In this video I'll show you how to completely destroy Cisco Enterprise Switch. We’ll attack Cisco Discovery
Protocol or CDP using Yersinia.
This is an extremely easy Denial Of Service (DoS) attack to launch on any Cisco Device using just a Linux
Machine. The protocol we are going to exploit CDP is enabled on any Cisco device by default.
Let me explain to you in just a few words what CDP is. Cisco Discovery Protocol or CDP is a Cisco proprietary
Layer 2 protocol that runs on Cisco devices and enables networking applications to learn about directly
connected devices nearby.
This protocol facilitates the management of Cisco devices by automatically discovering them and determining
how they are configured. Network engineers use CDP to discover the Network Topology.
For example if you log into a switch or a router and execute show cdp neighbors you’ll
see directly connected devices
that are also using CDP.
Ok. Let’s exploit CDP!
This is the topology I’m going to use: My laptop runs Windows 10 and Linux Mint in a VM.
This is the Linux VM. It’s connected directly to the Cisco Switch using a wired Ethernet connection.
This is the switch I will attack from the Linux Machine!
You'll see many other tutorials that tell you to use Kali which by the way is a great Linux distribution
but it's not necessary.
You can use any Linux distribution you prefer. Using Yersinia
I'm gonna flood the switch with thousands of CDP packets.
This will freeze the operating system running on the switch which will effectively block anyone from
remotely managing the switch. With the CDP continuously processing and use CDP packets
the switch will start to drop network traffic.
Moreover the switch will start to flood incoming frames out all ports, just like a hub.
This happens when the Switch MAC Address Table fills up entirely and a hacker could open up a packet
sniffer like wireshark and capture network traffic and sensitive data.
Let's take a look at the switch CPU and the CDP table before starting the attack. show ctp neighbors
There is no neighbor!
There is no other Cisco device directly connected to the switch and show process cpu sorted | include
CPU in upper case letters PID Runtime | CDP protocol
Take care to use the exact case you see in this example.
Okay.
And we notice that the CPU utilization for 5 seconds is 5% and CDP consumes only 0.32%
We can say that the CPU is idle; perfect ! Let's start the attack on the switch.
As I've already said I'm going to use Yesenia which is a framework that performs layer 2 attacks. It
takes advantage of some weaknesses in different network protocols.
By the way Yersinia Pestis
is the name of a bacteria, the bacteria that causes plague. Yersinia can be easily installed on any
Linux distribution like Ubuntu or Linux Mint because it belongs to the standard repositories. Let's install
Yersinia! To do that and to launch the attack
you need a non-root user with sudo privilege: so sudo apt install yersinia the user's password.
Okay sorry, it'
install. In this case Yersinia is already the newest version.
I'm gonna start at the Gui as root: sudo yersinia -G
- G option, written in upper case, makes Yersinia to start a graphical session.
This is the GUI of yYersinia!
There is also a command line tool available; if you prefer to run the attack from a Linux machine without
a graphical interface like say you are connected using ssh to that Linux machine you should use
Yersinia in command line. We notice that the attacks are implemented for the following network protocols
CDP, DHCP, VLANS or dot1q, DTP, MPLS, VTP and many more! I'll click on lunch
attack and in CDP tab, I’ll select Flooding CDP Table and then
OK
Yersinia
immediately starts flooding the switch with hundreds or thousands of CDP frames per second!
Now let's return to the switch to see the damage we have done. By the way
this is a console connection to the switch.
This is not a network connection.
Let's see the CDP neighbors.
So show cdp neighbors; okay.
There are hundreds of bogus devices all originating from Yersinia.
There are too many fake devices.
Let's take another look at the switch
CPU utilization, so the same command
I've already executed before starting the attack; okay.
This is very nice.
We notice that CPU utilization is 99%.
Ok. The Switch CPU is done. I've just shown you how to break a thousand dollar switch in just a few seconds
using Linux and free software like Yersinia. I am stopping the attack list attacks and stop and I'll
check the CPU utilization again; okay!
Now the CPU utilization is only 10%
and 5 %
In the next lecture I'll show you what countermeasures you can take as a network administrator to
prevent such an attack.
See you again in two seconds!