> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/blue/wireshark-incident-response-ir/network-attacks-pokedex.md). # Network Attacks Pokedex
## Rogue DHCP Server The hacker sets up a rogue [DHCP](https://www.geeksforgeeks.org/dynamic-host-configuration-protocol-dhcp/) server and creates an [IP address ](https://www.geeksforgeeks.org/what-is-an-ip-address/)conflict by broadcasting duplicate IP addresses or addresses that don't exist on the given subnet. Forget how a DHCP server operates? Think of **DORA (Discover, Offer, Request, Ack)**.
### Tips + Trix * Filter by DHCP type `bootp.option.dhcp==2` * Wireshark: Statistics > Endpoints and follow the stream of initial packets to identify the original DHCP Server * Complete an IP **release** and **renew** command to request a new IP from each DHCP server (one request is broadcasted to the whole network). ### Resources * [Finding Rogue DHCP server w/ Wireshark](https://www.youtube.com/watch?v=uyvEa7Nh80A\&t=2s) * [Detect Rogue DHCP Server with Wireshark](https://www.golinuxcloud.com/detect-rogue-dhcp-server-wireshark/) ## LLMNR Poisoning ### What is LLMNR? LLMNR (Link-Local Multicast Name Resolution) is a UDP-based service (typically on port 5355) that, as an alternative to DNS, allows name resolution and identification for users and servers on a network. Nowadays LLMNR is generally disabled. ### Detection * View > Name Resolution > Resolve Network Addresses * Filter by `ntlmssp` * Look for NTLM authentication requests and negotiations, identify the first responder to the LLMNR requests and then filter for DHCP requests identifying the hostname of the given srcIP. Might be a huge red flag if it's **kali** for example

Sample from CyberQuest network-capture.pcapng filtered on LLMNR, we see .147 IP responding and impersonating the fileserver SCCMSERVER

Sample from CyberQuest network-capture.pcapng filtered on ntlmssp making NTLM negotiation and authentication requests

