Lateral Movement
By: Mohamed Marrouchi
Tags: Security, Infosec, Cybersecurity, Information Security, Hacking

Abstract

Network Lateral Movement, or what is more commonly referred to simply as, “Lateral Movement”, refers to the techniques cyber attackers, or “threat actors”, use to progressively move through a network as they search for the key data and assets that are ultimately the target of their attack campaigns.

In this chapter we are going to discover the following topics:

Man-in-the–middle attacks

- ARP spoofing using arpspoof

- ARP spoofing using MITMf

- Bypassing HTTPS

- Session hijacking

- Code injection

Scapy

- MyFirstPacket

- Sending and receiving

- Layering

- Viewing the packet

- Classical attacks

1.Man-in-the–middle attacks

In the following couple of areas, we will discuss what are known as man-in-the-middle (MITM) attacks. This is a standout among the most risky and powerful assaults that we can convey out in a network. We can just do it once we have associated with the network. It tends to be utilized to divert the stream of flow from any customer to our device. This implies any packet that is sent to or from the customer will have to go through our device, and since we know the secret word we know the way to the system, so we will have the capacity to read those packet. They won’t be encrypted, and we will have the capacity to change them, drop them, or simply read them to check whether they contain passwords or critical data. This attack is so successful in light of the fact that it’s difficult to secure against. however, it’s difficult to completely secure against this assault. This is because of the way the ARP convention works. It was customized in a way that is extremely straightforward and exceptionally viable, but it’s not secure enough.

ARP has two primary security issues. The first is that every ARP ask for or response is trusted, so whatever our device says to different device that are in our network will be trusted. We can simply tell any device that is on our network that we are the router and the device will confide in us. It won’t endeavor to ensure that we are really the router. It won’t run any tests to guarantee our character. In the event that we tell any device that we are the router, the device will trust us. Similarly, on the off chance that we tell the router that we are another person on the network, the router will confide in us and will begin regarding us as that device; in this way, that is the principal security issue. The second security issue is that client can acknowledge response regardless of whether they didn’t send a demand. Anyway, for instance, when a device interfaces with the system, the main thing it will ask is, who is the router? And afterward the router will send a response saying “I am the router.” Now, we can simply send a response without the device asking who the router is. We can simply tell the device we are the router, and on the grounds that the device trust anybody, they will believe us begin sending us packet as opposed to sending the packet to the router.

Along these lines, how about we have a more profound take a gander at how this MITM attack functions. It will work utilizing a technique called ARP spoofing, or ARP poisoning, This is finished by misusing the two security issues that we discussed in the past passage. That is a typical Wi-Fi network, and we can find in the accompanying chart that when the client demands something it will send the demand to the Wi-Fi router, and after that the router will get the demand from the web and return with the response to the Client:

Presently, this is finished utilizing packets. Along these lines, what we will do is we will send an ARP response to the Client so we can send responses without the Client asking them.

The Client didn’t request anything, yet we can even now send it a response. We will state that our IP is the router IP. Thus, the router, for instance, has the IP 192.168.1.1; we’re going to tell the Client the device with the IP 192.168.1.1 has our MAC address, so we’re going to tell the Client that we are the router, essentially.

From that point forward, we will do the inverse to the Wi-Fi router. We will tell the router that we are the client. We’ll do this by telling the router that our IP is the Client IP, and that Client has our MAC address, so the correspondence of packets will be done through the MAC address, and the Wi-Fi router will begin sending any packet that is intended to go to the Client to us. This will divert the stream of packet through our device, so when the Client needs to send a demand it will send the demand to us:

Thus, for instance, as found in the accompanying screen capture, when the Client needs to open Google it will send the demand to our device as opposed to sending it to the Wi-Fi router:

Presently, our device will go to the Wi-Fi router, it’ll get Google, the Wi-Fi router will send the response to our device rather than the Client, and afterward we will send the packet back. Along these lines, this implies every packet that is sent to the Client or from the Client, will have to go through us. Since it’s going through us and we have the key, we can read these packets, we can adjust them, or we can simply drop them.

Along these lines, that is the fundamental guideline of the MITM attack and ARP poisoning. Essentially, we’re going to tell the Client that we are the Wi-Fi router, and afterward we will tell the router that we are the Client. This will put us in the middle of the packet flow, between the Client and the Wi-Fi router, and every one of the packets will begin coursing through our device. At that point we can read the packet, alter them, or drop them.

1.1 ARP spoofing using arpspoof

Presently, how about we perceive how to run a genuine ARP attack, diverting the stream of packets also, making it course through our device. We will discuss a tool called arpspoof, which is a piece of a suite called dsniff. dsniff is a suite that contains various projects that can be utilized to dispatch MITM attack. We’re simply going to discuss arpspoof, and we will perceive how to utilize it to complete ARP poisoning, which diverts the stream of packets through our device. The arpspoof tool is old, but it still works, and on the grounds that it’s so straightforward it’s been ported to Android, iOS, and other littler working frameworks. There’re many individuals that really get a kick out of the chance to utilize it to do ARP poisoning, which is for what reason we will demonstrate to you best practices to utilize this tool. In the following segment and every one of the segments from that point onward, we will utilize a tool called ettercap. We’ll perceive how we utilize it and how to do ARP poisoning with it, yet for this segment we simply need to demonstrate to utilize arpspoof in light of the fact that it will be utilized a great deal, so we have to realize how to utilize it. It’s exceptionally straightforward, at any rate.

