If you don't configure your network properly, it's very easy for someone using Kali Linux or another
type of hacking tool to exhaust the IP addresses in a DHCP pool, set up a rogue DHCP server, and then allocate
IP addresses to clients in a incorrect subnet
and what I'm going to show you in this video is how to do that, but also show you how to set up the Kali
Linux host as the default gateway so that traffic from PCs is sent via Kali Linux to the Internet or
to other devices in the network so that we can implement a man-in-the-middle attack.
DHCP, or dynamic host configuration protocol is a fundamental building block in networks today and administrator
which could be you will configure a pool or scope, which is a range of IP addresses that are allocated
to hosts in a specific subnet.
Hosts will send a broadcast typically to request an IP address from a DHCP server, and the DHCP server will
allocate the IP address to the client.
Have a look at this video, which I've linked here below.
If you want to learn more about the fundamentals of DHCP, in that video I'll show you how DHCP is configured,
how IP addresses are allocated to clients.
I'll show you through
Wireshark captures, how messages are sent from a client to server and from a server to a client.
Now, a quick summary of what we are going to do in this video.
We're going to hack DHCP, we're going to exhaust a DHCP pool or DHCP scope.
So that's the first attack.
We're going to set up a rogue DHCP server to allocate IP addresses from the fake subnet,
second attack, third attack
we're going to set the default gateway of clients to Kali Linux.
So when they get an IP address from the rogue subnet, they're going to see the default gateway as the
Linux host
and that allows us to implement a man-in-the middle attack.
So for text right there, then we'll use Wireshark to sniff passwords on the network.
You need to be careful when you configure your network using protocol such as DHCP, make sure that you
configure your network securely and properly.
Otherwise, it's very easy to hack networks that run DHCP.
Now this is one of multiple videos where I'm showing you how to hack networks using Kali Linux.
I don't just want to show you how to break networks.
I want to show you how to protect networks and I'll show you how to do that in subsequent videos
in this series. In previous videos in the series, I showed you how to hack a physical Cisco switch
but I'm traveling at the moment, so I don't want to carry a whole bunch of equipment around with me.
So what I've done is taken that switch or logically, taken that switch and put it into the cloud.
In this example, I'm using EveNG and I've got a Cisco switch as well as a Cisco router.
I've got a Windows 10 computer and I've got Kali Linux.
These devices are connected to the Internet.
This network is running in the cloud
but you could simulate this network on your laptop using GNS3 or EveNG or Cisco VIRL.
In this example, the switch is running a Cisco VIRL iOS image.
The router is running a Cisco VIRL image as well.
Have a look at my EVE-NG videos or my GNS3 videos,
if you want to learn more about how to virtualize networks on your laptop or how to virtualize them
in the cloud.
So let's start with the switch
and here's my console to the switch.
Now, in this example, I'm currently in South Africa, so my connection may be a bit slow to the Northern
Hemisphere.
Hopefully it won't affect this lab
but notice I've connected to a switch, show version shows me that this is a Cisco vios layer 2 switch
running version 15.2.
Now, don't worry too much about the details of the switch.
This is a Cisco switch, but any switch could be used in this topology.
I'm also using a Cisco router, but again, you could use any router here if you wanted to.
So this Cisco router, type show version is a Cisco ios V router running version 15.6 1T.
The reason I'm using a router here is I want to set up this router as a DHCP server.
So if I type show run, that shows me the running configuration of this device and what I want to point
out here is I've configured a DHCP pool, a DHCP pool in Cisco terminology is very similar to a scope.
So it's a range of IP addresses that we're going to allocate to clients in our network.
The subnet that's going to be allocated is 10.1.1.0/24.
So /24 mask is being used.
This is the default gateway.
That is the IP address of the router.
I've set the DNS server to Google, scrolling down,
notice this is the IP address of the Cisco router.
At the moment, this device has its interface shut down.
So what I'll do is no shut that.
That basically enables it.
I'll also enable the connection to the Internet.
Going back to my topology this interface on the router connects me to my internal network and this
interface connects me to the Internet.
So I'll type end here, show IP interface brief.
This is the IP address on the internal interface, interfaces up, up, that means that it's working.
This interface is connected to the Internet.
It's using DHCP.
So this router should be able to, as an example, ping Google.com, which it can and I'll save
the configuration of the router.
Now, again, you don't have to use a Cisco switch or a Cisco router.