### Resources * [BlackHills LLMNR Post](https://www.blackhillsinfosec.com/how-to-disable-llmnr-why-you-want-to/) * [RFC4795](https://www.blackhillsinfosec.com/how-to-disable-llmnr-why-you-want-to/) * [HackTheBox LLMNR Poisoning](https://www.hackthebox.com/blog/llmnr-poisoning-attack-detection) ## NTP Amplification Attack Attacker sends small malicious NTP query that causes the NTP server to respond with data 100s of times larger. By spoofing a victim's address, the NTP server will respond to the victim, sending a flood of packets to them. ## ICMP Redirect Attack ICMP Redirect Attack is used to redirect traffic and conduct MITM attacks. For context, an ICMP redirect message can be sent by routers to notify hosts of better traffic routes. By sending fake ICMP redirect messages the host's routing table is duped and reroutes its traffic through an attacker-chosen path, potentially allowing MITM, or DoS.
### Attack Feel free to check out Netwox and the tutorial [here](https://medium.com/@sherishrat/icmp-redirect-attack-18755cd0897). ```bash netwox 86 - device "" - filter "src host " - gw - code 1 - src-ip ``` ### Remediation Disable ICMP redirects. Most often they're disabled by default. {% tabs %} {% tab title="Ubuntu" %} ```bash # Check whether secure_redirects are enabled sudo sysctl -a | grep "secure_redirects" # Disable sudo sysctl -w net.ipv4.conf.all.secure_redirects=0 sudo sysctl -w net.ipv4.conf.default.secure_redirects=0 sudo sysctl -w net.ipv4.conf.enp0s3.secure_redirects=0 sudo sysctl -w net.ipv4.conf.lo.secure_redirects=0 ``` {% endtab %} {% tab title="Windows" %} ``` # TODO: ``` {% endtab %} {% endtabs %} ### Resources * [ICMP Redirect Attack Explained](https://hackblue.org/pages/icmp_redirect_attacks.html) * [Medium ICMP Redirect Attack](https://medium.com/@sherishrat/icmp-redirect-attack-18755cd0897) ## IPv6 Router Advertisement (RA) MITM Here's an example of an RA-MITM attack capture: ```bash $ tcpdump -enr event.pcap reading from file event.pcap, link-type EN10MB (Ethernet) 07:13:51.598507 80:e6:50:1b:95:b0 > 00:0c:29:47:fe:5f, ethertype IPv6 (0x86dd), length 78: fe80::82e6:50ff:fe1b:95b0 > fe80::20c:29ff:fe47:fe5f: ICMP6, neighbor advertisement, tgt is fe80::82e6:50ff:fe1b:95b0, length 24 07:13:51.598735 00:0c:29:47:fe:5f > 00:0c:29:47:fe:5f, ethertype IPv6 (0x86dd), length 86: fe80::82e6:50ff:fe1b:95b0 > fe80::20c:29ff:fe47:fe5f: ICMP6, neighbor advertisement, tgt is fe80::82e6:50ff:fe1b:95b0, length 32 07:13:51.598810 00:0c:29:47:fe:5f > fe:1b:95:b0:58:58, ethertype IPv6 (0x86dd), length 86: fe80::20c:29ff:fe47:fe5f > fe80::82e6:50ff:fe1b:95b0: ICMP6, neighbor advertisement, tgt is fe80::20c:29ff:fe47:fe5f, length 32 07:13:51.742638 00:0c:29:47:fe:5f > fe:47:fe:5f:58:58, ethertype IPv6 (0x86dd), length 86: fe80::66eb:8cff:fe72:2557 > fe80::20c:29ff:fe47:fe5f: ICMP6, neighbor advertisement, tgt is fe80::66eb:8cff:fe72:2557, length 32 07:13:52.479471 00:0c:29:47:fe:5f > 80:e6:50:1b:95:b0, ethertype IPv6 (0x86dd), length 86: fe80::6e70:9fff:fed2:622b > fe80::82e6:50ff:fe1b:95b0: ICMP6, neighbor advertisement, tgt is fe80::6e70:9fff:fed2:622b, length 32 ``` ### Resources * [ProSec: IPv6 MITM](https://www.prosec-networks.com/en/blog/ipv6-mitm/) ## VLAN Hopping Basis of the attack is to gain access to other VLANs. This can be completed via switch spoofing and double tagging. Both attack vectors can be mitigated with proper switch port configuration. ### Switch Spoofing Switch spoofing involves an attacker imitating a [trunking switch](#glossary) using [Dynamic Trunking Protocol (DTP)](#glossary) to negotiate a trunk link with a switch. The trunk link is responsible for carrying all VLAN traffic on the switch. Note this is possible when the “dynamic auto” or “dynamic desirable” switchport modes are enabled. ### Double Tagging An attacker sends Ethernet frames containing two VLAN tags, meaning the first switch unwraps the outer tag (corresponding to the native VLAN) and forwards the frame to the next switch. The second switch processes the inner tag, ultimately routing the frame to the target VLAN. How do switches forward frames in the first place using VLAN tags?

Example of a double tagging attack in which the outer VLAN ID is 1, while the inner VLAN ID is 20, therefore SW2 will forward to VLAN20.

Here's an example of how to conduct a basic double tagging request with [scapy](https://scapy.net/): ```bash $ scapy INFO: Can't import python gnuplot wrapper . Won't be able to plot. WARNING: No route found for IPv6 destination :: (no default route?) Welcome to Scapy (2.2.0) >>> sendp(Ether(dst='ff:ff:ff:ff:ff:ff', src='00:17:5a:ed:7a:f0')/Dot1Q(vlan=1)/Dot1Q(vlan=20)/ IP(dst='255.255.255.255', src='192.168.1.1')/ICMP(), iface='eth2') ``` Below is the resulting packet on Wireshark:
### Remediation * Disable DTP on all switch ports that don't require trunking * Configure all non-trunk ports to access mode `switchport mode access` * Isolate VLANs by assigning an unused VLAN ID as native VLAN on all trunk ports * Ensure native VLAN is explicitly tagged on all trunk ports * Disable unused ports and use port security features to limit the quantity of MAC addresses on a port ### Resources * [NetworkLessons: VLAN Hopping](https://networklessons.com/switching/vlan-hopping) * [TwinGate: What is VLAN Hopping?](https://www.twingate.com/blog/glossary/vlan%20hopping) ## Glossary | TERM | DEFINITION | | --------------- | --------------------------------------------------------------------------------------------------------------- | | NTP | Network Time Protocol, used to synchronize time across devices over a packet-switched variable-latency network. | | Trunking Switch | | | Trunk Link | | | DTP | Dynamic Trunking Protocol | | VLAN Tag | |