If you don't configure your network properly it's very easy for someone using Kelly LA Nix or another
type of hacking tool to exhaust the IP addresses in a DHB pool set up a rogue DHB server and then allocate
IP addresses to clients in a incorrect subnet.
And what I'm going to show you in this video is how to do that but also show you how to setup the Kelly
linux host as the default gateway so that traffic from pieces is sent via Kelly Linux to the Internet
or to other devices in the network so that we can implement a man in the middle attack
DCP or Dynamic Host Configuration Protocol is a fundamental building block in networks today and administrator
which could be you will configure a pool or scope which is a range of IP addresses that are allocated
to hosts in a specific subnet.
Hosts will send a broadcast typically to request an IP address from a DTP server and the DHB server
will allocate the IP address to the client.
Have a look at this video which I've linked to and below.
If you want to learn more about the fundamentals of DHEA P in that video.
Show you how DHEA is configured how IP addresses are allocated to clients.
I show you through why shock captures how messages are sent from a client to a server and from a server
to a client.
Now a quick summary of what we're going to do in this video we're going to hack DTP.
We're going to exhaust ADHD people or DHB scope so that's the first attack we're going to setup a rogue
DHB server to allocate IP addresses from a fake subnet.
Second attack third attack.
We're going to set the default gateway of clients to Kelly Linux so when they get an IP address from
the rogue subnet they're going to see their default gateway as the Kelly linux host and that allows
us to implement a man in the middle attack.
So for tax right there then we'll use Y shock to sniff passwords on the network.
You need to be careful when you configure your network using protocol such as DCP.
Make sure that you configure your network securely and properly.
Otherwise it's very easy to hack networks that run DHEA P.
Now this is one of multiple videos where I'm showing you how to hack networks using Kelly Linux.
I don't just want to show you how to break networks I want to show you how to protect networks and I'll
show you how to do that in subsequent videos in the series.
In previous videos in the series I showed you how to hack a physical Cisco switch but I'm travelling
at the moment so I don't want to carry a whole bunch of equipment around with me.
So what I've done is taken that switch all logically taken that switch and put it into the cloud.
In this example I'm using even G and I've got a Cisco switch as well as a Cisco router.
I've got a Windows 10 computer and I've got Kelly Linux.
These devices are connected to the Internet.
This network is running in the cloud but you could simulate this network on your laptop using Janus
3 or even G or Cisco viral.
In this example the switch is running a Cisco viral IOW image.
The road is running a Cisco viral image as well.
Have a look at my even videos or my genius 3 videos.
If you want to learn more about how to virtualize networks on your laptop or how to virtualize them
in the cloud.
So let's start with the switch.
Here's my console to the switch.
Now in this example I'm currently in South Africa so my connection may be a bit slow to the northern
hemisphere.
Hopefully it won't affect this lab but notice I've connected to a switch show version shows me that
this is a Cisco V I was late to switch running version 15 to now don't worry too much about the details
of the switch.
This is a Cisco switch but any switch could be used in this topology.
I'm also using a Cisco broader but again you could use any routing here if you wanted to.
So the Cisco router top show version is a Cisco IOW v router running version 15 dot 6 1 T.
The reason I'm using a rowdy here is I want to set up this rather as a DHB server so if I type should
run that shows me the running configuration of this device and what I want to point out here is I've
configured a DHB pool a DHB pool in Cisco terminologies very similar to a scope so it's a range of IP
addresses that we're going to allocate to clients in our network.
The subnet that's gonna be allocated is 10 1 1 0 slash 24 so slash 24 mosque is being used.
This is the default gateway.
That is the IP address of the router.
I've said to the DNS server to Google scrolling down.
Notice this is the IP address of the Cisco router at the moment.
This device has its interface shut down.
So what I'll do is no shut that that basically enables that.
I'll also enable the connection to the internet.
Going back to my topology at this interface on the router connects me to my internal network.
This interface connects me to the Internet so I'll type India show IP interface brief
this is the IP address on the internal interface interfaces up up.
That means that it's working.
This interface is connected to the Internet.
It's using DHEA p So this writer should be able to as an example paying Google dot com which it can
and I'll save the configuration of the router.
Now again you don't have to use a Cisco switch or a Cisco wrote it.
