This is one of multiple videos where I'm showing you how to hack networks using Kali Linux.
In previous videos, I showed you how to download and install Kali Linux on a Windows 10 computer using
a pre-built image that you can download from Kali.org.
I also showed you how you can hack Cisco Networks when a switch is badly or poorly configured.
It's important that you configure networks properly.
Otherwise, it's very easy to hack networks such as Cisco Networks using Kali Linux. In this video,
I'm going to show you how easy it is to break networks that are badly configured.
We're going to use two protocols.
The first one, dynamic trunking protocol or DTP and the second one the VTP or VLAN trunking protocol.
We basically going to do things to the network by leveraging those two protocols.
I'm going to show you as an example how you can take devices off the network by sending VTP packets
to a Cisco switch using Kali Linux.
So we basically going to delete VLANs from a switch by simply injecting VTP packets into the network.
Kali Linux, in our example, will be configured on one VLAN will have hosts on a separate VLAN, but that's
not going to stop us.
We're going to use DTP to form a trunk with a Cisco switch, have visibility of a separate VLAN.
So Kali Linux will be in one VLAN, let's say VLAN 1.
Our hosts will be in a separate VLAN, let's say VLAN 2 will say in DTP packets to the switch so that
we have visibility of those hosts from our Kali Linux host
and then what we'll do is use VTP to delete VLANs automatically on a Cisco switch, basically removing
devices in one VLAN from the network.
All right, without further ado, let me show you how to hack Cisco Networks, at the moment on the switch
show interface trunk shows us that there are no trunk ports on the switch, show interface gigabit 0
1 switch port shows us that this port, there's the command again, this port is configured to use
DTP, but at the moment it's a static access port.
Administrative mode is dynamic auto, bad idea to use DTP.
Show run interface Gigabit 01 shows us that this port is configured with a default configuration.
That's a bad idea because what we can do is launch a DTP attack and enable trunking by simply selecting
that option and clicking
OK, Yersenia sees that there's a switch using access auto, which is what we saw
over here, dynamic auto, but in the output of the switch, we can see that the interface went down
and came up again, gigabit 01 went down,
now Gigabit 01 has come up
and if we use the same command again, show interface trunk notice trunking is now enabled on gigabit
01,
so Gigabit 01 is using 802.1q.
The VLAN 1 interface on the switch or the SVI or switch virtual interface came up because
we have an interface in that VLAN
but again, show interface trunk, native VLAN is VLAN 1 on this port, but trunking is now used using
802.1q mode is auto VLANs 1 and 2 are allowed across that trunk.
That means that Kali Linux will have the visibility of the PC in VLAN 2, show run interface gigabit
01.
No configuration on that port, but the MacBook is in VLAN 2, notice it's been configured in VLAN 2
and if we type show interface gigabit02 switch port, we can see through this command that that
port Gigabit 02 is configured in VLAN 2 it's currently acting as an access port.
Again, Kali Linux, which is supposedly in VLAN 1, will be able to see traffic sent by devices
in VLAN2.
Before we look at that, let's have a look at spanning tree again.
So show spanning tree, for VLAN 1
the switch is no longer the root
it has a cost of 4 to get to the root switch.
Gigabit 01 is its root port to get to the root switch, for VLAN 2 it's the root.
Notice Gigabit 01 and 02 are now designated ports, previously we only saw gigabit 02 in the output
bay.
So back in, Kali Linux, let's start Wireshark,
select capture start.
You can see that we are capturing a bunch of traffic on the network, including spanning tree.
Bunch of other traffic seen here.
But let's filter for DHCP.
On the MacBook currently has this IP address, I'm going to disable the Ethernet interface on the MacBook,
I'll enable it again so that it sends a DHCP request, notice
Kali Linux is seeing the DHCP information.
So it's seeing the DHCP Discover message, seeing the DHCP offer from the switch to that host, it sees the
DHCP request and sees the acknowledgment. This is on VLAN 2,
notice the IP address, 10.1.2.254, giving this IP address to the MacBook.
So the MacBook has been given IP address 10.1.2.2 and Kali Linux, which is supposedly in a
different VLAN, was able to see that.
On the MacBook, if I ping a nonexistent IP address, so ping 10.1.2.123 I'll
press enter on the MacBook
and filter for ARP.
Notice we can see ARP resolution protocol send the IP addresses, this looking for the Mac address of 10.
1.2.123.
Basically, the Kali Linux host, which is supposedly in VLAN, 1 can now see the traffic in VLAN
2.
