- In this video I'm gonna show you multiple attacks.
I'm firstly gonna show you how to poison ARP caches on PCs.
ARP, or address resolution protocol,
is a fundamental building block in networks today.
Basically it allows devices to learn
the MAC addresses of other devices on an ethernet network.
Once we've poisoned the ARP cache of a device,
we're going to implement a man in the middle attack
where we view the passwords and data sent
between multiple devices in our network.
I'm gonna show you how to capture usernames
and passwords, as well as data sent
between a router and a host in our topology.
But rather than just talking about this,
I wanna show you practically how this actually works,
I'm gonna show you using Wireshark captures
how ARP works, how ARP caches are then poisoned
using Ettercap, and how we can implement
a man in the middle attack using a virtual network
running in this example in EVE-NG.
♪ I've been in your waters ♪
(upbeat rock music)
♪ I thought you were my love ♪
♪ I know one thing for sure ♪
- Now if you enjoy this video, please consider
subscribing to my YouTube channel,
please like this video, and please click
on the bell to get notifications when I post a new video.
Disclaimer as always, the information shared here
is for educational purposes only,
don't use the information that I'm sharing here
to go and hack a public network that you don't
have permission to hack, only hack networks
that you have explicit permission to hack,
or test networks such as the one that I'm showing you here.
In this example, I'm using EVE-NG
in the cloud, but EVE-NG allows you
to virtualize networks on your laptop,
it's great software, I'd recommend
that you use EVE-NG, or GNS3, or Cisco VIRL
if you wanna learn how to build networks
and virtualize networks on your laptop.
So let's look at this practically.
So on the Windows 10 host, what does
the ARP cache currently look like?
So firstly, ipconfig shows us the IP address of this host.
It has IP address 10.1.1.100, default gateway
is 10.1.1.254, which is the router in this topology.
So here's the router, it's a Cisco router,
but you could use any router if you prefer.
Show IP interface brief.
This is the IP address of the gigabit zero zero interface,
that is the interface connecting the router
to the switch in our topology.
The router has this MAC address on gigabit zero zero.
So show interface gigabit zero zero
shows us that the MAC address is 5001,
triple zero nine, followed by four zeros.
On the Windows 10 host, ARP dash A,
this is the MAC address associated with that IP address.
In other words, this device has learnt
the MAC address of the router correctly.
5001, followed by three zeros and a nine, followed by
four zeros, that's the MAC address of the router.
Now to prove the point, I'm going to delete
the ARP cache on the PC, but before I do that,
let's run Wireshark so that we can see what's going on.
I'm going to run Wireshark on ethernet zero.
That's the ethernet interface connecting
the PC to our network.
So here's our Wireshark capture,
we see a lot of traffic, but I'm gonna filter for ARP.
Windows 10 sends a lot of traffic into the network.
So what I'm gonna do is delete the ARP cache,
and what you'll see is ARP traffic
has been generated in Wireshark.
We can see that this device with MAC address
starting with 5001 is sending a broadcast
into the network, this is an ARP asking
who has IP address 10.1.1.254, tell 10.1.1.100.
Okay, so ipconfig /all shows us that this PC,
our Windows 10 host, has this MAC address.
The local PC with this MAC address
is sending a broadcast into the network
asking for the MAC address of 10.1.1.254.
Notice the target MAC address is blank,
it's a bunch of zeros.
That's because the PC doesn't know
the MAC address of the router.
It's asking for the MAC address of the router,
basically saying, who has this IP address.
The router then replies back, saying,
I have this IP address, and here's my MAC address.
And that's sent as a unicast back to the PC.
So basically, the PC sends a message into the network,
it's broadcast that's flooded by the switch,
the router replies back with it's MAC address,
it's a unicast that gets sent to the PC
so that the PC can learn the MAC address of the router.
Now on the switch, this is a Cisco switch,
show MAC address table, we can see the MAC address
of the PC, and the MAC address of the router.