The reason I want to use a Cisco switch here is Cisco switches support something called DHB snooping
which allows me to stop these kind of attacks in a network.
I haven't configured anything on the switch at the moment but in subsequent videos I'll show you how
to stop this attack.
But I firstly want to show you what's possible using Kelly Linux so I'll open up a console to Kelly.
I'm not gonna get into the debate about the correct way to pronounce Kelly different people pronounce
it differently but for the moment that's the way I'm gonna pronounce it okay.
He has my Kelly linux host.
Let's check if it got an IP address.
It may not have got an IP address because the road is interface was shut down.
I'll use more here rather than simply showing all the output and what you'll notice is this device has
this IP address 10 1 1 3 show IP DHB bindings on the Cisco router we can see that this IP address has
been allocated to this MAC address.
This command show IP DHB binding basically shows us which IP addresses have been allocated to which
MAC addresses.
So this is the MAC address that Kelly is supposedly using five thousand 1 0 0 0 2 4 zeros and back in
Kelly we can see that is the MAC address of this Ethernet interface.
Okay so what I'm going to do now is start your senior using a graphical user interface in a previous
video which I've linked here.
I showed you how to install this on Kelly Linux.
I also showed you how to implement or use Layer 2 attacks using your senior.
But in this example I'm going to show you how to use this for P. attacks.
We're told that this is an alpha version.
That's a case I'm going to click okay and I'm gonna go to DHEA P.
We can see some options here but what I want to do is launch a DHB attack so click the launch attack
and we going to send discover packets using denial of service.
Now before I do that on the road show IP DTP binding we only have one IP address allocated to a client.
Now the reason why the windows host hasn't got an IP address yet is it's currently off.
I haven't started the windows host at this point.
So again show IP DHB binding on the Cisco rider only one IP address has been allocated.
So Kelly I'm going to click Okay to start a Discover denial of service attack and what you'll see is
a whole bunch of DHB messages are being sent into the network.
You can see this packet count is going up on the Cisco router show IP DSP binding
what you'll notice is a whole bunch of IP addresses have now been allocated.
So 10 1 1 1 10 1 1 2 3 4.
And it just carries on.
Basically Kelly Linux has exhausted the DHB pool on the Cisco roster.
And as I keep scrolling what you'll notice is all addresses have been taken from this pool.
There are no IP addresses left in this pool show IP DHEA HP question mark pool let's press Enter here
253 addresses have been allocated from the pool.
The reason why 253 is the roader is using IP address 10 1 1 2 5 4.
So this IP address shouldn't be allocated to clients because that's the IP address that the right is
using.
So again show IP DHB pool shows us that at this point we've successfully exhausted the DHB pool on the
DHB server no IP addresses are gonna be available for Windows 10 client when we started up I'll stop
that up and I'll open up a console to the Windows device.
It'll take a while for this device to boot up but once it's booted up fully we'll see that it won't
get an IP address because we've exhausted the IP addresses in the DHB pool.
Now warning I will give you is a lot of packets are being sent into the network that can cause all kinds
of issues.
So don't run this in a production network.
Be careful where you're going to run these attacks.
Notice the number of the HP Discover messages being sent into the network okay from a Windows P.C. is
booted up.
I'm going to open up a command prompt and what I'll do is make this bigger so the font isn't so small
it's running really slowly here and that's probably because of the number of broadcasts being sent into
the network.
If I type IP config notice no IP address has been allocated to the windows.
P.S. It's using the default 169 254 IP address range IP config slash renew
this device is not going to get an IP address because we've exhausted the DHB pool on the DHB server
but what we can do now is launch our second attack.
So going to click launch attack and let's set up a d HP rogue server
IP address is gonna be 10 1 1 3 that's the IP address of our Kelly linux server.
I'm gonna allocate IP addresses in the range 10 1 1 1 100 to 10 1 1 1 50.
I'll set the least time to 3600 seconds.
Same for renew subnet mask will be this the default router is now gonna be Kelly.
It's not going to be the actual router in the network DNS server will set as Google and the domain name.
You probably don't want to use something like hacked dot com let's just specify home dot com and click
Okay.
Okay back on the windows host type IP config.
Notice we've been given this IP address 10 1 1 100.
And notice this default gateway is 10 1 1 3.
That's really important.
