WEBVTT 00:00:02.740 --> 00:00:03.410 In this demo, 00:00:03.410 --> 00:00:06.400 we're going to perform a man‑in‑the‑middle attack by sniffing the 00:00:06.400 --> 00:00:08.580 network for credentials using ARP poisoning. 00:00:09.220 --> 00:00:11.830 We will then use the credentials we gather to establish a 00:00:11.830 --> 00:00:14.550 foothold in the network to escalate our attack. 00:00:17.500 --> 00:00:19.710 We are going to start off on our Windows attack system, 00:00:19.720 --> 00:00:23.650 which has Cain installed on it, and it's connected to the Globomantics network. 00:00:24.080 --> 00:00:27.320 Let's go ahead and open Cain. For this attack, we will take 00:00:27.320 --> 00:00:31.080 advantage of both the Network and the Sniffer tabs. 00:00:31.410 --> 00:00:33.170 We will start with the Network tab. 00:00:33.830 --> 00:00:36.560 This feature of Cain allows us to perform some 00:00:36.560 --> 00:00:39.800 enumeration activities, as well as take advantage of the 00:00:39.810 --> 00:00:42.240 Abel tool in the Cain and Abel suite. 00:00:42.330 --> 00:00:45.570 Let's start by expanding out the Microsoft Network to view the Windows 00:00:45.570 --> 00:00:50.010 systems connected to the network. Click on the Microsoft Network, and then 00:00:50.010 --> 00:00:52.890 expand out the WORKGROUP, and click on Computers, 00:00:53.340 --> 00:00:55.900 which will show a list of available systems to target. 00:00:56.540 --> 00:00:59.120 You will see our attack system is included in the list 00:00:59.390 --> 00:01:00.930 as we are connected to the network. 00:01:01.320 --> 00:01:04.519 From here, we can explore some of the systems we want to target. 00:01:04.800 --> 00:01:09.360 We're going to click on the GLOBO‑PC‑01 and expand Anonymous, 00:01:09.710 --> 00:01:14.000 which will give us the ability to review groups and users set up on the system, 00:01:14.180 --> 00:01:16.870 among other information that we can use to gather 00:01:16.870 --> 00:01:19.050 information to exploit the system. 00:01:19.740 --> 00:01:20.990 What you will see, however, 00:01:21.130 --> 00:01:24.540 is that when we click on the information to enumerate, we are prevented 00:01:24.540 --> 00:01:27.580 to do so because we are unauthorized on the system. 00:01:28.160 --> 00:01:31.590 To really take advantage of this feature and further our exploit, 00:01:31.980 --> 00:01:34.100 we will need valid credentials on the system. 00:01:36.640 --> 00:01:39.160 So let's start our man‑in‑the‑middle attack to get 00:01:39.160 --> 00:01:40.650 some credentials which we can use. 00:01:41.140 --> 00:01:44.410 Let's go ahead and click on the Sniffer tab. Here we'll see a list 00:01:44.410 --> 00:01:46.710 of all the systems on the network from our scan. 00:01:47.730 --> 00:01:49.680 This will allow us to get more information about the 00:01:49.680 --> 00:01:52.250 systems so we know which ones to target. 00:01:52.810 --> 00:01:55.870 Go ahead and highlight all of them by clicking on the top and 00:01:55.870 --> 00:01:59.220 bottom entries while holding the Shift key and right‑click 00:01:59.230 --> 00:02:01.750 and select Resolve Host Names. 00:02:02.390 --> 00:02:05.350 This will give you a better idea of the systems to target. The 00:02:05.350 --> 00:02:07.630 Globomantics intranet server looks interesting. 00:02:07.720 --> 00:02:12.970 Let's target traffic to and from that system. Click on the ARP tab and then go 00:02:12.970 --> 00:02:16.900 up to the blue plus sign to see the devices to initiate the man‑in‑the‑middle 00:02:16.900 --> 00:02:20.380 attack against. Click on our intranet system first. 00:02:20.790 --> 00:02:22.050 That will highlight our target. 