Hi, this is Keatron Evans, and I'm going to show you how to do a man in the middle attack.
So what we see on the screen here is basically one of the victims that we're going to be
doing a man in the middle attack against, and we have another victim here. Now, one
of the things that we need to remember is any time you visit a website, you do so by
going out to a router or a gateway or something like that, to get you out to the internet,
and you primarily find the websites that you're trying to visit by doing something called
a DNS query, which is when you tell your DNS server that you're connected to, to put you
in the right direction, to go to the IP address of wherever you're trying to visit. So what
we're going to do here is we're going to be interrupting that process, putting ourselves
in the middle so that when they request Facebook or whatever it is they're trying to get to,
we're going to lie to them and tell them that Facebook is somewhere that we want it to be
and point them to our site that we control instead of them getting to the real Facebook.
So let's dive right into it. First thing we have to do is we have to tell the victim,
which is this machine.
We have to tell it that we're the gateway, which is dot two so that it will pass all
those requests through us. The easy way to do that is something called ARP poisoning.
So let me ARP poison,
And I'm going to specifically tell the gateway, which is dot two that I am the victim, which
is 100. Now for man in the middle of the work. Remember you're in the middle or you're trying
to get in the middle. So you can't just ARP poison one side of that equation. You have
the ARP poison, both. So now simultaneously I'm going to ARP poison and tell the gateway,
which if you're at home or at Starbucks, this gateway would essentially be your Wi-Fi router
that we're spoofing here. So now I'm going to tell the victim that I am the gateway.
So first ARP spoof, I'm telling the gateway that I'm the victim, the second ARP spoof,
I'm telling the victim that I'm the gateway. This is part of what puts me in the middle.
Both sides will now think I'm the other side. So I start my ARP poison and right away you
can see the ARP going out and it's doing a reply, which is telling the 100 machine that
I'm the gateway.
And it's also telling the gateway that I'm the 100 machine. So that's the ARP poisoning
in motion. And it's going every second. The reason it's going every second is because
in a real network, every once in awhile, the real machines would respond and say, wait
a minute, I've got that IP address. So having this ARP happen every second guarantees that
even if the real device responds, you immediately overwrite that response with your more recent
response, because in the land of ARP, the most recent reply is considered to be the
truth. So the last step, once we've got the ARP poison going here to set up the infrastructure
is we have to make sure we turn on something called IP forwarding. And the reason for that
is by default your machine will simply drop packets. That's not intended for it. Now,
in my case, my machine has the IP forwarding turned off, which means it's going to follow
that behavior and all machines do that by the fault.
What I want to do is change that behavior because I am going to be getting packets that
are intended for our victim here. And since those packets aren't actually intended for
me, my default behavior is to simply drop those packets, but I don't want to drop them.
I want to go ahead and take them and pass them on. So I'm going to change this IP forward
from a value of zero to guess what? If zero is off, what do you think I need to change
it to to turn it on? Exactly. You won. One. So I'm simply going to write the number one
into this file
And this will actually turn on IP forwarding. Now to prove to you that this is working,
I'm not going to write this yet. I'm going to show you that currently 100, which is this
victim, has trouble pinging dot two.
And that's because the ping packet is never making it to the actual gateway. It's coming
to my machine. And since my default behavior is a drop packets not meant for me and I'm
clearly not dot two, that packet's getting dropped, but the minute I turn on IP forwarding,
let's go ahead and turn that on. Now you're going to see those pings are going to end
up being a hundred percent successful. And that's because now the ping is making it to
the other side, but it's only making it there by coming through my interface first. So that
means I've made myself a proxy or now I've completed and put myself in the middle. All
right, the next part, how do we prove that? And how can we do things? Well, there's a
couple of tools that I want to show you on top of us being in the middle. First one is
a special purpose sniffer called driftnet. What driftnet does is it is unique in that
it grabs only images out of a victim's traffic. So if I run driftnet, tell it to listen on
interface six here.