The reason I want to use the Cisco switch here is Cisco switches support something called DHCP Snooping
which allows me to stop these kinds of attacks in a network.
I haven't configured anything on the switch at the moment, but in subsequent videos, I'll show you
how to stop this attack
but I firstly want to show you what's possible using Kali Linux.
So I'll open up a console to Kali.
I'm not going to get into the debate about the correct way to pronounce Kali.
Different people pronounce it differently, but for the moment, that's the way I'm going to pronounce
it.
OK, so here's my Kali Linux host, let's check if it got an IP address, it may not have got an
IP address because the routers interface was shut down.
I'll use more here rather than simply showing all the output
and what you'll notice is this device has this IP address, 10.1.1.3, show IP DHCP bindings on the
Cisco router.
We can see that this IP address has been allocated to this Mac address, this command show, IP DHCP
binding basically shows us which IP addresses have been allocated to which Mac addresses.
So this is the Mac address that Kali is supposedly using, 50001.0002.
0000 and back
in Kali, we can see that is the Mac address of this Ethernet interface.
Okay, so what I'm going to do now is start Yersenia using a graphical user interface.
In a previous video, which I've linked here, I showed you how to install this on Kali Linux.
I also showed you how to implement or use lyer 2 attacks using Yersenia
but in this example, I'm going to show you how to use this for DHCP attacks and we're told that this is an
alpha version.
That's ok, so I'm going to click OK, and I'm going to go to DHCP.
We can see some options here
but what I want to do is launch a DHCP attack.
So click launch attack
and we are going to send discover packets using Denial-of-service, now before I do that on the router, show
IP DHCP binding.
We only have one IP address allocated to a client.
Now, the reason why the Windows host hasn't got an IP address yet is it's currently off.
I haven't started the Windows host at this point.
So again, show IP DHCP binding on the Cisco router.
Only one IP address has been allocated.
So in Kali, I'm going to click OK to start a discover denial of service attack
and what you'll see is a whole bunch of DHCP messages are being sent into the network.
You can see this packet-count is going up, on the Cisco router show IP DHCP binding.
What you'll notice is a whole bunch of IP addresses have now been allocated, so 10.1.1.1, 10.1
1.2, 3, 4, and it just carries on.
Basically, Kali Linux has exhausted the DHCP pool on the Cisco router
and as I keep scrolling, what you'll notice is all addresses have been taken from this pool.
There are no IP addresses left in this pool show IP, DHCP, Questionmark, pool.
Let's press enter here.
253 addresses have been allocated from the pool, the reason why it's 253
is the router is using IP address 10.1.1.254.
So this IP address shouldn't be allocated to clients because that's the IP address that the router is
using.
So again, show IP, DHCP pool shows us that at this point we've successfully exhausted the DHCP pool
on the DHCP server.
No IP addresses are going to be available for the Windows 10 client when we started up.
So I'll start that up and I'll open up a console to the Windows device.
It'll take a while for this device to boot up, but once it's booted up fully, we'll see that it won't
get an IP address because we've exhausted the IP addresses in the DHCP pool.
Now, warning I will give you is a lot of packets are being sent into the network that can cause all
kinds of issues.
So don't run this in a production network.
Be careful where you're going to run these attacks.
Notice the number of DHCP, discover messages being sent into the network.
OK, so my Windows PC is booted up, I'm going to open up a command prompt and what I'll do is make
this bigger so the font isn't so small.
It's running really slowly here, and that's probably because of the number of broadcasts being sent
to the network, if I type IP config notice, no IP address has been allocated to this Windows PC.
It's using the default 169.254 IP address range IP config slash renew.
This device is not going to get an IP address because we've exhausted the DHCP pool on the DHCP server, but what
we can do now is launch our second attack.
So I'm going to click launch attack
and let's set up a DHCP rogue server.
IP address is going to be 10.1.1.3.
That's the IP address of our Kali Linux server.
I'm going to allocate IP addresses in the range 10.1.1.100 to 10.1.1.150.
I'll set the least time to 3600 secconds.
Same for renew subnet mask will be
this the default router is now going to be Kali.
It's not going to be the actual router in the network DNS server will set as Google and the domain name.
You probably don't want to use something like hacked.com.
Let's just specify home.com and click, OK.
OK, back on the Windows, host type IP config notice we've been given this IP address 10.1.1
100 and notice this default gateway is 10.1.13.
