So look at the page seen in the slide.
This is the manual page of the Mac of Command.
Markov is a command line tool, mainly used to flood the switch on a local network with random Mac addresses.
So as I mentioned before, when the switch receives a frame, it creates a new entry in its Mac address
table for these Mac addresses.
Once the switches Mac address table is full and it cannot save any more Mac addresses, it generally
enters into a fail open mode and it starts behaving like a network hub.
So let's see.
Mac of command in action.
So here's a network that I created in three.
Well, the IP addresses are different from the one that I created in the previous lectures.
But not to worry, it's completely identical with that network.
So in addition, I've added some other VMware, VMs, Owasp, Broken Web applications and Metasploitable
in the same way with Kali.
Now, just a little word of caution while you're adding a VMware VM to a Gns3 network, do not forget
to create a new custom network mode such as VM net two because all VMs need a separate custom network
mode.
Remember that?
Okay, so now I'll go to Carly.
Since Carly is a part of the Ns3 network, its network settings is custom, so it's not in Nat mode
right now.
Have a look at the IP address using ifconfig.
Okay, so it's in 192.168.10.0 24 IP block.
So now check the entire network.
I go over to the other VMs and look at the interface configurations.
These are the IP addresses of all the VMs.
Now go to Kali and ping them.
The results are pretty good.
We got the reply packets for ping requests.
So now I open another terminal screen and scan these two VMs and see the open ports and running services.
So I'll simply use the Nmap command with the IP address only so it'll be a Sin scan and the top 1000
ports will be scanned.
Here are the results.
10.11 has nine open ports and 10.12 has 23.
And as you see here, Telnet port of the 192.168.10.12 is open.
So let's go to the VMs.
Dundalk 12 is Metasploitable and 1011 is Owasp BWA.
Now we know the Telnet service is running on Metasploitable.
So to create some traffic and let the switch fill the Mac address table, I'll start up a Telnet connection
from Owasp, BWA to Metasploitable type Telnet and the IP address of Metasploitable.
Enter the username and password which are already given as a welcome message here.
And we got the session.
Okay.
So we can exit now.
Now I'll go to the console of the switch and type show Mac address table dynamic to see the dynamic
records of the Mac address table.
Now here there are six Port and Mac mappings for now.
Run the command again.
And now we have two rows.
So it seems by the look of this that the Mac address table aging is 10 or 15 seconds.
Okay.
You ready for this?
This is the time of Mac flooding.
So now I'm in a terminal screen on Kali.
Have a look at the manual of Mecha command first so type man mac of and hit enter.
Markov is a tool that's used to flood the local network with random Mac addresses.
And here are the options.
I to identify the network interface to attack n to specify the number of packets to send.
D to specify the destination system's IP address, etcetera.
So let's create the command.
Of course, the first command I'll send is Markov.
I the interface that's used to attack.
We'll type that in as eth0.
D the destination the ether switch router.
Now we're ready to run the command.
So hit Enter.
And the flood started and Markov sends tens of packets in seconds.
Now let me go to the ether switch router console and look at the dynamic Mac address table again.
You can call the last command by using the up arrow key.
And as you see, there are a lot of rows for our fast Ethernet one zero port, which is used for Kali.
So while Mac is running, let's run Wireshark and try to listen in to the traffic on the Telnet of Kylie's
own network interface.
Now to see only the telnet traffic type Telnet in the filter box and click the blue button next to the
box.
Okay.
No telnet traffic for now.
Now go back to the VM and telnet to the metasploit VM again.
Telnet the IP address of metasploitable username and password.
Run a command.
Okay, so back to Kali.
You see the Telnet traffic here?
Kylie is neither the source of the traffic nor the destination.
It receives the Telnet traffic.
Now, this is a typical in hub behaviour to send packets to each node.
So we can say that our switch is behaving like a hub now.
Just like we predicted.
So let's go ahead and stop Wireshark and the Mac of command using Ctrl C keys.
You can do that.
These are the telnet packets.
Since Telnet is a clear text protocol by default.
We can see the payload as well as the metadata.
We can see every character in a different packet, so select one of them.
Right click, follow and select TCP stream.
So the red characters here are client packets.
The blue characters are the server packets.
Here's a credential username and password.