This is one of multiple videos where I'm showing you how to hack networks using Kelly Linux in previous
videos I showed you how to download and install Kelly Linux on Windows 10 computer using a pre-built
image that you can download from Kelly dot org.
I also showed you how you can hack Cisco networks when a switch is badly or poorly configured.
It's important that you configure networks properly otherwise it's very easy to hack networks such as
Cisco networks using Kelly Linux and thus video I'm going to show you how easy it is to break networks
that are badly configured.
We're going to use two protocols.
The first one dynamic trucking protocol or DDP.
And the second one to VTB or VLAN trucking protocol.
We basically going to do things to the network by leveraging those two protocols.
I'm going to show you as an example how you can take devices off the network by sending VTB packets
to a Cisco switch using Kelly Linux.
So we basically going to delete Evie lands from a switch by simply injecting VTB packets into the network.
Kelly Linux in our example will be configured on one VLAN will have hosts on a separate VLAN but that's
not going to stop us.
We're going to use DDP to form a trunk with a Cisco switch.
Have visibility of a separate DV land.
So Kelly Linux will be in one V Line.
Let's say we land one.
Our host will be in a separate Vila let's say v land too.
We'll say DTP packets to the switch so that we have visibility of those hosts from our Kelli linux host.
And then what we'll do is use v DP to delete a v lands automatically on a Cisco switch.
Basically removing devices in one VLAN from the network is
a right.
Without further ado let me show you how to hack Cisco networks at the moment on the switch show interface.
Trunk shows us that they are no trunk ports on the switch.
Show interface gigabit.
0 1 switch port shows us that this port there's the command again.
This port is configured to use DTP but at the moment it's a static access port administrative mode it's
dynamic order.
Bad idea to use DTP show run interface gigabit 0 1 shows us that this port is configured with a default
configuration.
That's a bad idea because what we can do is launch a DTP attack and enable truncate by simply selecting
that option and clicking Okay.
Yesenia sees that there's a switch using Access order which is what we saw over here.
Dynamic order.
But in the output of the switch we can see that the interface went down and came up again gigabit 0
1 went down.
Now gigabit 0 1 has come up.
And if we use the same command again show interface trunk noticed trucking is now enabled on gigabit
0 1 gigabit 0 1 is using attitude at one key the villain wanted to face on the switch or the XVI or
switched to virtual interface came up because we have an interface in that VLAN but again show interface
trunk native vlan is VLAN one on this port but trucking is now used using editor at 1 q motors auto
v lands 1 and 2 are allowed across that trunk.
That means that Kelly Linux will have visibility of the P.C. in Valenti show run interface gigabit 0
1 no configuration on that port.
But the Mac book is in VLAN to notice it's been configured in feeling too.
And if we type show interface gigabit 0 to switch port we can see through this command that that port
gigabit 0 2 is configured in V land 2.
It's currently acting as an access port again Kelly Linux which is supposedly in VLAN one will be able
to see traffic center by devices and Valenti before we look at that.
Let's have a look at spanning tree again so show spanning tree for VLAN 1.
The switch is no longer the route it has a cost of 4 to get to the root switch gigabit 0 1 is its route
port to get to the route switch for violent to it's the route noticed gigabit 0 1 and 0 2 on not designated
ports previously we only saw gigabit 0 2 in the output there so back in Kelly Linux let's start why
a shock
select capture start you can see that we are capturing a bunch of traffic on the network including spanning
tree
bunch of other traffic seen here but let's falter for DHEA P on the MacBook currently has this IP address
I'm going to disable the Ethernet interface on the MacBook I'll enable it again so that it sends a DHB
request notice Kelly Linux is seeing the D HP information so it seeing the HP Discover message seeing
the DHB offer from the switch to that host it sees the DHB request and sees the D HP acknowledgement
this is on V land to notice the IP address 10 1 2 2 5 4 giving this IP address to the MacBook so the
MacBook has been given IP address 10 1 2 2 and Kelly Linux which is supposedly in a different VLAN was
able to see that on the MacBook if I'm paying a non-existent IP address at ping ten one two one two
three or press enter on the MacBook and faulted for OP notice we can see OP resolution protocol sender
IP addresses this looking for the Mac address of 10 1 2 1 2 3.
