In this demo,
we're going to perform a man‑in‑the‑middle attack by sniffing the
network for credentials using ARP poisoning.
We will then use the credentials we gather to establish a
foothold in the network to escalate our attack.
We are going to start off on our Windows attack system,
which has Cain installed on it, and it's connected to the Globomantics network.
Let's go ahead and open Cain. For this attack, we will take
advantage of both the Network and the Sniffer tabs.
We will start with the Network tab.
This feature of Cain allows us to perform some
enumeration activities, as well as take advantage of the
Abel tool in the Cain and Abel suite.
Let's start by expanding out the Microsoft Network to view the Windows
systems connected to the network. Click on the Microsoft Network, and then
expand out the WORKGROUP, and click on Computers,
which will show a list of available systems to target.
You will see our attack system is included in the list
as we are connected to the network.
From here, we can explore some of the systems we want to target.
We're going to click on the GLOBO‑PC‑01 and expand Anonymous,
which will give us the ability to review groups and users set up on the system,
among other information that we can use to gather
information to exploit the system.
What you will see, however,
is that when we click on the information to enumerate, we are prevented
to do so because we are unauthorized on the system.
To really take advantage of this feature and further our exploit,
we will need valid credentials on the system.
So let's start our man‑in‑the‑middle attack to get
some credentials which we can use.
Let's go ahead and click on the Sniffer tab. Here we'll see a list
of all the systems on the network from our scan.
This will allow us to get more information about the
systems so we know which ones to target.
Go ahead and highlight all of them by clicking on the top and
bottom entries while holding the Shift key and right‑click
and select Resolve Host Names.
This will give you a better idea of the systems to target. The
Globomantics intranet server looks interesting.
Let's target traffic to and from that system. Click on the ARP tab and then go
up to the blue plus sign to see the devices to initiate the man‑in‑the‑middle
attack against. Click on our intranet system first.
That will highlight our target.
Now in the left box,
you can choose the second system to perform the ARP poison against. Let's
choose the GLOBO‑PC‑01 system we were looking at earlier.
Now you will see all choices are added as an entry to perform ARP poison
against. Click on it and select the yellow and black ARP poisoning button
from the toolbar next to the Sniffer icon.
We have begun to poison our systems so that any traffic between the two
systems will now be routed through our attack system and Cain.
Now I'm going to swap over to our GLOBO‑PC‑01 victim system
to simulate a connection to the server, which houses the corporate intranet site.
I'm going to go ahead and open a web browser as the victim and
navigate to the corporate intranet site like I normally do every
morning. And because this is an intranet site,
I am prompted for my credentials.
I'll enter them here with the username of user1 with a
very secure password of password.
And here we go.
Just like normal, the corporate intranet site opens, and I am none the
wiser that anything out of the ordinary has happened.
Let's close our victim's browser and head back over to our attack system to
assess the damage we have caused. Back on our attack system, you'll see our
ARP poison attack is still ongoing with an increased number of packets between
the two victims being collected by Cain.
I'm now going to click on the Passwords tab below, and you will see that we
have a number of HTTP passwords that have been captured.
We will click on the HTTP and see what we have gathered. Here you
will see our connections between our victims and columns
highlighting both the username and the password that our victim
submitted to the corporate intranet server.
Let's now take these credentials back to our Network tab
to enumerate the GLOBAL‑PC‑01 machine.
We will click back on the Network tab and expand out our network.
However this time, we will right‑click on GLOBAL‑PC‑01
system and click the Connect As option.
We enter the credentials we gathered from our man‑in‑the middle
attack with the username of user1 and the password of password and
click OK. Now when we start to enumerate,
we'll no longer get errors, but rather enumerate the victim system,
showing both the groups on the machine, as well as a number of user
accounts which we can harvest credentials from. This will end our
demo where we learned how to use a man‑in‑the middle attack to gather
credentials that we can use to establish a foothold in the network to
escalate our attack.