In a previous video which I've linked here and below I showed you how to set up Kelly or Carly if you
prefer Linux as a DHB server and then implement a man in the middle attack in a topology such as this
Kelly Linux is setup as a DHB server to allocate IP addresses to pieces such as Windows 10 host and
then set the default gateway to itself so that traffic is sent through the Kelly linux server onto the
Internet and onto other destinations.
That allows us then to implement a man in the middle attack because all traffic is going through Kelly
to other devices in the topology.
Now to stop that from happening we going to set up the switch to use DHB snooping so it's going to snoop
or listen in on the HP messages and only allow certain DHB messages from trusted servers.
So the switch will allow clients to request IP addresses but will not allow Kelly or other servers on
untrusted ports to offer IP addresses to clients.
We'll setup this interface on the switch as a trusted port so that the writer is able to allocate IP
addresses to the P.C. but Kelly is not able to do that.
Okay so I'm not going to show you practically how to use DHB snooping to stop these kind of attacks
but I've also added some additional information below this video.
There's a PowerPoint presentation that you can download as an example that gives you the commands to
set this up on a switch.
Okay so on the windows computer I'm going to open up command prompt so open up a C D prompt IP config
shows me that this is the IP address of the PC at the moment.
Default gateway is 10 1 1 2 5 4 which is the router in the topology on the router show IP interface
brief notice IP address of the router.
Is this the right it is configured as a DHB server show IP DHB binding shows me that two IP addresses
have been allocated one to the windows computer and one to Kelly on Kelly as an example.
If I open up a terminal and type I have config.
This is the IP address that's been allocated to the Kelly linux server.
Once again this is the IP address allocated to the P.C. by top IP config slash release to release the
IP address.
I'll make that a bit bigger and then type IP config.
You'll notice that it's not been allocated an IP address.
It's using a link local IP version for address and link local IP version 6 address.
But if I type IP config slash renew it should get an IP address from the DHB server and there you go.
IP address has been allocated by the router to the windows computer but now let's setup Kelly as a rogue
DHB server so to do that I'm going to run Yesenia and use a graphical user interface.
I showed you previously how to use this application and a lot of detail.
So once again referred to the previous videos if you want to learn more about this application.
But it's quite simple.
All I'm going to do is launch an attack and I'm going to setup a rogue DHB server so I'm going to select
that option and click Okay.
If the IP address of the rogue HP server is going to be the local Kelly linux host which has an IP address
of 10 1 1 2 slash 24 now I'll use a different range of IP addresses for hosts that we allocate addresses
to using Kelly.
So let's say 100 to 110 release time and renew time all set to 3600 seconds.
Subnet Mask will be a slash 24 mask.
And this is how I can implement a man in the middle attack.
I'm going to set myself as the default gateway.
That means that the host will send traffic to the Kelly linux host which will then forward traffic to
the rider so we can implement a man in the middle attack without the user knowing what's going on DNS
server.
I'll set to Google and the domain I'll simply set to whom dot com and click Okay.
So if we look at actions list attacks you can see that I'm running a DHEA P rogue server attack.
You can see that the D.A. GP rogue server is currently running so on the client I'm going to release
my IP address again and then renew it.
Now it may get an IP address from the broader rather than from the Kelly linux server.
It just depends which device replies first so you can see it got its IP address from the router so on
the router I'm going to type no service DHEA P I'm going to disable the DHB service on the router so
show IP DHEA HP binding.
You can see that the bindings have been removed from the router so on the P.C. I'll release my IP address
and then I'll renew it and let's see if it gets an IP address from the Kelly linux server on Kelly you
can see there's a D HP Discover DHB discovers are being received.
Now sometimes this application bombs out or breaks so you have to rerun the DHB server.
That's a lesson in hacking you can't expect everything to work the first time.
You gotta be persistent and be tenacious and keep on trying.
So now it received a D HP request from the client and it acknowledged it.
In other words when I ran IP conflicts renew again it got an IP address.
Okay so the P.C. has been given an IP address but not previously I had an error here saying unable to
contact your DHB server request timed out the Yasuni application.
