In this video, I'm going to show you how to hack Cisco switches using Kali Linux.
In a previous video, I showed you how to get Kali Linux downloaded and installed on a Windows 10 computer.
So have a look at the video which I've linked here or below.
If you haven't got Kali Linux installed and running, I basically show you how to download a pre-built
version of Kali Linux and imported into VMware workstation player, which is free software that allows
you to run Kali Linux on your Windows 10 computer.
All right, without further ado, let me show you how to hack Cisco Networks. In this video
I'm going to demonstrate the use of Yersinia, which is a framework for performing layer 2 attacks.
It allows you to attack multiple network protocols, including spanning tree, CDP or Cisco Discovery
Protocol, DTP or Dynamic Trunking Protocol, DHCP, HSRP 802.1q, 802.1x, ISL and VLAN trunking
protocol or VTP.
So basically this application allows you to hack multiple protocols in Cisco networks, doesn't just
apply to Cisco Networks, but some of these protocols such as CDP, DTP and HSRP are Cisco proprietary
protocols.
So this application is really geared for hacking Cisco Networks, but you could use it for hacking other
protocols and networks that have other vendor devices in it.
Cisco is the biggest networking vendor in the world.
So Cisco switches and Cisco routers will be found in many, many corporate environments around the world.
So I'm going to demonstrate how to hack Cisco devices using Yersenia running in Kali Linux. Now in this
basic network.
I've got a Cisco switch.
This is a catalyst, 29 60 switch.
The reason I'm using a small switch like this is it's fanless, so it doesn't make a lot of noise.
I've got a Windows 10 laptop that I've connected physically to the Ethernet switch on port 1.
I've got a MacBook connected on port 2 these devices are connected via Ethernet cables to the switch.
I've also connected to the console of the switch using a USB connection. In this example
I'm also controlling both of those devices from my local Mac.
It just makes it easier to do the recordings.
So I've got the connection to the MacBook and I'm controlling that via VNC and I'm also controlling
the Windows computer via VNC.
The Windows computer once again is running Kali Linux within VMware workstation player.
OK, so I'm going to open up a terminal
and I'm going to type y e r s tab, and you'll notice nothing happens, that's because this application
is no longer installed by default in this latest release of Kali Linux.
So I'm going to type apt-get updates, to update references on this Kali Linux host, and then I'm
going to say apt-get install yersinia.
So I'm basically installing this application on Kali Linux.
It used to be installed by default, but in this release is no longer installed.
The version of Kelly Linux that I'm using is 2019 three.
You simply need to wait now for the application to install.
OK, so it's now installed, so I'll clear the screen and notice now when I type y e r
S tab, the command auto completes and I can press, dash or hyphen h to get help about the application.
So we're told that we can get the application version number by using uppercase v h displays.
This helps screen G gives us a graphical user interface, I is interactive, uppercase D daemon mode, lowercase
D debug mode.
We've also got some logging options.
So what I'm going to type is Yersenia-G to get a graphical user interface.
Now we're told that this is an alpha release.
That's fine.
For our example, notice once again that multiple protocols are supported.
CDP, DHCP, 802.1q, 802.1x, DTP, HSRP, ISL, MPLS, STP, VTP and we've got a log here. Now in this video
I'm assuming that you have knowledge of these protocols, to be able to hack networks
you need to have an understanding of the protocols that network devices use.
Now if you don't know what those protocols are,
have a look at some of the videos that I've linked below or have a look at my course, in my CCNA course
I teach a lot of these protocols.
You don't have to take my course if you don't want to have a look at other videos on YouTube or other
CCNA courses
but for this video, I'm assuming that you have knowledge of these protocols.
Now, in this example, I'll start PuTTy,
because what I want to do is connect to the console of the Cisco switch and show you how the switch
is being configured, before I do that, we need to know which console port to use.
So I'm going to go to device manager
and here I can see that USB serial device, COM3 is being used, so I'm going to specify COM3
in PuTTy and click open and now I'm connected to this switch.
This switch has not been configured with best practices
and that's a problem because with hacking tools like Kali Linux, if you don't configure a network
device properly, hackers can get access to your network very, very easily.
So if I type sh run on the switch.
It's got two DHCP pool configured.
Port 1 on the switch is configured in VLAN 1 and Port 2 is configured in VLAN 2 in other words,
this laptop is in a different VLAN to that laptop, but we're not going to let that stop us. Scrolling
down
you can see that interface gigabit 01 is configured with defaults.
Very bad idea.
You don't want to use default configurations on a switch, put on a switch.
You should at least shut down ports on a switch that are not in use or put them in a separate VLAN or
stop protocols like DTP being used.
So as an example, show interface gigabit 01 switch port.
What you'll notice is negotiation of trunking is on, current administrative mode is dynamic auto.
We've got DTP enabled on this port.
That's something we don't want to do.
So this command show Interface Port number switch Port shows us that the port is configured in VLAN 1, but DTP
is enabled on that port.
So again, sh run interface gigabit 01,
that's the configuration of port 1,
here's the configuration of port 2, I'll put the switches configuration below the video if you want to have
a look at the switches configuration off-line
but apart from that, this switch also doesn't have routing enabled and that means that there's no routing
from one VLAN to another on the switch, at the moment
VLAN 1 is down because I haven't plugged in my Kali Linux PC.
