnet in the filter box and click the blue button
‫next to the box.
‫OK.
‫No Telnet traffic for now.
‫Now go back to the old BW, AVM and Telnet to the Metasploit VM again.
‫Telnet the IP address of Metasploit able username and password.
‫Run command.
‫OK, so back to Cali.
‫You see the town that traffic here.
‫Collie is neither the source of the traffic nor the destination, it receives the tail in that traffic.
‫Now this is a typical in her behavior to send packets to each node so we can say that our switch is
‫behaving like a hub now, just like we predicted.
‫So let's go ahead and stop Wireshark and the lack of command using control C keys, you can do that.
‫These are the Telnet packets.
‫Since Telnet is a clear text protocol, by default, we can see the payload as well as the metadata.
‫We can see every character in a different packet.
‫So select one of them, right click follow and select TCP Stream.
‫So the right characters here are client packets, the blue characters are the server packets.
‫Here is a credential username and password.