That's really important the actual default gateway is 10.1.1.254.
Kali Linux is using IP address 10.1.1.3.
So IF Config more shows us that this is the IP address of the Kali Linux host, so the Windows computer
is using Kali as its default gateway.
That's important because when the Windows host sends traffic to the Internet, that traffic is going
to go via Kali to this router, onto the Internet.
So as an example, the router has this loopback interface configured on it of 1.1.1
.1 that's essentially a loopback or imaginary interface on the router that allows us to add a
subnet to the router. The PC at the moment, won't be able to ping that loopback address because the
traffic is going through the network to Kali
but Kali is not forwarding that traffic to the router.
We need to type a command on the Kli Linux host to forward the traffic.
So, again, notice the pings are failing.
So in Kali, we going to type sysctl
-w. net ipv4 IP_forward=one.
Basically, we're going to allow the Linux host to forward traffic that's sent to it.
So on the Windows PC ping, 1.1.1.1 now works.
That traffic is going via the Kali Linux server and we can see that by going to applications, sniffing
and spoofing,
wireshark.
So Wireshark will allow us to see the traffic being sent on the network.
I'm going to capture traffic on Ethernet 0 and I'll filter this for ICMP traffic.
So back on the Windows PC, if I ping 1.1.1.1, we can see that traffic
from the PC to the router.
We see a bunch of ICMP redirects, but essentially the traffic is being sent through Kali to the router.
We only see half the conversation, but we can see the pings
and this is the important piece.
Let's assume the administrator of the router did something very stupid and allowed Telnet connections.
So on the Windows PC, I'm going to telnet to the router to administer the router, we should actually
be using SSH.
So before I click, OK.
Let's filt for Telnet in Wireshark
and I'll click open in PuTTy.
Now, that font is very small, but I'll enter the password and log in.
So I've changed the font now, basically the router prompted for a password, which I entered and I'm
now in what's called user mode type enable, enter my password, and I'm in privileged mode.
But noticing Kali, now, I can see Telnet information, including the password, here's the password C
i
s c o, Cisco.
Now, that's not such an easy way to view it
so I'm going to
right
click on a packet and click follow TCP stream
and what you'll notice there, there's the first password I typed enable there's the second password,
which is Cisco.
So I was able to see the password that was transmitted from the Windows host to the router because the
traffic is being sent through the Kali Linux host to the router.
So that is an example of a man in the middle attack, now on the PC
I'll open up a Web browser
and what I'll do in Kali
is specify HTTP.
So let's look at HTTP traffic.
You should be using HTTPS, most websites use HTTPS, but again, if I connect to the router and put
in my username and password using HTTP and sign in.
I can log into the router and I'll be able to view information on the router, such as monitor the
router by using command on the router.
So I could type show IP interface brief as an example and execute that command on the router using HTTP
But back in Cali, you'll notice I'll be able to see all the traffic from the PC to the router.
And one of the things I want to point out here is notice authorization there, all of the credentials,
username and password used to log into the Cisco router.
Again, that's a man in the middle of tech, the PC sending the traffic to its default gateway, which
is the Kali Linux host, which is sending it to the router
but we could connect to the Internet.
So on the Windows PC, I'll open up another tab.
Most websites are now using encryption.
One of them that's not which is really bad is Oxford University, oxacuk.
That website is using HTTP not HTTPS notice it says not secure in the output here.
Very bad.
Your connection to the site is not secure.
We've been told.
So back in, Kali, we can see traffic sent from the Windows 10.1.1.100 to 129
67. 242. 154 which is the Oxford University website now, at least here
on their website when you try and log in.
So go to Oxford students as an example, they are now using encryption, so only part of their website
is in clear text we should be using HTTPS today
but the point is, I can see part of their website through Kali Linux by using this man in the middle
attack.
You should always make sure that your traffic is encrypted and that you're using a valid certificate. a
So it's really important that you verify that the certificate is a good certificate that it's been
issued correctly, that it's not a rogue certificate.
So make sure that your traffic is encrypted, especially if you're using wireless hotspots or open networks,
make sure that the certificate is valid because the traffic could be going through a device such as
Kelly Linux.
Don't just connect to any network.
Make sure that networks that you connect to are good.
Make sure that you use a VPN or some kind of encryption mechanism so that your traffic is not sent in
clear text.