The actual default gateway is 10 1 1 2 5 4.
Kelly Linux is using IP address 10 1 1 3 so I have config more shows us that this is the IP address
of the Kelly linux host.
So the Windows computer is using Kelly as its default gateway.
That's important because when the windows host sends traffic to the Internet that traffic is gonna go
via Kelly to this writer onto the Internet.
So as an example the broader has this loop back interface configured on it of one dot wandered wandered
one that's essentially a loop back or imaginary interface on the broader that allows us to add a subnet
to the right of the P.S. at the moment won't be able to ping that loop back address because the traffic
is going through the network to Kelly but Kelly is not forwarding that traffic to the router we need
to type a command on the Kelly linux host to forward the traffic.
So again notice the pings are failing.
So in Kelly we're going to type sis CTO
dash w net dot IP V for IP underscore school forward equals one.
Basically we're going to allow the Linux host to forward traffic that's sent to it.
So on the windows P.C. ping wandered wandered wandered one now works that traffic is going off via the
Kelly linux server and we can see that by going to applications snuffing and spoofing why shock so why
shock will allow us to see the traffic being sent on the network.
I'm going to capture traffic on Ethernet zero and I'll filter this for ICMP traffic so back on the windows.
P.S. If I ping wandered wandered wondered one we can see that traffic from the PRC to the router we
see a bunch of ICMP redirects but essentially the traffic is being sent through Kelly to the.
We only see half the conversation but we can see the pings and this is the important piece.
Let's assume the administrator of the router did something very stupid and allowed telnet connections.
So on the windows.
P.S. I'm going to tell it to the broader to administer the router.
We should actually be using SSL each so before I click Okay.
Let's filter for telnet in y shock and I'll click open in Patty now that font is very small but all
into the password and log in
so I've changed the font.
Now basically the write up prompted for a password which I entered and I'm now in what's called user
mode typing able into my password and I'm in privilege mode.
But notice and Kelly now I can see telnet information including the password.
Here's the password C I S C O Cisco.
Now that's not such an easy way to view it.
So I'm gonna right click on a packet and click follow TCB stream.
And what you'll notice there there's the first password I type to enable.
There's the second password which is Cisco.
So I was able to see the password that was transmitted from the windows host to the router because the
traffic is being sent through the Kelly linux host to the right.
So that is an example of a man in the middle attack now on the P.C. I'll open up a web browser and what
I'll do and Kelly is specify HDP.
So let's look at HP traffic.
You should be using HP yes.
Most websites use HDP s but again if I connect to the router and put in my username and my password
using HDP and sign in I can log into the broader and I'll be able to view information on the writer
such as monitor the broader by using commands on the broader so I could type show IP interface brief
as an example and execute that command on the rider using a GDP.
But back in Cali you'll notice I'll be able to see all the HDP traffic from the P.C. to the router
and one of the things I want to point out here is notice authorization there of the credentials username
and password used to log into the Cisco broader.
Again that's a man in the middle attack the PRC is sending the traffic to its default gateway which
is the Kelly linux host which is sending it to the border.
But we could connect to the Internet.
So on the windows.
P.S. I'll open up another tab.
Most websites are now using encryption.
One of them that's not.
Which is really bad.
Is OXFORD UNIVERSITY Oh X AC UK.
That website is using GDP not GDP.
Notice it says not secure in the output.
Very bad
your connection to the site is not secure.
We've been told so back in Kelly we can see traffic sent from the windows.
P.S. 10 1 1 100 to 120 967 to 40 to 154 which is the Oxford University website.
Now at least here on their website when you try and log in so go to Oxford students as an example.
They are now using encryption so only part of their website is in clear text.
We should be using HDP yesterday but the point is I can see part of their website through Kelly Linux
by using this man in the middle attack.
You should always make sure that your traffic is encrypted and that you using a valid cert.
So it's really important that you verify that the certificate is a good certificate that it's been issued
correctly that it's not a rogue cert so make sure that your traffic is encrypted especially if you're
using wireless hotspots or open networks.
Make sure that the certificate is valid because the traffic could be going through a device such as
Kelly Linux don't just connect to any network.
Make sure that networks that you connect to are good.
Make sure that you use a VPN or some kind of encryption mechanism so that your traffic is not sent in
clear text.