- [Instructor] This is a demonstration
of switch hacking using Yersinia.
In this demo, as an attacker,
we have a goal of denying service to a victim machine
or even performing a man-in-the-middle attack
by acting as a rogue DHCP server,
but to do this, we must deny network access
to the legitimate DHCP server.
We'll gain unauthorized access through a switch
to other VLANs or broadcast domains
by negotiating Dynamic Trunking Protocol, or DTP.
Once we have this access,
we can use the Cisco's VLAN Trunking Protocol, or VTP,
again using Yersinia, to deny network access
to the legitimate DHCP server.
VTP is used to share VLAN information between switches
and we can exploit this to remove the server's VLAN.
Let's get started.
I've already created the typology
and configuration using AutoNetkit.
Let's use the AutoNetkit Visualization tool
to help you understand this network.
This is the window you're prompted
to open after you build your initial configurations.
Starting from the Physical diagram,
you could see how the devices are connected together.
We have two switches with a connection between them
that acts as a trunk.
The router provides the function
to route between the two VLANs configured on both switches.
The attacker Kali machine
and victim are connected to switch one,
the server is connected to switch two.
You'll see that even though the attacker
isn't directly attached to switch two,
we could still affect its state.
Let's look at the Layer 2 diagram.
You'll see how vlan2 and vlan3
are logically placed in the network.
The Kali machine and victim are on vlan2
and the server is on vlan3.
The router provides Layer 3 connectivity
between the two VLANs.
Let's start the simulation and open the consoles.
I'll run the command show int status,
note how Kali is connected to port Gigabit Ethernet 0/3.
On switch two, we'll run the same command
and you could see server-1 is on vlan3.
On Kali, we'll see that we can
successfully ping the server at 10.0.128.2.
AutoNetkit follows best practices
and hardcodes the switchport mode to access
for our Kali machine.
To demonstrate Dynamic Trunking Protocol,
we'll put the port back in the default mode,
which is dynamic auto.
We'll verify the change was made
by doing show int gi0/3 switchport.
Note that the Administrative Mode has changed
to dynamic auto
and the Trucking Encapsulation is set to negotiate.
Our Access VLAN is two,
but when we ask the switch to enable trunking,
our Native VLAN will be one.
This will isolate Kali from vlan2,
unless we send frames tagged
with the VLAN ID of two.
AutoNetkit also makes VLAN Trunking Protocol passive
by placing it in Transparent mode.
You can see this with the command show vtp status.
We'll change this by placing switch one in Server mode
and running show vtp status again.
Note that the updater ID is 172.16.1.137
and was also the last updater.
We'll place switch two in VTP Client mode
and run show vtp status.
This will make switch one the server
and switch two the client.
You'll see that the switch is in Client mode
and has been updated
by the updater ID for switch one.
Now we've undone the best practices configurations
by AutoNetkit
and placed the switches in a more default state.
Let's run Yersinia in ncurses as our Interactive mode.
There is a GUI mode, but you'll find it quite unstable.
By default, eth0 is selected,
we'll change the attacking interface to eth1.
You could do this with the i key,
to get help use the h key.
You should see configuration bridge protocol data units
from the switch.
Now we'll change the protocol mode to DTP
by using the g key.
You could see the advertised VTP domain name
and that the status of our port is ACCESS,
but the switch is also set
to dynamically auto negotiate using DTP.
We'll execute an attack using the x key,
our attack will be to enable trunking mode.
We've sent a frame to the switch
that we desire trunking,
then the switch will reflect this
by enabling trunking mode.
We could verify this by going back to switch one
and running show int trunk.
This will show our port in auto mode
and that we've negotiated 802.1q trunking
with the Native VLAN of one.
We don't have any VLANs in spanning tree
forwarding state yet,
we'll have to wait for STP to go
through the listing and learning phases
and enter forwarding.
Then when we verify this,
you could see that we're in forwarding state
and now if we do show int trunk again,
you could see that one through three
are now in forwarding state.
Let's open a new tab and try pinging the server.
You'll see we can't do this
because of our Native VLAN,
which has changed to one.
So, let's go to the victim console
and try pinging the server.
You could see, I could still reach the server,
so let's change that.
Let's go back to Yersinia and use the g key
to change the attack to VTP,
then we'll choose the attack that deletes one VLAN.
We'll target the server's VLAN, which is vlan3.
After some time, you'll see state changes from VTP.
In the meantime, we can look at the running attacks.
Now, we'll try pinging the server again from the victim,
you'll see that the server is no longer reachable.
You can verify this on either switch
by using the show vlan command.
You'll see that vlan3 is now missing,
which isolates the server from the network,
now we can be free to attack the victim.
This concludes this demo of switch hacking.
You've seen how you can widen the scope of access
to a network using protocols,
like Dynamic Trunking Protocol
and VLAN Trunking Protocol.
Thanks for watching.