So let's see how we can perform a starvation attack and consume the DHC people using Yersinia Yersinia
is a network tool designed to take advantage of some weaknesses in different network protocols.
The protocols currently implemented in your cinema are shown in the slide.
Now we're going to use our VMS in that mode during this demo.
So I'm on my host machine and over the virtual machine library.
This is the Colly that I'll use to click this icon to see the VM settings, click the network adapter
icon, it says Internet is shared with my Mac.
So if you look the explanation in the right hand side of the frame, it means the VM is in that mode.
So this is what we want.
So just leave it as it is.
The Connect Network adapter is selected so Colly is ready to use within that network connection.
So Windows eight is the other VM that I'll use to demonstrate DHP starvation attack.
Let's have a look at the network settings of Windows as well.
Yeah, it's in that mode and the network adapter is connected.
So I'll disconnect the network adapter by clicking here because I just want to show you that the DHP
of VMware is working properly.
So I want to add a second network interface for my window system click show all and go to the settings
menu and click on ADD device that the upper left hand corner select network adapter and click add the
details of the new adapter listed here in that mode is selected by default already.
So uncheck the Connect Network adaptor box for now.
OK, so as you see, we have two network adapters for the Windows system, both of them are in that
mode and are disconnected.
So now I'll start the Windows eight system.
And sure enough, it's ready.
Right, click on a network icon at the lower right corner and Select Open Network in Sharing Center.
And right there, we don't have an active network at the moment.
That's to be expected.
So now I connect the first adapter and activate the network.
In VMware Fusion, you can see and change the setting in several ways if you use the VMS and full screen
mode like I do, just go to the upper side for VMware fusion menu.
There it is.
And if the menu does not appear, just press command control buttons together.
Right.
So this is the default setting of VMware Fusion to turn back to the host system when you're inside of
VM.
And these are the network adapters, when you click on them, you'll see the short menu for network
adapter and here you can connect or disconnect the network adapter chains, the network mode, Nat Bridge
or host only.
And you can use this pop up for the network adapter settings.
Now, the second way to see and change the network settings is to click the settings icon, then select
the adapter to see the settings.
So the third way is to go to the virtual machine menu.
Go to the network adapter and you'll see the short menu of the adapter.
Now go to the first network adapter icon and click on the Connect Network adapter menu item, and now
you see in the network and sharing center window, we now have an active network connection.
So click the network name and the details button.
Here are the connection details and right there, there it is, DHP is one seven two one six eight nine
nine that 204 and it assigned an IP address for the PVM 172 dot one six eight nine nine two two one,
as well as the Gateway and the DNS address.
Now, I'll go back to Cali and open a terminal screen.
Using the F config command to see the network interface configuration, and sure enough, it has the
IP address.
So paying the Windows eight system to validate the network two to one.
OK, we receive the ICMP reply, so everything looks OK.
Now, is it time for your Cynthia to type man, your Cynthia and hit enter to see the menu?
And right here in the manual, Yersinia is a framework for performing layer two attacks.
And here's a list of protocols implemented in your Cynthia.
Scroll down, you'll see the options we can use uppercase G to start a graphical interface.
So let's go ahead and use it in graphical mode.
Press Q To quit from the manual and turn back to the terminal now type Yersinia Abrogates Gee and Press
enter.
So this is a graphical user interface of Yersinia.
Before running the attack, let's open Wireshark and monitor the network packets to see what happens
when we start the attack.
You can type Wireshark in terminal to start it or just click the Wireshark icon to select the interface
to listen double click e0.
And to discard the different packets and focus only on the DHC packets, we can filter the packets in
the filter box type boot P and hit enter.
So Boot P is the short form of bootstrap protocol, which I mentioned earlier.
It's basically a computer networking protocol to automatically assign an IP address to network devices
from a configuration server.
And obviously it's used by the DHP server.
Now we can turn back to your Cynthia and prepare and run the attack.
So quick launch attack, that's the length of the upper left hand corner.
The tabs in the window are the implemented protocols, choose DHP and select sending Discover packet
now click OK.
As soon as we click the button, your seniors start sending dozens of requests in a second, it'll keep
sending the packets till we stop the attack.
Now, look at the Wireshark window, these are the Discover packets sent by Yersinia.
So now, while Yersinia is sending the Discover packet, let's activate the second interface of the
Windows VM and let's see if the DHP server assigns an IP address for the second interface.
All right, so we're in the windows VM now go to the second network adapter, click Connect Network
Adapter two to activate the second interface.
Now, do you remember what happened when we activated the first interface, we saw the new network activated,
but now there is still no network because the server is busy replying to the request created by your
Synthia, it's not going to answer the Windows eight second interface.
So let's turn back to Cali and stop the attack.
In your city is interface, just click list attacks and then click, stop or stop all.
And the Wireshark window, look at the bottom of the package list, we now have a complete DHC sequence.
Discover, offer, request and ask packet's.
In the Windows eight pvm, we now have the second network, the first one was either net zero to this
one is either net zero.
Click on it.
In the status window, click on details, the second interface has an IP address now assigned by the
server.