In this video I'm going to show you how to hack Cisco switches using Kelly Linux in a previous video
I showed you how to get Kelly Linux downloaded and installed on a Windows 10 computer.
So have a look at the video which I've linked here or below.
If you haven't got Kelly Linux installed and running I basically show you how to download a pre-built
version of Kelly Linux and imported into VM workstation player which is free software that allows you
to run Kelly Linux on your windows 10 computer
all right.
Without further ado let me show you how to hack Cisco networks in this video.
I'm going to demonstrate to the use of your senior which is a framework for performing layer two attacks.
It allows you to attack multiple network protocols including spanning tree CTP or Cisco Discovery Protocol
DTP or dynamic trucking protocol DHEA P H.S. op ed the one Q edited a 1 x ISIL and veal and trucking
protocol or CTP.
So basically this application allows you to hack multiple protocols in Cisco networks doesn't just apply
to Cisco networks but some of these protocols such as DP DTP and Aegis IP or Cisco proprietary protocols.
So this application is really geared for hacking Cisco networks but you could use it for hacking other
protocols in networks that have other vendor devices in it.
Cisco is the biggest networking vendor in the world.
So Cisco switches and Cisco riders will be found in many many corporate environments around the world.
So I'm going to demonstrate how to hack Cisco devices using Yersinia running in Kelly Linux.
Now in this basic network I've got a Cisco switch.
This is a catalyst 29 60 C.G. switch.
The reason I'm using a small switch like this is it's fabulous.
So it doesn't make a lot of noise.
I've got a Windows 10 a laptop that I've connected physically to the Ethernet switch on port one I've
got a Macbook connected on Port 2.
These devices are connected via ethernet cables to the switch.
I've also connected to the console of the switch using a USB B connection.
In this example I'm also controlling both of those devices from my local Mac.
It just makes it easier to do the recordings.
So I've got the connection to the MacBook and I'm controlling that via the NC and I'm also controlling
the windows computer via VANOC the Windows computer.
Once again is running Kelly Linux within VMware Workstation player.
Okay so I'm gonna open up a terminal and I'm going to type y e r s tab and you'll notice nothing happens.
That's because of this application is no longer installed by default in this latest release of Kelly
Linux some of the type apt get updated to update references on this Kelly linux host and then I'm gonna
say apt get install your senior
so I'm basically installing this application on Kelly Linux.
It used to be installed by default but in this release is no longer installed.
The version of Kelly Linux that I'm using is 2019 got three you simply need to wait now for the application
to install Okay so it's now installed solved clear the screen and notice.
Now when I type of y e r s tab the command order completes and I compress dash or hyphen H to get help
about to the application.
So we told that we can get to the application version number by using uppercase V H displays this help
screen G gives us a graphical user interface ie is interactive uppercase D daemon mode lowercase d debug
mode.
We've also got some logging options.
So what I'm going to type is senior dash g to get a graphical user interface.
Now we're told that this is an alpha release that's fine for our example.
Notice once again that multiple protocols are supported CTP DHEA P edited at 1 q edited at 1 x DTP H
S R P ISIL NPL s SDP V.P. and we've got a log here now in this video I'm assuming that you have knowledge
of these protocols to be able to hack networks you need to have an understanding of the protocols that
network devices use now if you don't know what those protocols are.
Have a look at some of the videos that have link below or have a look at my course in my CCN and a course
I teach a lot of these protocols you don't have to take my course if you don't want to have a look at
other videos on YouTube or other CCN courses but for this video I'm assuming that you have knowledge
of these protocols now in this example.
I'll start Patty because what I want to do is connect to the console of the Cisco switch and show you
how the switch is being configured before I do that we need to know which console port to use going
to go to device manager and here I can see that USP serial device.
Com 3 is being used so I'm gonna specify Com 3 in P and click open and now I'm connected to this switch.
The switch has not been configured with best practices and that's a problem because with hacking tools
like Kelly Linux if you don't configure a network device properly hackers can get access to your network
very very easily.
If I touch your run on the switch
it's got to DHB pools configured port one on the switch is configured in veal and one and port two is
configured in and two.
In other words this laptop is in a different VLAN to that laptop but we're not going to let that stop
us scrolling down.
You can see that interface gigabyte 0 1 is configured with defaults.
Very bad idea.
You don't want to use default configurations on a switch port on a switch.
You should at least shut down ports on a switch that are not in use.
Or put them in a separate VLAN or stop protocols like DTP being used so as an example show interface
gigabit 01 switch port what you'll notice is negotiation of trucking is on current administrative mode
is dynamic auto we've got DTP enabled on this port that's something we don't want to do.
So this command show interface port number switch port shows us that the port is configured and VLAN
1 but to DDP is enabled on that port.
So again show run interface gigabit 01.
That's the configuration of Port 1.
Here's the configuration of Port 2.
I'll put the switches configuration below the video if you want to have a look at the switches configuration
or flying.
But apart from that the switch also doesn't have writing enabled.
