Although this we'll find out in a little, well we know the IP's of the routers that interconnect our company ...
Here:
RS: The router that connects to Internet resources, has 2 interfaces:
· LAN: 192.168.43.254
· WAN: xxx.xxx. xxx.xxx (this is public, of course)
RC: It is the headquarters router connecting resources headquarters and offices:
· Interface1: 192.168.4.111, Central connects Resources
· Interface2: 172.28.0.111, Central Office Connect 1 and Office2
RO1 : The Office Router 1, which connects central
· Interface1: 172.28.0.112 1 and connecting central office
· Interface2: 192,168,200,111 network connecting Office1, come on, it will be the gateway for people
ficina1
RO2: The router that connects to the Central Office 2
· Balance 1: 172.28.0.113 2 and connecting Central Office
· Balance 2: 10.0.0.111 connecting network connecting Office2, come on, it will be the gateway for people
Office2
ATTACKING : Linux machine located in central
· Interface1: 172.28.0.66 and 172.28.0.111 gateway
Another
Graph ... one more to see it more clearly:
The attack consists of passing traffic offices by the attacker's machine by sending RIP updates to the routers of topology for this machine 172.28.0.66 (attacker) misrepresent your IP and send those updates to the routers R01 and R02 posing RC packets to send them to the routers involved indicate that access to the Internet or corporate network resources, the best way to get there is by himself ... then re-routed traffic to the real destination of the packets and send them back answers back to the legitimate origins.
The ip target of the attack will be 10.0.0.55, which is located in the Office2 network, this computer connects to a website usually important for your daily work ...
http://www.wadalbertia.org/phpBB2/index.php
To achieve the objective, the attacker needs to know:
Ip origin: our victim ip 10.0.0.55
· IP destiny: these forums ... 67,225,138,174
really need the destination network ... 67.225.138.0/24 may well be, but in this example we use only the IP.
also need to know or be sure that the metrics into the network from source is greater than 1, since if an office router 2 could do three things:
a) Balancing load, 50% of the packets would go through the interface of the router and the other half of the attacker's machine
b) Use only the router interface office 2
c) Use only the attacker's machine.
here we can find a simple path routes to the victim and another path to wadalbertia, jumps and will join the metrics that apply Office2 router.
Man, this we knew before, we have some wonderful cartoons, but of course ... not always be like this, right?
Well, to see more clearly, let us as if we were on the machine and launch a sniffer 10.0.0.55 to RIP ... called ass (no. .. not ass like their meaning indicates ) Autonomous System Sniffer is certainly not just for RIP, but here we will use for it.
We see that to reach the network 172.28.0.0 (which is supposed to be where the attacker) needs a jump, while to go to other networks requires 2 or 3 jumps .. . therefore, if we tell you to go to wadalbertia is needed and is just a hop by 172.28.0.66 (ip of the attacker) swallow it ....
Now let's see it from the standpoint of the attacker ...
First we ip traceroute to 10.0.0.55 (victim), then another traceroute to wadalbertia (Destination network that we want to get in the middle)
Note: The output of traceroute to wadalbertia I stopped before the end,
If you notice, since the attacker will go through the routers 172.28.0.111 and 172.28.0.113 to reach the 10.0.0.0 network, recalls that the router 172.28.0.113 is the network connecting us to the victim ...
To reach wadalbertia, passed by the routers and 192.168.4.254 172.28.0.111 (and more ... but as I told you I stopped before the end because the rest of jumps not interest us)
So you'll need at least two jumps, so if you get "Teach" the router 172.28.0.113 wadalbertia that to go to instead of two breaks need only one, the thing is clinched.
If we run the esniffer from "our" position, we will be a better idea of \u200b\u200btopology ... almost, almost like the graphics (almost)
One thing before you get the screenshot, leave a minute or less esniffer running, DO NOT KNOW WHY?? Cona, the RIP updates, the 30 seconds of rigor and all that ... I explained that this before
Well, will some antics, ones and twos, and RIPv1 packets that are RIPv2 respectively ... let's see:
as viewed on the screen above, clearly found as routing, routers, neighbors, Ip's, metrics ... we all ....
