In this video I’m gonna show you how to hack STP. Spanning Tree Protocol or STP is one of the most
common LAN protocols deployed in today's enterprise networks.
I'd recommend you to dive deeper into STP because it's really important and the lack of securing it
could disrupt your entire network.
A very good resource for learning about STP is the Cisco CCNA course.
This video assumes that you have some basic knowledge about how STP works.
Let's recap in a nutshell what is its purpose and how it works. Redundant
links are always welcome in switched topologies as they avoid the single point of failure issue of a single
switch or link that fails.
In the example you are looking at if the link between switch A and switch B fails the traffic from
A to B will still reach the destination through Root
Switch. However, redundant links, if we look at them from layer 2 perspective, can cause Layer 2 loops which
further can cause broadcast storms and multiple frame transmission.
This is simply because there is no time to leave field in Ethernet header. For example in this image
If host A sends a broadcast frame that frame will be received doubbled by host B. tThe first path
is A switch A root switch B and host B and the second path is host A switch A switch B and host B, so
host B will receive the broadcast frame two times. Fortunately spanning three can allow us to have redundant
links while having a loop free topology, thus preventing the potential for a broadcast storm.
STP achieves this loop free topology by selecting one switch as the root bridge and the network
administrator can influence which switch becomes the root bridge because this is the central part of the
switch topology.
Selecting a specific Switch as the root bridge is done by manipulating a value called Switch priority and
the switch with the lowest priority becomes the root bridge; if the root bridge goes down or another
switch must become the root bridge
the STP topology must reconverted by electing a new root bridge and the election starts at that precise
moment.
Switch ports do not immediately transit from the blocking state to the forwarding state; the ports
go through some different states and the time before the ports start to forward packets can be up to one
minute.
Okay now that we have a basic understanding of how STP works let's see how a hacker could attack STP,
In this lab
I'm gonna show you how to exploit the way STP works and I mean the way STP elects the root bridge.
This is another denial of service attack that is easy to be launched from a Linux machine using an application
like Yersinia.
It's the same application we've used for the CDP attack.
Take a look there
if you feel the need to see again what is Yersinia and how to install it on Linux.
Taking over the root bridge is probably one of the most disruptive attacks.
Keep in mind that STP is trustful, stateless and does not provide an authentication mechanism. Running
Yersinia from Kali Linux
I'll claim the root bridge role by sending BPDU frames with a lower priority than of the actual
root bridge. For STP a lower priority means a superior priority and the switch with the lowest
priority becomes
the root bridge. Yersinia
will take the role of the root bridge; by the way I've said BPDU frames.
These are Ethernet frames used by STP for its operation!
This attack is both of type DoS and MiTM. Denial of service because
STP takes time to converge once a change in topology occurs, and during this phase no data is forwarded
by any switch in the network.
The attacker could continuously reset the topology converging process before it has any chance to finish.
The switch will be put in such a state that will continuously calculate the final STP topology. And Man
in the Middle
because if the attacker attacker inserts a roque switch in the network and that switch becomes the root bridge,
traffic could be diverted through the roque switch.
Okay, let's exploit STP. This is topology I'm going to use: My laptop runs Windows 10 and
Kali Linux in a VM. It’s connected directly to a Cisco Catalyst Switch using a wired Ethernet connection.
If you use the same setup don't forget to set the VM network in bridged mode so that the Linux machine
has access to the physical interface of your laptop.
To reproduce this attack, besides a Linux machine, you need the Cisco Layer 2 switch or any other switch
that supports STP.
You will connect the Linux machine to the switch using a wired connection.
Now if you don't have available such a physical switch you can still lunch to the attack.
Just run a Cisco L2
IOU in GNS3 and setup a network connection between the Linux host and the devices that
run in GNS3.
Take a look at the previous lecture where I have explained in detail how to do it. In this topology
notice that there are two redundant links between switch 1 and switch 2.
This is what a redundant topology means and STP will temporarily disable a port to avoid the problems
of a redundant layer 2 topologies. This is a console connection to Switch2. The default STP priority of
a Switch is 32768. Let's check it!
sh spanning-tree
We notice the switch priority and that this switch is the root bridge. If you want to be sure that a particular
switch becomes the root just decrease the priority.
You can set the bridge priority in increments of 4096 and I'm gonna set the priority
to a lower value: config
spanning-tree vlan 1 - all parts belong to vlan 1 - priority and the value
You cannot give any value, only in increments of 4096
For this example the priority will be 28672
and of course the switch is the root bridge of the topology
We see the message here!
This bridge is the root. Back to Kali Linux
I'll start Yersinia as root
So yersinia -G written in uppercase; minus G option makes yersinia to start a graphical
section. I'll click on launch attack and in STP tab I'm selecting Claiming Root Role and then OK.
Yersinia immediately starts sending BPDU with a lower priority than the priority of the RootBridge,
claiming the root role.
You can adjust the values in the BPDU frames here, in this window.
Okay let's return to the switch and see if it still the root. I am executing show spanning three command
And we noticed that the switch is no more the
root bridge. There is a cost of 19 to the root! Back to Kali Linux
I'll stop with the attack: list attacks and stop show spanning three again The switch is still the root.
I am waiting a few seconds
okay.
We see that the switch has become again the root of the topology; if we don't have or don't want to use
the graphical interface of Yersinia,
we can start with the attack in command line like this:
yersinia stp - the name of the attack and - attack and the id of the attack
In this case is 4
Let's return to the switch and execute the show spanning three
again and we notice that the switch has lost the root role.
Okay, I am stopping Yersinia and the attack!
You've just seen how to heck STP, one of the most used switching protocols in enterprise networks.
In the next lecture I'll show you what countermeasures you can take to protect your switches against
this attack.