Sometimes bombs art especially the graphical user interface it is an alpha release.
That's probably why you want to do stuff through the CSI if you can but to keep things simple I've done
it through the gooey but the net result is that the piece he has been given an IP address from the Kelly
linux server.
That's what we don't want.
Notice the default gateway is Kelly.
That means a man in the middle attack could be used here OK.
So to stop this nonsense.
Now on the switch that the devices connect to.
I'm going to enable DHB snooping.
This is a layer to switch or is configured as a layer to switch.
It does support other options.
Show IPD HP snooping at the moment DHB snooping is disabled.
There's the command.
Notice DHB snooping is disabled.
It's not configured on any v lands and it's not operational on any V'landys no interfaces have been
configured to be trusted so in global configuration mode I'm simply going to type IP DHEA P snooping
that enables DHB snooping on the switch globally.
But please note that's not how you make it work.
This is the first step type the command show IP DHB snooping again.
You can see that it's now been globally enabled but it's not enabled on any villains.
So don't forget to enable it on the villain and to do that you type IP DHB snooping the villain one
so two commands are required show run pipe include DHEA P.
We have now used this command globally as well as this command globally on the switch show IP DHB snooping
shows us that DCP snooping is now enabled on VLAN 1 I'll type IP config slash renew on the P.C. now
at this point it's not going to get any IP addresses because we've got DHB snooping enabled the Kelly
linux host won't be able to allocate IP addresses to the P.C. but nor will the router.
So to prove that on the broader all enable the DHB service again.
So show run shows us that we've got this DHB people configured this is the network.
This is the default gateway.
This is the DNS server but the piece is not getting any IP addresses so IP conflict slash renew notice
no IP address is being allocated show IP DHEA P binding no IP addresses are allocated by the router
and no IP addresses are being allocated by the Kelly Lennox host not to see what's actually going on
we can run a debug on the switch.
So let's run debug IPD HP snooping packets so we can see a lot of detail.
Be careful with packets you'll see a lot of detail in the output here.
So you may prefer to use events but let's run this again IP config slash Renee notice we seeing a lot
of output.
But what I'll do now is turn off debugging for the moment.
We can see
received a new DHEA packet from input interface gigabit 0.
That is the P.C..
It's a Discover message.
Notice the source mac address is this ending in 7.
See double zero on the P.C. IP config slash all.
That is the MAC address of the Windows computer.
So the Windows computers requesting an IP address at least two we can see the source MAC address of
the P.C. destination is a broadcast notice all Fs so hexadecimal FS broadcast at layer 3 destination
is a broadcast IP version 4 source IP address is unknown it doesn't currently have an IP address it's
requesting an IP address.
So we've got invalid entry for flooding on ingress of V land one breach output port is null packet is
dropped so the switch is essentially just dropping that packet it's not forwarding it anyway to forward
that request to the writer on this interface we need to trust this port so we need to make gigabit 00
a trusted port so that that DHB requests can be forwarded to the router so on the switch interface gigabit
00 that's this interface connecting to the router IP DHEA AP snooping we're going to trust the port
debug IP DHEA AP snooping packet back on the P.C. IP config slash renew let's try and get an IP address
can see a lot happening here but notice right at the bottom of this debug breach packet sent to Port
gigabit 00.
So the DHS P request received by the switch from the C is being forwarded to the router we've got the
HP Discover from the P.S. On gigabit 02 asking for an IP address but notice this problem we see here
option 82 option 82 can cause problems.
Option 82 is used when you need to forward the HP requests from a writer to a D HP server as an example
and include information such as port numbers.
So if you have problems with that on the switch type no IP DHEA AP snooping information option enter.
So we're not going to forward option 82 information to the writer so let's try that again I P conflict
slash renew.
Notice the P.C. now gets an IP address.
So back on the switch.
A lot of output in the debug.
So once again the P.C. is requesting an IP address inbound interface is gigabit 0 to the switch sending
the packet to the rider on gigabit 00.
The rudder replies back.
There's the DHB packet inbound on gigabit 00 we see the router allocating an IP address to the client.