Well, now we have to prepare the attack ... inject a packet destined for 172.28.0.113 (10.0.0.0 network router) 172.28.0.111 making us go through (next hop 10.0.0.0 network), telling him to go to Wadalbertia (67225138174) is going "better "(Measure 1) by 172.28.0.66 (attacker's machine)
AND ALL traffic of 10.0.0.55 Wadalbertia bound by our machine will
BUT BEFORE! Before, if we want the victim network get answers, we must put our IP as the source of the packets and not the victim! We do not do that if NAT outbound traffic will pass by us but not back ...
And how do NAT in Linux?? Of course, man of course ... IPTABLES!
therefore BEFORE injecting anything:
· Enable forwarding:
echo 1> / proc/sys/net/ipv4/ip_forward
RS: The router that connects to Internet resources, has 2 interfaces:
· LAN: 192.168.43.254
· WAN: xxx.xxx. xxx.xxx (this is public, of course)
RC: It is the headquarters router connecting resources headquarters and offices:
· Interface1: 192.168.4.111, Central connects Resources
· Interface2: 172.28.0.111, Central Office Connect 1 and Office2
RO1 : The Office Router 1, which connects central
· Interface1: 172.28.0.112 1 and connecting central office
· Interface2: 192,168,200,111 network connecting Office1, come on, it will be the gateway for people
ficina1
RO2: The router that connects to the Central Office 2
· Balance 1: 172.28.0.113 2 and connecting Central Office
· Balance 2: 10.0.0.111 connecting network connecting Office2, come on, it will be the gateway for people
Office2
ATTACKING : Linux machine located in central
· Interface1: 172.28.0.66 and 172.28.0.111 gateway
Another
Graph ... one more to see it more clearly:
The attack consists of passing traffic offices by the attacker's machine by sending RIP updates to the routers of topology for this machine 172.28.0.66 (attacker) misrepresent your IP and send those updates to the routers R01 and R02 posing RC packets to send them to the routers involved indicate that access to the Internet or corporate network resources, the best way to get there is by himself ... then re-routed traffic to the real destination of the packets and send them back answers back to the legitimate origins. The ip target of the attack will be 10.0.0.55, which is located in the Office2 network, this computer connects to a website usually important for your daily work ...
http://www.wadalbertia.org/phpBB2/index.php
To achieve the objective, the attacker needs to know:
Ip origin: our victim ip 10.0.0.55
· IP destiny: these forums ... 67,225,138,174
really need the destination network ... 67.225.138.0/24 may well be, but in this example we use only the IP.
also need to know or be sure that the metrics into the network from source is greater than 1, since if an office router 2 could do three things:
a) Balancing load, 50% of the packets would go through the interface of the router and the other half of the attacker's machine
b) Use only the router interface office 2
c) Use only the attacker's machine.
here we can find a simple path routes to the victim and another path to wadalbertia, jumps and will join the metrics that apply Office2 router.
Man, this we knew before, we have some wonderful cartoons, but of course ... not always be like this, right?
Well, to see more clearly, let us as if we were on the machine and launch a sniffer 10.0.0.55 to RIP ... called ass (no. .. not ass like their meaning indicates ) Autonomous System Sniffer is certainly not just for RIP, but here we will use for it.
We see that to reach the network 172.28.0.0 (which is supposed to be where the attacker) needs a jump, while to go to other networks requires 2 or 3 jumps .. . therefore, if we tell you to go to wadalbertia is needed and is just a hop by 172.28.0.66 (ip of the attacker) swallow it ....
Now let's see it from the standpoint of the attacker ...
First we ip traceroute to 10.0.0.55 (victim), then another traceroute to wadalbertia (Destination network that we want to get in the middle)
Note: The output of traceroute to wadalbertia I stopped before the end, If you notice, since the attacker will go through the routers 172.28.0.111 and 172.28.0.113 to reach the 10.0.0.0 network, recalls that the router 172.28.0.113 is the network connecting us to the victim ...
To reach wadalbertia, passed by the routers and 192.168.4.254 172.28.0.111 (and more ... but as I told you I stopped before the end because the rest of jumps not interest us)
So you'll need at least two jumps, so if you get "Teach" the router 172.28.0.113 wadalbertia that to go to instead of two breaks need only one, the thing is clinched.