Those MAC addresses have been learnt by the switch.
The switch currently hasn't learnt
the Kali Linux host MAC address yet.
We can see that the PC is on gigabit zero one,
and the router is on gigabit zero two,
those MAC addresses were learnt dynamically.
So PC is on this interface, router is on this interface.
So on the Kali Linux host, ifconfig, pipe that to more,
IP address of Kali is that, MAC address is this.
I'll ping the default gateway,
just to generate some traffic, cancel that,
on the switch, show MAC address table.
The switch has now learnt the MAC address
of the Kali Linux host.
Okay, so this is where it gets interesting.
In Kali Linux, I'm gonna go to applications,
sniffing and spoofing, and select Ettercap.
I'm gonna go to sniff, I'm using unified sniffing,
because I only wanna sniff one interface,
which is ethernet zero.
So unified sniffing has started,
I'm then gonna go to hosts, scan for hosts,
so we're gonna scan for hosts in the network,
it scanned for 255 hosts in our subnet.
Notice two hosts have been added to the hosts list.
Ettercap has discovered two hosts in our network,
we can view those hosts by going to hosts, hosts list,
and we'll see our two devices.
10.1.1.100 is the Windows PC, 10.1.1.254 is our router.
So I'm gonna add the router to target one.
I'm gonna add the Windows host to target two.
On the windows host, you'll notice a bunch
of our broadcasts have been sent out
from 10.1.1.156, which is our Kali Linux host.
Once again, ifconfig, pipe more,
this is the IP address of the hacking host.
Now that we've discovered the hosts in the network
and specified our targets, next step
is to implement a man in the middle attack,
and we're gonna implement ARP poisoning.
We're going to sniff the remote connections and click OK.
So we are poisoning these two devices.
10.1.1.254 in group one, and 10.1.1.100 in group two.
Back on the Windows host, the device is receiving
ARP messages, stating that this IP address
is using this MAC address.
On the router, show interface gigabit zero zero.
This is the MAC address of the actual router.
5001.0009, note that is different
to what we're seeing here.
This is five double zero one, triple zero two,
not 5001 triple zero nine.
So on the Windows host, if we look at the ARP cache,
so ARP dash A, this IP address
is using the same MAC address as this IP address,
which is our Kali Linux host.
So on Kali, let's start Wireshark
so that we can sniff traffic.
We've implemented a man in the middle attack now,
because when traffic is sent to the router,
it's actually gonna be sent to the Kali Linux host.
On the switch once again,
show MAC address table.
This MAC address is the Kali Linux host,
MAC address is found on gigabit zero zero,
the router, using this MAC address,
is actually found on gigabit zero two.
So the traffic is gonna flow to
the Kali Linux host, and then to the router.
So on Kali I'll start a Wireshark capture on ethernet zero.
We can see a bunch of traffic, but let's filter for telnet.
Now in this example, let's assume
that the administrator made a bad decision
and enabled telnet on the router.
So when I open up PuTTY, I'm gonna use telnet,
I'm gonna telnet to the router, 10.1.1.254.
I'm prompted for a password, which I'll enter and login.
The font is very small, so I'll change that.
So I'll change the appearance of PuTTY,
make this bigger, so there you go.
What you'll notice is I was prompted
for a username and password which I entered,
and I've been able to log in to the router.
I'll type enable to go to privilege mode,
and enter my password, so I'm now
in privilege mode on the router.
And if I type something such as show run, I'll see
the running configuration of the router
displayed on the Windows computer.
However, all that data has been captured
by the Kali Linux host.
Traffic from 10.1.1.100, the PC going to the router.
Scrolling down, we can see a password prompt
as an example, and then we can see the password.
C-I-S-C-O, it's not very easy to see that however,
so I'm gonna right click here and go to follow TCP stream.
And what you'll notice is the password is displayed,
so there's the original password,
in other words the telnet password,
here's the enable password, and here's the full
running configuration of the router,
displayed on the Kali Linux host.