That means that there's no routing from one VLAN to another on the switch at the moment.
Veal and one is down because I haven't plugged in my Kelly Linux SPC so let me do that
and what we should notice is the port on the switch comes up and it does so show IP interface brief
thus veal V'landys install down but we can see that interface gigabit 0 1 has come up.
So after a while that XVI will switch to virtual interface should come up and there you go.
It's now come up Savill and want to volunteer configured on the switch the switch is acting as a DHB
server and allocating IP addresses to devices in the relevant V'landys show lan shows us that gigabit
to 0 1 is in VLAN 1 gigabit 02 isn't violent to the Mac has been allocated to this IP address 10 1 2
1 by the DHB server we can see that on the switch by typing show IP DHEA P bindings so that IP address
has been allocated to the MacBook according to the switch this IP address has also been allocated and
that's probably my windows computer
changed the font size had to make it easier to see
so command prompt IP config.
This Windows computer has been allocated this IP address but the pieces won't be able to ping each other
because IP routing is disabled on the switch.
There's no routing from one VLAN to another in this topology.
So on my macbook as an example if the MacBook tries to ping the windows computer it can't do that because
IP routing is disabled.
There's no routing between the violence but that's not going to stop us once again.
Now currently the Kelly linux host is configured to use Nat and it's been using my wireless connection
to get access to the Internet.
This little network here doesn't have any internet access.
So what I'm gonna do is I'm going to breach the Kelly linux host to the real tech USP Gigabit Ethernet
family controller.
So I'm gonna bridge it to this Ethernet connection and click Okay.
So in Kelly Linux I'll open up another terminal window ie if config will show us the IP address at the
moment.
No IP address has been allocated do that command again.
And notice 10 1 1 3 has been allocated.
So on the switch show IP DHB bindings.
This IP address has been allocated to the Kelly linux host.
So that means I've got three devices in this topology physical windows P.C. MacBook.
Plus Kelly Linux virtual computer.
So let's use Kelly now to hack the network.
Okay so it's already picked up that it's connected to a switch through CTP so we already know that we
connected to a Cisco switch on the Cisco switch show CTP neighbor.
It doesn't see any neighbors at the moment but what we could do is launch an attack and send a CTP packet
and click okay in the log we can see that an attack was launched and it's now finished.
So back on the switch show CTP neighbors stalled and see a neighbor so let's flood the CDC table of
that switch.
So as you can see a lot of CTP packets are being sent out on the switch show CTP neighbors notice we
suddenly have a huge amount of sleepy neighbors and you can see the platform here is your senior.
So we are flooding the CTP neighbor table on the switch.
That isn't really a fantastic attack but it just shows you that by a simple attack I can flood the CTP
table of that switch.
Notice how many packets are being sent out after a short while you'll see this has increased dramatically
the CPI on that laptop is going crazy.
The lights on that switch are going mad.
I am essentially flooding this switch with a lot of neighbor relationships.
If I type show CTP traffic you'll notice a lot of input packets are being received by the switch.
A lot of attack packets to stop this go to actions list attacks.
And I'm going to say stop all attacks if you wanna shut the program down and stop the attack.
Click exit.
But you probably want to go to actions list attacks and then you can shut down the attacks.
Now because this network is small.
I mean there's only one switch in this topology.
I can't show you large scale attacks but I'll continue showing you some basic attacks which you can
then apply to logic.
Apologies.
I'll show you a lodger.
Apologies in separate videos.
Now very basic attack that can be used is attacking spanning tree at the moment in this network show
spanning tree shows me that the switch is the root of the topology gigabit 0 1 is forwarding on VLAN
1 switches the route for VLAN 1 for violent 2 switches.
Also the route so violent to switch is the route port that's forwarding is gigabit 0 2.
I only have two ports currently up in this topology port one is in Vila and one we can see that with
the show v land brief command so gigabit 0 1 is currently in V land 1 gigabit 0 is configured and violent
to only have two ports plugged into the switch and again port one is in VLAN one port 2 is in V land
2 shows spanning tree root shows us that the current Switch is the route for VLAN 1 and V land too.
We can see the route cost is 0 for both those v lines and again we can use the show spanning tree command
to see that the switch is the route for VLAN 1 and V land 2.
But let's change that.
So I'm going to launch an attack in this case it's a spanning tree attack we going to claim route roll
and click Okay.
So Yesenia has picked up that there's a switch in the topology but we going to claim to be the route.
So on the switch show spanning tree notice for VLAN 1 the switch is no longer the route it has a cost
of 4 to get to the route we can see that gigabit 0 1 is a route port where the cost of 4 previously
the port was a designated port when the switch was the route.
So we've changed the role to route.
This is the port that the physical switch is going to use to get to the root Bridge which is currently
Kelly Linux for veal two we can see that the switch is route notice gigabit 02 is a designated port.
Now I won't have time to go through all the protocols.
There's a lot of things you can do just with your senior within Kelly Linux.
I'll show you other hacks in subsequent videos.