If we run the esniffer from "our" position, we will be a better idea of \u200b\u200btopology ... almost, almost like the graphics (almost)
One thing before you get the screenshot, leave a minute or less esniffer running, DO NOT KNOW WHY?? Cona, the RIP updates, the 30 seconds of rigor and all that ... I explained that this before
Well, will some antics, ones and twos, and RIPv1 packets that are RIPv2 respectively ... let's see:
as viewed on the screen above, clearly found as routing, routers, neighbors, Ip's, metrics ... we all .... Well, now we have to prepare the attack ... inject a packet destined for 172.28.0.113 (10.0.0.0 network router) 172.28.0.111 making us go through (next hop 10.0.0.0 network), telling him to go to Wadalbertia (67225138174) is going "better "(Measure 1) by 172.28.0.66 (attacker's machine)
AND ALL traffic of 10.0.0.55 Wadalbertia bound by our machine will
BUT BEFORE! Before, if we want the victim network get answers, we must put our IP as the source of the packets and not the victim! We do not do that if NAT outbound traffic will pass by us but not back ...
And how do NAT in Linux?? Of course, man of course ... IPTABLES!
therefore BEFORE injecting anything:
· Enable forwarding:
echo 1> / proc/sys/net/ipv4/ip_forward
· We originally nat:
iptables-t nat-A POSTROUTING-o eth0-s 10.0.0.55-j SNAT - to
-source 172.28.0.66
Y ZAS! ALL IP traffic between 10.0.0.55 and Wadalbertia go through our machine (when we inject the package) and also be able to capture traffic back to the network and give the victim
Now, if ... a packet generator, we use the one we want, Buan nemesis is an option, but one also specializes in RIP, is called Srip
What
we will do is:
Srip -2-n-g 255.255.255.0 172.28.0.111 172.28.0.66 172.28.0.113 67,225,138,174 1
What:
-2 (RIP version 2 )
-n 255.255.255.0 subnet mask
172.28.0.111 IP-g router or gateway to forward the packet ip-spoofing)
machine 172.28.0.66
next hop 172.28.0.113
Router to which the package will be sent
67,225,138,174 or IP network is reached via 172.28.0.66
1 Metrics (number of hops)
and update the router's routing table with that input 172.28.0.113 ... accept it because it comes from 172.28.0.111, but confirm the origin of the package will arrive ....
Let's see what happens BEFORE injecting the packet, 10.0.0.55 suppose that the machine makes a trace route to wadalbertia (output cut)
AND AFTER now injecting the package: 
As you can see there is a jump "extra" machine that we 172.28.0.66 nosotros Si ponemos un esnifer y la máquina Linux para capturar contraseñas y eso, pues.... está claro, no?
Por cierto... ahora nuestros en nuestros foros la contraseña ya no viaja en texto plano,
El usuario, si se ve en texto plano... “ pepillo ”
Y el password en md5 que era... “ eldelospalotes ”
En fin, espero que haya sido de interés, he de decir que este fin de semana nos entretuvimos un poco en clase con este asunto, come to know ... more than one student of mine goes here ... not you? Haha, what a topic ... between this, the session hijacking and STP, go weekend that we spent. Greetings, my students also
PD:
ass (part of the suite of IRPAS) you can find it at:
http://www.phenoelit-us .org / irpas / download.html
Srip (C source, you have to build it) at:
http://packetstormsecurity.org/groups/horizon/srip.c
Ayy! I forget that "solutions" ...
* Authenticate using CHAP RIP
* Mute router interfaces that should not be sending updates, eg the ethernet (interfaces passive and / or ACLS)
* Filters and access lists UDP port 520 and / or multicast addresses
* validate the source of the packets
* Using static routes (when possible)
* Use protocols "stronger" as OSPF (which is also vulnerable to such attacks, but something more complex)
* Monitor ... traceroute betray a simple matter.
Routing Protocols. Attacking RIP (Part1)
Routing Protocols. Attacking RIP (Part2)
Author: Vic_Thor
Published in: www.wadalbertia.org
0 comments:
Post a Comment