In this video, I'm going to show you multiple attacks, I'm firstly going to show you how to poison ARP caches
on PCs, ARP or address resolution protocol is a fundamental building block in networks today.
Basically, it allows devices to learn the Mac addresses of other devices on an Ethernet network.
Once we've poisoned the ARP cache of a device, we're going to implement a man in the middle attack where
we view the passwords and data sent between multiple devices in our network.
I'm going to show you how to capture usernames and passwords, as well as data sent between a router
and a host in our topology
but rather than just talking about this, I want to show you practically how this actually works.
I'm going to show you using Wireshark captures how ARP works, how ARP caches are then poisoned using
AACAP and how we can implement a man in the middle attack using a virtual network running in this example
in EVE-NG.
Disclaimer as always the information shared here is for educational purposes only.
Don't use the information that I'm sharing here to go and hack a public network that you don't have
permission to hack.
Only hack networks that you have explicit permission to hack or test networks such as the one that I'm
showing you here in this example I'm using even in the cloud, but even allows you to virtualize networks
on your laptop.
It's great software.
I'd recommend that you use EVE-NG or GNS3 or Cisco VIRL if you want to learn how to build
networks and virtualize networks on your laptop.
So let's look at this practically so on the Windows 10 host.
What does the ARP cache currently look like?
So firstly, IP config shows us the IP address of this host.
It has IP address 10.1.1.100 default gateway is 10.1.1.254, which is the router
in this topology.
So here's the router,
it's a Cisco router, but you could use any router if you prefer.
Show IP interface brief.
This is the IP address of the Gigabit 00 interface, and that is the interface connecting the router
to the switch. In our topology
the router has this Mac address on gigabit 00.
So show interface Gigabit 00 shows us that the Mac address is 5001.0009
followed by 0000. On the Windows 10 host ARP-A,
this is the Mac address associated with that IP address.
In other words, this device has learnt the Mac address of the router correctly 50-01
followed by 00-09 followed by 00-00.
That's the Mac address of the router.
Now, to prove the point, I'm going to delete the ARP cache on the PC
but before I do that, let's run Wireshark so that we can see what's going on.
I'm going to run Wireshark on Ethernet 0.
That's the Ethernet interface connecting the PC to our network.
So here's our Wireshark capture, we see a lot of traffic, but I'm going to filter for ARP. Windows
10 send a lot of traffic into the network.
So what I'm going to do is delete the ARP cache
and what you'll see is ARP traffic has been generated in Wireshark.
We can see that this device with Mac address, starting with 50-01, is sending a broadcast
into the network.
This is an ARP asking who has IP address 10.1.1.254 Tell 10.1.1.100.
OK, so ipconfig/all,
shows us that this PC, our Windows 10 host has this Mac address, the local PC with this Mac address is
sending a broadcast into the network asking for the Mac address of 10.1.1.254.
Notice the target Mac address is blank.
It's a bunch of zeros.
That's because the PC doesn't know the Mac address of the router.
It's asking for the Mac address of the router, basically saying who has this IP address?
The router then replies back, saying, I have this IP address and here's my Mac address
and that's sent as a unicast back to the PC.
So basically, the PC sends a message into the network.
It's a broadcast that's flooded by the switch.
The router replies back with its Mac address, it's a unicast that gets sent to the PC so that the PC
can learn the Mac address of the router. Now on the switch
this is a Cisco switch, show Mac address table.
We can see the Mac address of the PC and the Mac address of the router.
Those Mac addresses have been learnt by the switch.
The switch currently hasn't learnt the Linux host Mac address yet.
We can see that the PC is on Gigabit01 and the router is on gigabit02 those Mac addresses
will learn to dynamically.
So PCs on this interface, router is on this interface.
So on the Kali Linux host, ifconfig
pipe that to more.
IP address of Kali is that Mac address is this, I'll ping the default gateway
just to generate some traffic, cancel that, on the switch show Mac address table.
The switch has now learnt the Mac address of the Kali Linux host.
OK, so this is where it gets interesting in Kali Linux, I'm going to go to applications sniffing
and spoofing and select ettercap.
I'm going to go to sniff, I'm using unified sniffing because I only want to sniff one interface, which
is Ethernet0, so unified sniffing has started.
I'm then going to go to hosts, scan for hosts.
So we're going to scan for hosts in the network.
It's scanned
for 255 hosts in our subnet noticed two hosts have been added to the hosts list, ettercap has discovered
two hosts in our network.
We can view those hosts by going to hosts hosts list and we'll see our two devices, 10.1.1.100
is the Windows PC, 10.1.1.254 is our router.
So I'm going to add the router to target 1.
I'm going to add the Windows host to Target 2.
On the Windows host, you'll notice a bunch of our broadcasts have been sent out from 10.1.1.1
56, which is our Kali Linux host.
Once again, ifconfig
pipe more, this is the IP address of the hacking host.
Now that we've discovered the hosts in the network and specified our targets, next step is to implement
a man in the middle attack and we're going to implement ARP poisoning.
We're going to sniff the remote connections and click OK, so we are poisoning these two devices,
10.1.1.254 in group 1 and 10.1.1.100 in group 2. Back on the Windows host
the device is receiving ARP messages stating that this IP address is using this Mac address.
On the router show interface Gigabit 00.