So in the output here we can see that this IP address which is the router is sending a broadcast it's
a broadcast oddly a two broadcast at least three allocating the IP address to the P.C. thus once again
if you remember is the MAC address of the P.C. so the writer has successfully allocated an IP address
to the P.C. the P.C. got to that IP address from the router.
Now it got given 10 1 1 100 because the P.C. will ask for the IP address that it had previously.
Previously it had been given that IP address by the Kelly linux server.
So Windows remembers that information and basically requests that IP address it had before so it got
a different IP address but that IP address is in the pool of IP addresses on the router so you can see
that this IP address was allocated to the P.C. and if we have a look at the DHB pool once again you
can see that the pool is all IP addresses in 10 1 1 0.
So 10 1 1 100 is a valid IP address in that range.
Okay.
So back on the switch let's recap what we configured show run pipe include DHEA P we configured DHEA
P snooping globally on the switch we configured it globally on the veal and 1 so those are global configuration
commands.
We also stopped option 82 by configuring that globally and then we trusted the gigabit 00 interface
so show run interface gigabit 00.
Notice this interface has been configured as a trusted interface.
Can we should do some show commands to show IPD HBP snooping we can see through the output of this command
that DHB snooping is enabled globally also enabled on VLAN 1 not in other v lines all the devices in
this network on VLAN one gigabit 00 is a trusted interface we are not a rate limiting that interface
but what we may want to do is right limit requests from pieces so we may want a rate limit this interface
and this interface the reason why is on Kelly Linux we could do a DHB P. a denial of service attack
so send a DHB packets and basically just flood the network with a huge amount of DHB requests and that
can actually kill or cause problems in the network.
It's actually killing the switch so I'll stop that attack.
So actions list attacks and I'll stop the D.A. HP Discover attack because it basically kills the switch.
I'm going to get a huge amount of debug output now because I was running a debug.
It's an important lesson.
Don't leave a debug running and Kelly sent a huge amount of packets to the switch.
So this may take a while so I'll turn off debugging.
Not sure if you saw that about a topic quickly but there it is again unaltered.
And what I'll do is on the interface to the Kelly linux server which is gigabit 0 1 all enabled rate
limiting.
So IPD HP snooping the limit rate to 10 packets that means 10 packets per second so we'll rate limit.
This packet generation on Kelly basically stop it from sending too many packets.
So back on the switch.
Notice DCP snooping error disable.
We've received more than 10 DHB packets on gigabit 00 DCP snooping rate.
Limit is exceeded.
More packets have been received and what has happened.
The interface has been taken down.
So show IP interface brief on the switch.
There's the command again.
Notice this interface has gone down because Kelly has sent too many packets
I'll shut it down to manually shut it and then no shut.
And let's see what happens.
It's actually locked up my switch.
Now you can see the CPSU is gone crazy.
Some Kelly all stop that attack.
This is one of the problems using a virtual environments such as Janus 3 or Cisco viral or even G.
The problem is this is not a physical switch so it hasn't got the A6 to forward lots of traffic through
it so you can basically destroy the switch which has happened here but after a while what happened was
the messages displayed KGB snooping ten BHP packets have been received and what has happened now is
the interface is shut down once again.
So show IP interface brief interface has gone down.
So basically what happened is I shut the interface no shut it so many packets were being received from
the Kelly linux host that the switch bombed out our physical switch wouldn't necessarily have that problem
because it's got the ASX then the 10 packet limit kicked in and the port was shut down to protect the
switch.
So there was a delay from interface going up see you being hammered by Kelly to the port being shut
down by that command on.
And that's because I'm using a virtual switch rather than a physical switch physical switch with Bolton
ASX would stop this kind of nonsense from happening.
Net result however is that the interface has gone down.
We've protected the network.
So in this video I showed you how to protect a network using DCP snooping I showed you how to stop rogue
DHB servers on the network.
I showed you how to stop a denial of service attack by Kelly Linux where it sends a whole bunch of HP
messages.
The switch will shut the port down if it receives too many DHB requests in a certain amount of time.
Don't forget option 82 can cause problems like it did here.