What you're going to see in this little black window is whenever the victim visits websites,
let's go do that. Victim goes out. It goes to MSN and some other places. Well in that
traffic are images, well guess what the attacker just grabbed? All of the images that were
in that traffic has now been sniffed off by this attacker who's in the middle. So any
images that you would have viewed during your browser session, the attacker is able to see
those images now. Not only see them, but if I found one that I wanted to keep like this
image here with this nice pie, I click that and it actually saves a local copy of that
image so that I can go back and look at it and view it later. Now, if that's not creepy
enough, let me show you how this really gets deep.
So on top of the man in the middle and on top of the ARP poisoning, I'm going to do
one more thing called DNS cache poisoning. And what this means is whenever you go to
a website such as Facebook, the first thing that happens is your machine sends a query
to your DNS server saying, where is Facebook? What's Facebook's IP? Your DNS server responds
back and says, here's the IP address for Facebook. Now, what I'm going to do is since some in
the middle, I'm going to see that request. And I'm going to respond on behalf of the
actual DNS server and lie to you and tell you that Facebook is at my machine. Let's
look at how easy that is. So I'm first going to create a file. We'll just call this MITM
FB for Facebook. And I'm just going to say in there that Facebook is at my IP, which
is 204. Save that little text file. And now I'm going to run the tool dnsspoof, point
to that file that we just created, and now what's happening is any time this tool sees
a query for Facebook, it's going to respond to that machine that's asking for Facebook
and lie to it and tell it that Facebook is at my IP. Let's go check the victim. See what
happens. Now when the victim pings Facebook. So victim says let's ping facebook.com
And it gets pings. But look at where it says the pings are coming from 204. So we've successfully
poisoned the ARP cash. Now we've successfully DNS cash poison them. So they can't even DNS
look up Facebook without blindly trusting what we're telling it Facebook is. The last
step of this is now. I simply need to go out and make sure I have myself a nice clean copy
of Facebook that looks just like Facebook, but actually has malicious code in it that
will give me control of that victim's machine if they are to browse to my particular copy
Facebook. This is also known as a client side attack against a browser that we're going
to use to do the actual exploit here. So that sounds complex. Let me show you how simple
it actually is. I'm going to load up a tool that's been around for a lot of years written
by Dave Kennedy called the social engineer's toolkit.
I'm going to pick one for social engineering, two for website attack vectors, and two, again,
for browser exploit method. I'm going to go to site cloner going to say no to natting.
IP I wanted to come back to that. It's going to be mine.
Who do I want to clone? Let's just say Facebook.
And then I'm going to use browser auto pawn because these hundreds of exploits up here
are basically depending on me knowing which browser victim's use, I don't know what browser
the victim is going to have because it could be different browser and OS combinations.
So I'm going to pick Autopawn, which means that when the victim hits my fake Facebook
server, the server is going to look at that victims, get request and decipher what the
browser and OS is, and then send the appropriate exploit based on that. Alright, I'm going
to pick Meterpreter as my payload. In other words, if I'm able to export the machine,
what do you want to get as your loot? I want a Meterpreter session so that I can take over
the machine, let the port stay r43. And now it's off to the races. It's going out.
It's going to the default Facebook login page. As you can see there, it's cloning that which
means it's copying it down. Now it's putting the malicious code that I've crafted inside
that fake Facebook copy. And now it's standing up a version of the exploit for every possible
browser and operating system combination and storing them at a slightly different URL on
my server. So when your browser hits this server, it's going to look at your browser
version, look at your OS version, and then simply send the appropriate exploit based
on that, which we're loading them all right here. Once this is finished, the only thing
we have left to do is go play victim and see what happens when the victim simply does what
the victim does everyday and tries to go to Facebook. So we jump over, go to the victim.
We open our browser, we load facebook.com in their browser. And at that point right
there, it's game over, we go back and look, what you see happening on the attacker side
is the attacker now has a session. We connect to that session as the attacker.
Take our obligatory screenshot here to prove that we have it. And at that point we own
that machine. It belongs to us completely. It's no longer that victim's. It is ours.
We can drop into a shell and it's all game over at that point. And that folks is what
a man in the middle attack looks like. And now you can see the actual devastation that
can come from that.