This is the Mac address of the actual router, 5001.0009 note that is different
to what we're seeing here.
This is 5001 0002 not 5001 0009.
So on the Windows host, if we look at the ARP cache, so arp-a.
This IP address is using the same Mac address as this IP address, which is our Kali Linux host.
So on, Kali, let's start Wireshark so that we can sniff traffic.
We've implemented a man in the middle attack now because when traffic is sent to the router, it's actually
going to be sent to the Kali Linux host. On the switch once again
show Mac address table.
This Mac address is the Kelly Linux host Mac address found on Gigabit 00, the router using this Mac
address is actually found on gigabit 02.
So the traffic is going to flow to the Kali Linux host and then to the router.
So on
Kali I'll start a
wireshark capture on Ethernet0.
We can see a bunch of traffic, but let's filter for telnet.
Now, in this example, let's assume that the administrator made a bad decision and enabled telnet on
the router.
So when I open up PuTTy, I'm going to use Telnet and I'm going to telnet to the router 10.1.1
254.
I'm prompted for a password, which I'll enter and login.
The font is very small, so I'll change that.
So change the appearance of PuTTy,
make this bigger.
So there you go, what you'll notice is I was prompted for a username and password, which I entered
and I've been able to log into the router.
I'll type enable to go to privilege mode and enter my password, so I'm now in privilege mode on the router
and if I type something such as show run, I'll see the running configuration of the router displayed
on the Windows computer.
However, all that data has been captured by the Kali Linux host, traffic from 10.1.1.100 the
PC going to the router scrolling down, we can see a password prompt as an example
and then we can see the password c i s c o it's not very easy to see that, however, so I'm going to
right click here and go to follow TCP stream
and what you'll notice is the password is displayed.
So there's the original password.
In other words, the telnet password.
Here's the enable password and here's the full running configuration of the router displayed on the
Kali Linux host.
I've been able to capture the entire telnet session between the host and the router because the traffic
is going through the Kali Linux host.
We have poisoned the ARP cache on the Windows computer.
Now, the same thing is true if we used HTTP on the Windows PC.
So I'll open up a browser and
browse to the router 10.1.1.254 and log in with my password of Cisco, Cisco.
Back in Kali
I'll search for HTTP.
Now the Windows host is sending HTTP traffic not just to the router s fault for IP address equals 10.
1.1.254.
So we see traffic from the Windows PC to the router and not to other destinations on the Internet.
So scrolling down.
We can see that the router is saying the session is unauthorized, so the PC is now sending authorization
information, including the user name and password to the router.
So we've been able to capture the user name and password because it's sent in clear text from the PC
to the router.
You shouldn't be using clear text protocols in your network today.
So in other words, we shouldn't be using telnet.
We shouldn't be using HTTP.
We should be using encrypted protocols.
But I've been able to capture the username and password of the router through Telnet and HTTP by simply
implementing an ettercap arp poisoning attack.
Now, a lot of Cisco engineers will back up the configuration of a router using TFTP, so we'll use
a command such as copy running config TFTP.
And in this example, I'll specify the Windows host as the TFTP server, before I press enter there on the
windows host
I'm going to run TFTP 32, which is a TFTP server, so that TFTP server is now running on the Windows
PC.
On the router, I'll press enter now to back up the configuration to the TFTP server.
I'm getting permission denied there, so let me try that again.
and I'll specify different file name.
Back on the TFTP server, here's a problem, I'll specify security is none.
Once again, that's not necessarily a good idea.
I'll specify the desktop as the destination folder and click, OK.
So try that again, it's a copy running config TFTP specify the type to be server specified the file
name and notice you can see the configuration was copied successfully.
Now, that's OK
but back on a Kali Linux host I'll filter for TFTP
and you can see the file name there.
There was a TFTP error.
So what I'll do actually is scroll all the way to the end so that we see the successful right.
Here's an acknowledgment of a block of data, TFTP sends data in blocks so the sender will send a block
of data.
The receiver will send back an acknowledgement.
So there's an acknowledgement of part of data.
Here's the actual data from the router to the TFTP server.
I'll right
click on the data and show packet bytes.
There's the last part of the routers configuration.
So that's OK, but let's see if we can get some passwords, so scrolling right up to block 1, passwords
are at the top of the router configuration.
So here's block 1 sent from the router to the TFTP server.
Right
click and select show packet bytes, as you can see there
that's the enable password of the router.
We can see the entire router configuration by simply looking at the blocks of data.
So here's block 2 look at that block of data.
Here's the loopback interface IP address, there's gigabit00 IP address.
Now, it's once again bad practice to use clear text protocols in networks today, you should be using
encrypted protocols wherever possible.
You can also stop this kind of nonsense in networks today by implementing dynamic ARP inspection on
your switches.
I'll show you how to stop these kind of hacks in subsequent videos, this videos getting too long.
Now, this is a troubleshooting hint.
If traffic is not being forwarded by your Kali Linux host type, this command, this command forwards
IP version 4 traffic.
So it basically allows the Kali Linux host, well, any Linux host to receive traffic and then forward
it on when destined for another host.
So it basically acts as a router, receives traffic for another device and basically sends it back into
the network.
So if you have issues forwarding traffic, then use this command.
OK, so this video I showed you how to implement a man in the middle attack using ARP poisoning, using
the application ettercap, which is available in Kali Linux.