Basically the Kelly Linux host which is supposedly in VIGELAND One can now see the traffic in Vila too.
Now that's a broadcast.
If the host sent multicast traffic to let's say 2 3 9 1 2 3 that Kelly linux host would see that ICMP
traffic
so here we go.
We can see IP address 10 1 2 2 pinging 2 3 9 1 2 3.
This is multicast traffic or stop that ping.
Now this is not doing much.
I'll show you in a subsequent video how I can for instance sniff SPF passwords or SPF which is a writing
protocol sends updates into the network using multicast and Kelly Linux will be able to sniff those
writing updates and capture passwords as an example on the OSP SPF updates.
So what we've seen thus far is a CTP attack I've shown you DTP attack and I've shown you spanning tree.
Let's have a look at VTB VTB is a really bad protocol.
Generally you want to turn it off.
It's actually been removed from the Cisco CCMA exam.
So in the next release of CCMA it will be there.
If I type show VTB status the switch is in this domain called home.
It's currently acting as a server configuration revision number is 1.
It has six valence configured show veal and brief as an example shows me that veal and one and veal
and two exist on the switch.
If I create another veal and let's say veal and three show veal and brief veal and three is being created
show VIP status configuration revision number is now two
so in Kelly Lennox let's send a VTB packet you can see it's learnt about the home VTB domain going to
launch an attack and let's delete a villain now before I do that I'm gonna plug in my Mac Book so this
mac book is not plugged into the network on Pt. 3 So on the switch we can see that gigabit 0 3 came
up so show IP interface brief gigabit 0 1 2 and 3 on now up I'll configure gigabit 0 3 as an access
port
and put it into v land to so show run
these two ports are now in the same VLAN on this MacBook I'm going to enable DHEA P it should get an
IP address in VLAN to and there you go 10 1 2 3 so on that Mac book over there the small one paying
10 1 to 3 ping succeeds.
So again that mac book can ping this mac book.
They are both in Vila and to
but what I'll do now on Kelly Linux is delete a villain and the villain I'm going to delete his villain
to it's on the switch show V.P. status at the moment configuration revision number is still to show
villain brief we still have those V'landys I've seen sometimes that this doesn't work that well.
But notice your villain too has now been removed.
I've noticed sometimes you have to create a villain to speed this up but if I type show the villain
brief a villain too is missing and that Mac Book can no longer ping the smack book.
I've basically removed these two devices from the network.
Again show interface gigabit zero to switch port gigabit zero to the interface that that MacBook is
connected to is configured in VLAN 2 but the V Line is inactive.
So basically I've removed these devices from the network.
If I have a look at gigabit 0 3 That's the port to that this MacBook is connected to.
It's also in Vale and 2.
So this command shows us that gigabit 0 3 is configured in Vale and 2 but it's inactive.
I've removed the device from the network essentially
so if I create a V Line to again show the line brief I've now got realigned to back on the switch the
ping should start succeeding once things converge and there you go.
The pings are now succeeding interface volunteers also come up on the switch so that MacBook cannot
ping this MacBook.
But again I can simply delete that V Line using Kelly Linux show veal and brief shows us that the VLAN
exists to speed things up.
I could simply create another VLAN so let's create VLAN 5 top exit and as soon as I did that the ping
started failing on the MacBook because things converge quicker.
When you actually do something on the switch like create a VPN otherwise you just need to wait a while
for for that V Line to be removed.
So show VLAN brief feel and 5 is there but villain too is gone and if you want to really be nasty you
could simply say delete all of ETP V'landys.
So at the moment we've got VLAN 1 3 and 5 1 will not be deleted because it's a default villain these
other villains will also not be deleted but 3 and 5 should disappear when this converges to speed it
up or create a V Line 10 and top end so show V Line brief notice all the villains have gone VLAN 3 5
to 10 are all gone.
That can basically break an entire network if you're using VTB so don't use the BGP or set your devices
too transparent so either disable ATP or use transparent don't use server or client mode P2P is a bad
idea.
Are there some basic examples of how you can hack networks using Kelly Linux.
Make sure that you understand how your protocols work in your network and how you can secure your network.
In other videos I'll show you how you can protect your network from these kind of hacks.
But in this video I wanted to show you what's possible using Kelly Linux.