MITM ARP Poison Attack - Simms-teach

CIS 76 MITM via ARP PoisoningMITMARP PoisonAttackDRAFTLast updated 9/4/20171

CIS 76 MITM via ARP PoisoningAdmonition2

CIS 76 MITM via ARP PoisoningUnauthorized hacking is a crime.The hacking methods and activitieslearned in this course can result in prisonterms, large fines and lawsuits if used inan unethical manner. They may only beused in a lawful manner on equipment youown or where you have explicit permissionfrom the owner.Students that engage in any unethical,unauthorized or illegal hacking may bedropped from the course and will receiveno legal protection or help from theinstructor or the college.3

CIS 76 MITM via ARP PoisoningInternet“Server yand 1EH-WinXP-xx“Microlab sEH-pfSense-xxgatewayand firewallVictimEH-Win7-xxVictimEH-Pod-xx"EH-Pod-xx Network"10.76.xx.0/24.dhcpEH-Lolli-xxVictim4

CIS 76 MITM via ARP PoisoningRequirements1. EH-Centos VM running with vsftp installed on uLabnetwork.2. OWASP VM at Baseline snapshot.3. WinXP at Baseline snapshot.4. pfSense VM at Baseline snapshot.5. Cain and Abel software for WinXP VM6. Older release of Wireshark for WinXP VM.5

CIS 76 MITM via ARP PoisoningToolsCain and Abel siteWireshark hark.org/download.htmlThese websites are for reference only. No need to downloadanything from them for this exercise.6

CIS 76 MITM via ARP PoisoningMan in the Middle Attack via ARP poisoningEH-WinXP-xxgatewayftp ctimEH-OWASP-xxIn this scenario the WinXP attacker will use Cain to poison the ARPcaches on the pfSense firewall and the OWASP VM. The WinXP VMwill intercept and sniff traffic between the OWASP and Centos VM.Wireshark will be loaded on the WinXP VM to see how the ARPpoisoning is accomplished.7

CIS 76 MITM via ARP PoisoningOWASP VMPing EH-Centosfrom your OWASPVM to testconnectivity.Check the arp cacheto show the MACaddress of yourrouter.ping -c1 172.30.10.160arp8

CIS 76 MITM via ARP PoisoningOWASP VMftp to EH-Centos andlogin as anonymous withany password.Change to passive mode,descend and list thecontents of the pubdirectory.ftp 172.30.10.160anonymousNotSoSecretpassivelscd publs9

CIS 76 MITM via ARP PoisoningOWASP VMConfirm you candownload the admonitionfile.get admonitionexitcat admonition10

CIS 76 MITM via ARP PoisoningWinXP VM1) Use:Start Run . \\172.30.10.36\depotto connect to the depot file share2) Open the "Cain and Abel" and "Wiresharkfor XP" folders and drag their setup files toyour desktopWireshark-win32-1.10.0ca setup11

CIS 76 MITM via ARP PoisoningWinXP VMOpen theWireshark-win32-1.10.0file on your desktop andinstall Wireshark.You can ignore the XPwarning.Take the setup defaults.12

CIS 76 MITM via ARP PoisoningWinXP VM1) Open the ca setup file onyour desktop and install Cainand Abel.2) When prompted aboutreinstalling pcapclick Cancelsince this was alreadyinstalled by Wireshark.13

CIS 76 MITM via ARP PoisoningWinXP VMNote: If you seeport 4444 trafficyou have malwarerunning fromtheprevious lab.Revert WinXP to theBaseline snapshot.1) Give yourself some more screen real estate:Right click on screen select Properties Settings Tab slide ScreenResolution to 1024 by 768 pixels.2) Run Wireshark and start a capture:Start All Programs Wireshark Click on Start (after the "green fin")You can deselect Packet Bytes under the View menu for more room.14

CIS 76 MITM via ARP PoisoningWinXP VM1) Using the Control Panel disable the Windows Firewall.Start Control Panel Security Center Scroll down andclick "Windows Firewall" Off (not recommended)2) Run Cain: Start All Programs, run Cain.15

CIS 76 MITM via ARP PoisoningWinXP VM131) Start by clicking (and depressing) theSniffer icon button on the top ribbon.2) Click OK on the Configuration dialog boxthat comes up next.3) Then click the Sniffer tab above.4) Then click on the Hosts tab below.4216

CIS 76 MITM via ARP PoisoningWinXP VMRight-click on the empty tableand select Scan MAC addresses17

CIS 76 MITM via ARP PoisoningWinXP VMMake sure you can see youpfSense and OWASP VMs. Takenote of their MAC addresses.18

CIS 76 MITM via ARP PoisoningWinXP VMThe MAC addresses fromthe scan should show upas an ARP Response inWireshark19

CIS 76 MITM via ARP PoisoningWinXP VMIn Wireshark you will see your WinXP VM has sent out ARP requests for every IPaddress on your pod subnet.20

CIS 76 MITM via ARP PoisoningWinXP VMClick on the radioactive APR (ARP Poison Routing)tab at the bottom.21

CIS 76 MITM via ARP PoisoningWinXP VMClick inside this tablethen click the icon.22

CIS 76 MITM via ARP PoisoningWinXP VM1) Select your pfSense VM on the left.2) The select your OWASP VM on the right.3) Then click OK.23

CIS 76 MITM via ARP PoisoningWinXP VM1) Confirm the two addresses above are yourpfSense and OWASP VMs2) Then click the APR button to start poisoning.The Status will change from "Idle" to"Poisoning".24

CIS 76 MITM via ARP PoisoningOWASP VMping -c1 172.30.10.160Ping EH-Centosfrom your OWASPVM to testconnectivity.Notice the OWASPARP cache no longerhas the real MACaddress for thepfSense VM!25

CIS 76 MITM via ARP PoisoningWinXP VMThe WinXP VM is able to intercept and monitor thetraffic between the OWASP and pfSense VMs!26

CIS 76 MITM via ARP PoisoningOWASP VMRepeat downloadinga file from the ftpserver.ftp 172.30.10.160anonymousNotSoSecretpassivelscd publsget admonitionexit27

CIS 76 MITM via ARP PoisoningWinXP VMClick the password tab at the bottom and FTP on theleft to show captured FTP usernames and passwords.28

CIS 76 MITM via ARP PoisoningWinXP VMIn Wireshark right-click on one of the FTP packetsand use "Follow the TCP Stream" to see the session.29

CIS 76 MITM via ARP PoisoningWinXP VMIn Wireshark notice that the poisoning is broughtabout by the WinXP VM flooding the subnet with ARPreplies containing the fraudulent IP/MAC pairs.30

CIS 76 MITM via ARP PoisoningReferences Cainhttp://www.oxid.it/cain.html Cain & packetsniffers/cain-abel/31

CIS 76 MITM via ARP Poisoning 3 Unauthorized hacking is a crime. The hacking methods and activities learned in this course can re