So let me do that
and what we should notice is the port on the switch comes up and it does so show IP interface brief,
this VLAN is still down, but we can see that interface Gigabit 01 has come up.
So after a while that SVI or switch virtual interface should come up
and there you go,
it's now come up.
So VLAN 1 and VLAN 2 are now configured on the switch, the switch is acting as a DHCP server and allocating
IP addresses to devices in the relevant VLANs, show VLAN shows us that gigabit 01 is in VLAN 1
gigabit 02 is in VLAN 2, the MacBook has been allocated to this IP address 10121 by the
DHCP server.
We can see that on the switch by typing show IP DHCP bindings.
So that IP address has been allocated to the MacBook, according to the switch, this IP address has
also been allocated and that's probably my Windows computer.
Change the font size here to make it easier to see.
So command prompt IP config, this Windows computer has been allocated this IP address, but the PCs
won't be able to ping each other because IP routing is disabled on the switch.
There's no routing from one VLAN to another in this topology.
So on my MacBook as an example, if the MacBook tries to ping the Windows computer, it can't do that
because IP routing is disabled.
There's no routing between the VLANs, but that's not going to stop us once again.
Now, currently, the Kali Linux host
is configured to use NAT, and it's been using my wireless connection to get access to the Internet.
This little network here doesn't have any Internet access.
So what I'm going to do is I'm going to bridge the
Kali Linux host to the Realtek USB Gigabit Ethernet family controller, so I'm going to bridge
it to this Ethernet connection and click, OK.
So in Kali Linux, I'll open up another terminal window IF config will show us the IP address.
At the moment, no IP address has been allocated.
Do that command again and notice 10.1.1.3 has been allocated, so on the switch show IP DHCP bindings,
this IP address has been allocated to the Kali Linux host.
So that means I've got three devices in this topology physical Windows PC, MacBook plus Kali Linux
Virtual Computer.
So let's use Kali now to hack the network.
OK, so
It's already picked up that it's connected to a switch through CDP.
So we already know that we're connected to a Cisco switch, on the Cisco switch show CDP neighbor, it doesn't
see any neighbors at the moment, but what we could do is launch an attack and send a CDP packet and
click OK.
In the log, we can see that an attack was launched and it's now finished.
So back on the switch, show CDP neighbors,
still don't see a neighbor.
So let's flood the CDP table of that switch.
So as you can see, a lot of CDP packets are being sent out on the switch, shows CDP neighbors,
notice we suddenly have a huge amount of CDP neighbors and you can see the platform here is Yersinia.
So we are flooding the CDP neighbor table on the switch.
That isn't really a fantastic attack, but it just shows you that by a simple attack, I can flood the
CDP table of that switch.
Notice how many packets are being sent out.
After a short while, you'll see this has increased dramatically.
The CPU on that laptop is going crazy.
The lights on that switch are going mad.
I am essentially flooding this switch
with a lot of neighbor relationships, so if I type show CDP traffic.
You'll notice a lot of input packets are being received by the switch.
A lot of attack packets, to stop this, go to actions list attacks
and I'm going to say stop all attacks if you want to shut the program down and stop the attack, click
exit, but you probably want to go to action's list attacks
and then you can shut down the attacks. Now, because this network is small,
I mean, there's only one switch in this topology.
I can't show you large scale attacks, but I'll continue showing you some basic attacks, which you
can then apply to larer topologies.
I'll show you larger topologies in separate videos.
Now, very basic attack that can be used is attacking spanning tree.
At the moment in this network show spanning-tree shows me that the switch is the root of the topology.
Gigabit 01 is forwarding on VLAN
1, switch is the root for VLAN, 1, for VLAN 2 switch is also the root.
So VLAN 2 switch is the root, port that's forwarding is gigabit 02.
I only have two ports currently up in this topology port
1 is in VLAN 1.
We can see that with the show VLAN Brief Command.
So Gigabit 01 is currently in VLAN 1, gigabit 02 is configured in VLAN 2, I only have two ports
plugged into the switch.
And again port 1 is in VLAN 1, port 2 is in VLAN 2, show spanning-tree
root
shows us that the current switch is the root for VLN 1 and VLAN 2, we can see the root cost
is zero for both those VLANs.
And again, we can use the show spanning-tree command to see that the switch is the root for VLAN 1
and VLAN 2
but let's change that.
So I'm going to launch an attack.
In this case, it's a spanning-tree attack.
We are going to claim root roll and click, OK.
So Yersenia has picked up that there's a switch in the topology, but we're going to claim to be the
root.
So on the switch show spanning tree.
Notice for VLAN 1, the switch is no longer the root, it has a cost of 4 to get to the root.
We can see that Gigabit 01 is a root port with the cost of four.
Previously the port was a designated port when the switch was the root.
So we've changed the roll to root.
This is the port that the physical switch is going to use to get to the root bridge, which is currently
Kali Linux. For VLAN 2 we can see that the switch is root, notice gigabit 02 is a designated
port.
Now, I won't have time to go through all the protocols.
There's a lot of things you can do just with Yersenia within Kali Linux.
I'll show you other hacks in subsequent videos.