00:02:22.940 --> 00:02:24.150 Now in the left box, 00:02:24.350 --> 00:02:28.430 you can choose the second system to perform the ARP poison against. Let's 00:02:28.430 --> 00:02:32.150 choose the GLOBO‑PC‑01 system we were looking at earlier. 00:02:32.830 --> 00:02:37.480 Now you will see all choices are added as an entry to perform ARP poison 00:02:37.480 --> 00:02:41.710 against. Click on it and select the yellow and black ARP poisoning button 00:02:41.960 --> 00:02:44.250 from the toolbar next to the Sniffer icon. 00:02:44.740 --> 00:02:48.500 We have begun to poison our systems so that any traffic between the two 00:02:48.500 --> 00:02:52.070 systems will now be routed through our attack system and Cain. 00:02:54.450 --> 00:02:57.780 Now I'm going to swap over to our GLOBO‑PC‑01 victim system 00:02:57.960 --> 00:03:01.680 to simulate a connection to the server, which houses the corporate intranet site. 00:03:02.320 --> 00:03:06.100 I'm going to go ahead and open a web browser as the victim and 00:03:06.100 --> 00:03:09.120 navigate to the corporate intranet site like I normally do every 00:03:09.120 --> 00:03:11.970 morning. And because this is an intranet site, 00:03:12.080 --> 00:03:13.850 I am prompted for my credentials. 00:03:14.450 --> 00:03:18.640 I'll enter them here with the username of user1 with a 00:03:18.640 --> 00:03:20.950 very secure password of password. 00:03:24.240 --> 00:03:25.070 And here we go. 00:03:25.080 --> 00:03:28.600 Just like normal, the corporate intranet site opens, and I am none the 00:03:28.600 --> 00:03:30.860 wiser that anything out of the ordinary has happened. 00:03:31.640 --> 00:03:35.570 Let's close our victim's browser and head back over to our attack system to 00:03:35.570 --> 00:03:40.260 assess the damage we have caused. Back on our attack system, you'll see our 00:03:40.270 --> 00:03:44.900 ARP poison attack is still ongoing with an increased number of packets between 00:03:44.900 --> 00:03:46.850 the two victims being collected by Cain. 00:03:47.530 --> 00:03:51.900 I'm now going to click on the Passwords tab below, and you will see that we 00:03:51.900 --> 00:03:55.310 have a number of HTTP passwords that have been captured. 00:03:55.740 --> 00:04:01.010 We will click on the HTTP and see what we have gathered. Here you 00:04:01.010 --> 00:04:03.720 will see our connections between our victims and columns 00:04:03.720 --> 00:04:06.540 highlighting both the username and the password that our victim 00:04:06.540 --> 00:04:08.650 submitted to the corporate intranet server. 00:04:09.440 --> 00:04:12.220 Let's now take these credentials back to our Network tab 00:04:12.270 --> 00:04:14.860 to enumerate the GLOBAL‑PC‑01 machine. 00:04:15.340 --> 00:04:18.450 We will click back on the Network tab and expand out our network. 00:04:20.579 --> 00:04:23.630 However this time, we will right‑click on GLOBAL‑PC‑01 00:04:23.630 --> 00:04:26.040 system and click the Connect As option. 00:04:26.840 --> 00:04:29.380 We enter the credentials we gathered from our man‑in‑the middle 00:04:29.380 --> 00:04:35.010 attack with the username of user1 and the password of password and 00:04:35.010 --> 00:04:37.760 click OK. Now when we start to enumerate, 00:04:37.760 --> 00:04:41.290 we'll no longer get errors, but rather enumerate the victim system, 00:04:41.490 --> 00:04:44.770 showing both the groups on the machine, as well as a number of user 00:04:44.770 --> 00:04:48.520 accounts which we can harvest credentials from. This will end our 00:04:48.520 --> 00:04:52.400 demo where we learned how to use a man‑in‑the middle attack to gather 00:04:52.410 --> 00:04:55.730 credentials that we can use to establish a foothold in the network to 00:04:55.740 --> 00:04:56.710 escalate our attack.