In this lab, we're going to take some
of what we've learned with Wireshark and network traffic
and we're actually going to make an attack.
We're going to do a man in the middle.
We're going to do some ARP poisoning.
So let's get into the environment and play with that.
We have our console.
Let's check out our IP address on ETH1.
It says 10.
100.
13.
And let's run an Nmap on event.
Zero set at 24.
And we're 140.
I know, it's a strange number.
Well, it's just not a round number.
It's not one, two or three.
We have our results back.
.1 is going to be our--
looks like our webserver. .36 has Telnet open,
and .37 looks to be a machine that isn't hosting anything.
And we're .40 or .140.
All right.
Now that's kind of fun.
Let's check our Wireshark.
Let's see what's going on in this network, right?
And to match ETH1 is what we want to be searching on.
And let's listen.
It's not really much happening.
Because we're not talking to anyone.
Let's just make sure things work.
Let's ping one of these guys.
Bam.
OK.
I see ping is going on.
Well, what we want to do is, there is Telnet open.
We aren't seeing any traffic between other machines.
So let's-- I don't know, let's pretend to be someone else
and see if we can intercept traffic that's not intended
for us.
So the way we go about that is we're
going to take, echo our standard in
and then we're going to send that to IP forward.
And we're doing that because--
oh, we already have something.
All right.
Let's really to do this ARP spoofing.
And you can see a whole bunch of traffic out here.
Where we are sending our ARP information out.
Oh, you see Telnet traffic.
That might be what we're looking for.
Let's stop this capture.
We're also going to stop the scan.
Cleaning up and reopening the target.
That's good.
We'll let him do his cleanup.
Saw something in here.
Telnet traffic.
Who is that intended from?
From 36 to 37.
So it wasn't going to us.
This traffic wasn't intended for us, we're about .
140, right?
This one's going from 36 to 37.
And if we were plugged into a switch,
if we were gathering data from, basically from a switch,
it's the best way to do that.
Or if you had a line in between switches
and you gathered all the traffic even if it wasn't intended
for us, that might work.
But by our ARP spoofing, we told 36 that we were 37.
And said, hey, send that over here.
And then we were able to listen to it.
And let's dig in and see what that looks like.
So it is Telnet.
Lots of Telnet data.
Let's follow the stream and see what's in here.
Oh, hey, we have a log in.
Only log in with admin and my secret pass.
Let's copy that code.
And let's pull this back up.
It was going from which machine to which machine?
From 36 to 37.
It would be way too much to go back.
Not that-- not that far.
Yeah, it is 36 that has Telnet open.
So let's Telnet to 36.
In .100 .13 .36.
INE log in.
And we saw that the username is admin and the password.
So that copies.
Hey, it worked.
Copied in that my secret pass from up here.
Use the keyboard command.
And it says welcome to Ubuntu, which is something
since we were on Kali before.
And now you can see we are now Telneted
into this other server.
That's one of the dangers of Telnet.
Is it's not secured or it's not encrypted in root.
So we were able to ARP spoof and capture that traffic
and read it.
And then utilize it.
Since log in is not encrypted, we grabbed it.
And we were able to log in on the machine on our own.
It's kind of nice.
We could cover our own tracks and maybe use
this machine to SSH back to ourselves
through this Telnet session.
And then we might have access that way.
And have then whatever we're doing from there
become encrypted and harder to look at forensically.
But this is just base level man in the middle spoofing,
listening, and then utilizing what we found.
Now let's, in the next couple of labs, let's dig in
and do something a little more sophisticated if you will.
Let's look at Wi-Fi and see what that looks like
and what we might be able to do there.