I've been able to capture the entire telnet session
between the host and the router,
because the traffic is going through the Kali Linux host.
We have poisoned the ARP cache on the Windows computer.
Now the same thing is true if we used
HTTP on the Windows PC, so I'll open up
a browser, and browse to the router.
10.1.1.254, and log in with my password of Cisco Cisco.
Back in Kali, I'll search for HTTP.
Now the Windows host is sending HTTP traffic
not just to the router, so I'll filter
for IP address equals 10.1.1.254.
So we see traffic from the Windows PC to the router,
and not to other destinations on the internet.
So scrolling down, we can see that
the router's saying the session is unauthorized,
so the PC is now sending authorization information,
including the username and password to the router.
So we've been able to capture the username and password,
because it sent in clear text from the PC to the router,
you shouldn't be using clear text protocols
in your network today, so in other words
we shouldn't be using telnet, we shouldn't
be using HTTP, we should be using encrypted protocols.
But I've been able to capture the username and password
of the router through telnet and HTTP.
By simply implementing in Ettercap our poisoning attack.
Now a lot of Cisco engineers will back up
the configuration of a router using TFTP.
So we'll use a command such as copy running-config tftp,
and in this example, I'll specify
the Windows host as the TFTP server.
Before I press enter there, on the Windows host,
I'm going to run TFTP 32, which is a TFTP server,
so that TFTP server is now running on the Windows PC.
On the router I'll press enter now to back up
the configuration to the TFTP server.
I'm getting permission denied there,
so lemme try that again.
And I'll specify a different file name.
Back on the TFTP server, here's a problem,
I'll specify security is none.
Once again that's not necessarily a good idea, I'll specify
the desktop as the destination folder, and click OK.
So try that again.
So copy running-config tftp, specify the TFTP server,
specify the file name, and notice you can see
the configuration was copied successfully.
Now that's okay, but back on our Kali Linux host,
I'll filter for TFTP.
And you can see the file name there.
There was a TFTP error, so what I'll do actually
is scroll all the way to the end,
so that we see the successful write.
Here's an acknowledgement of a block of data.
TFTP sends data in blocks, so the sender
will send a block of data, the receiver will send back
an acknowledgement, so there's an acknowledgement
of part of data, here's the actual data
from the router to the TFTP server.
I'll right click on the data, and show packet bytes.
There's the last part of the router's configuration.
So that's okay, but let's see if we can get some passwords,
so scrolling right up to block one, passwords
are at the top of the router configuration.
See here's block one, sent from the router to the TFTP
server, right click, and select show packet bytes.
As you can see there, that's the
enable password of the router.
We can see the entire router configuration
by simply looking at the blocks of data.
See here's block two, look at that block of data.
Here's the Loopback interface IP address,
there's gigabit zero zero's IP address.
Now it's once again bad practice
to use clear text protocols in networks today.
You should be using encrypted protocols wherever possible.
You can also stop this kind of nonsense
in networks today by implementing
dynamic ARP inspection on your switches.
I'll show you how to stop these kind of hacks
in subsequent videos, this video's getting too long.
Now this is a troubleshooting hint.
If traffic is not being forwarded
by your Kali Linux host, type this command.
This command forwards IP version four traffic.
So it basically allows the Kali Linux host,
well any Linux host, to receive traffic
and then forward it on when destined for another host.
So it basically acts as a router.
Receives traffic for another device
and basically sends it back into the network.
See if you have issues forward traffic,
then use this command.
Okay so in this video, I showed you
how to implement a man in the middle attack
using ARP poisoning, using the application Ettercap,
which is available in Kali Linux.
Now once again, if you enjoyed this video,
please consider subscribing to my YouTube channel,
please like this video, and please click
on the bell to get notifications when I post a new video.
I'm David Bombal, and I want to wish you all the very best.
♪ I've been in your waters ♪
(upbeat rock music)
♪ I thought you were my love ♪
♪ I know one thing for sure ♪