Now, that's a broadcast.
If the host sent multicast traffic to, let's say, 239.1.2.3, the Kali Linux host
would see that ICMP traffic.
So here we go, we can see IP address 10.1.2.2 pinging 239.1.2.3.
This is multicast traffic.
I'll stop that ping.
Now, this is not doing much here
I'll show you in a subsequent video how I can, for instance, sniff OSPF passwords.
OSPF, which is a routing protocol, sends updates into the network using multicast
and Kali Linux will be able to sniff those routing updates and capture passwords as an example on the
OSPF updates.
So what we've seen thus far is a CDP attack, I've shown you DTP attack
and I've shown you spanning tree. Let's have a look at VTP, VTP is a really bad protocol,
generally, you want to turn it off.
It's actually been removed from the Cisco CCNA exam.
So in the next release of CCNA, it wouldn't be there. If I type show VTP status
the switch is in this domain called home.
It's currently acting as a server, configuration, revision number is 1.
It has six VLANs configured, show VLAN brief as an example, shows me that VLAN 1 and 2 exist
on the switch.
If I create another VLAN, let's say VLAN 3, show VLAN brief VLAN 3 has been created,
show VTP status configuration
revision number is now 2.
So in Kali Linux, let's send a VTP packet.
You can see it's learnt about the home VTP domain.
I'm going to launch an attack and let's delete a VLAN now before I do that, I'm going to plug in my
MacBook, so this MacBook is now plugged into the network in port 3.
So on the switch, we can see that Gigabit03 came up.
So show IP interface brief,
Gigabit 01, 2, and 3 are now up, I'll configure gigabit 03 as an access port
and put it into VLAN 2, so show run
these two ports are now in the same VLAN. On this MacBook
I'm going to enable DHCP it should get an IP address in VLAN 2
and there you go
10.1.2.3.
So on that MacBook over there, the small one ping 10.1.2.3 pings succeeds, so again,
that MacBook can ping this MacBook.
They are both in VLAN 2
but what I'll do now in Kali Linux is delete VLAN,
and the VLAN I'm going to delete is VLAN 2.
So on the switch show VTP status.
At the moment, configuration revision number is still to show Vilan brief.
We still have those VLANs.
I've seen some times that this doesn't work that well, but notice here VLAN 2 has now been removed.
I've noticed sometimes you have to create a VLAN to speed this up, but if I type show VLAN, brief
VLAN 2 is missing and that MacBook can no longer ping this MacBook.
I've basically removed these two devices from the network again show interface gigabit 02 switch
port.
Gigabit 02 the interface that that MacBook is connected to is configured in VLAN 2, but the
VLAN is inactive.
So basically I've removed these devices from the network.
If I have a look at gigabit 03, that's the port that this MacBook is connected to.
It's also in VLN 2,
so this command shows us that Gigabit 03 is configured in VLAN 2, but it's inactive.
I've removed the device from the network, essentially.
So if I create VLAN 2 again, so show VLAN brief, I've now got VLAN 2 back on the switch.
The pings should start succeeding once things converge and there you go, the pings are now succeeding.
Interface VLAN 2 has also come up on the switch so that MacBook can now ping this MacBook.
But again, I can simply delete that VLAN using Kali Linux.
Show VLAN Brief shows us that the VLAN exists, to speed things up,
I could simply create another VLAN, so let's create VLAN
5 type exit
and as soon as I did that, the ping started failing on the MacBook because things converged quicker
when you actually do something on the switch, like create a VLAN, otherwise you just need to wait
a while for for that VLAN to be removed.
So show VLAN brief,
VLAN 5 is there but VLAN 2 is gone
and if you want to really be nasty, you could simply say
delete all VTP VLANs. So at the moment we've got VLAN 1,3 nd 5, 1 will not be deleted
because it's a default VLAN.
These other VLANs will also not be deleted, but 3 and 5 should disappear
when this converges. To speed it up, I'll create VLAN 10 and type End, so show VLAN brief notice all
the VLANs have gone.
VLAN 3, 5, 2, 10 are all gone, that can basically break an entire network if you're using VTP.
So don't use VTP or set your devices too transparent.
So either disable VTP or use transparent, don't use server or client mode.
VTP is a bad idea.
Now there's some basic examples of how you can hack networks using Kali Linux.
Make sure that you understand how your protocols work in your network and how you can secure your network.
In other videos, I'll show you how you can protect your network from these kind of hacks.
But in this video, I wanted to show you what's possible using Kali Linux.