In this way, we are associated now to the objective network. How about we perceive how we utilize the tool. It will be arpspoof — i, to pick our web card (virtual card), so it’s eth0. At that point we will put in the target IP address. In this way, our target is the Windows device, with its IP, 10.0.2.5. At that point we will put the IP address for the access point, which is 10.0.2.1. We will tell the access point that the client IP address has our MAC address, so fundamentally, we will tell the access point that we are the target client:

After this, we will need to run arpspoof once more, and as opposed to telling the access point that we the target client, we will tell the client that we are the access point, so we’re simply going to flip the IPs:

In this way, by running both the preceding commands we will trick the access point and the

client, and we will give the packet a chance to move through our device.

Presently, how about we see, at the target, Windows is the target device, so we are heading off to the ARP table.

Along these lines, if we just run the arp — a command in the Windows machine, it will demonstrate to us the ARP table. In this way, we can find in the accompanying screen capture that the IP address for the access point is 10.0.2.1, and we can see its MAC address is 52–54–00–12–35–00. It’s put away in this ARP table:

Now, once we do the attack, we will see that the MAC address 08–00–27–0b-91–66 for

the target access point is going to change, and it’s going to be the attacker’s MAC address:

We’ll likewise need to accomplish something many refer to as enabling IP forwarding. We do that so when the packets move through our device they don’t get dropped, so every packet that goes through our device gets really sent to its destination. In this way, when we get a packet from the router it goes to the client, and when a packet originates from the client it ought to go to the router without being dropped in our device. Along these lines, we will enable it utilizing this command:

echo 1 > /proc/sys/net/ipv4/ip_forward

1.2 ARP spoofing using MITMf

In this section, and the following couple of areas, we will discuss about a tool called MITMf, and as the name proposes, this device enables you to run various MITM attack. In this way, how about we run the tool, perceive how we utilize it, and we will complete a fundamental ARP poisoning attack, precisely as we did in the past section.

If we do ifconfig just to see our interfaces, we’ll see that we have the eth0 card connected to the internal network at 10.0.2.15:

Presently, go to the Windows machine and run arp — a to see our MAC locations, and we can find in the accompanying screen capture that we have the gateway at 10.0.2.1, and the MAC address ends with 35–00:

So, we’re going to run the ARP poisoning attack and see whether the MAC address changes and whether we can become the MITM.

To utilize the tool, the name of which is MITMf, we will put the command first. At that point we will instruct it to do ARP poisoning, at that point we will give it the gateway(the IP of the router), at that point we will give it the IP of our device, and after that give it the interface.The command is as follows:

mitmf — arp — spoof — gateway 10.0.2.1 — target 10.0.2.5 -i eth0

Let’s go to the Windows machine, run arp -a, and see whether we managed to become the center of the connection.

So, that implies we’re the MITM right now, and the tool naturally begins a sniffer for us. So rather than arpspoof, which just places us in the center, this tool really begins a sniffer.

In this way, on a Windows machine, we will go to a site called Hack.me, and afterward we will go to the login page to sign in to an account while the MITM attack is running, and afterward we are simply going to utilize a username and a password.

Basically, we can see any username and password that is entered by the target also we can see the URL that his requested.

1.3 Bypassing HTTPS

In the past section, we perceived how to sniff and catch anything sent over HTTP request.

Most popular sites utilize HTTPS rather than HTTP. This implies when we attempt to turn into the MITM, when the individual goes to that site, the site will show a warring saying that the certification of that site is invalid. That way, the individual will be suspicious and likely won’t sign in to that page. Along these lines, what we will do is utilize a tool called SSLstrip, which will downgrade any HTTPS request for to HTTP; so at whatever point the target individual attempts to go to https://hotmail.com, for instance, they’ll be diverted to the HTTP of hotmail.com.

If we look at the following screenshot, once we run this program, we will see that it will actually, tell us that SSLstrip has been started and it’s online:

In this way, we will return and we will attempt to go to hotmail.com, and we will see in the accompanying screen capture that, rather than the HTTPS version that we’re getting, we’re really going to go to a HTTP version of hotmail.com.

In this way, we will return and we will attempt to go to hotmail.com, and we will see

in the accompanying screen capture that, rather than the HTTPS version that we’re getting, we’re really going to go to a HTTP version of hotmail.com.

Sites, for example, Facebook and Google are really utilizing something called HSTS, and what that does is this; fundamentally, the browser comes in with a pre-hardcoded list of sites that must be perused as HTTPS. Along these lines, regardless of whether we attempt to downgrade the HTTPS connection to HTTP, the program will simply decline to demonstrate the site, or simply demonstrate a HTTPS version of it. This because, without connection to anything, the b browser as a rundown put away locally on the local PC saying that it shouldn’t open Facebook, Gmail, and such sites as HTTP. In this way, the manner in which we attempt to do it, the site will simply decline to open in HTTP.

1.4 Session hijacking

Imagine a scenario where the target never really entered their password? Imagine a scenario in which they utilize the Remember Me feature, so when they go to the website, they as of now get signed in into that website? That way, they never enter the password, the password is never sent to the server, and in this manner, we’ll never have the capacity to catch the password since it’s not in any case sent. Along these lines, how about we examine that.

For this situation, the clients really get authenticated dependent on their cookies. The cookies are stored in the browser, and each time the individual attempts to go to the site they will be confirmed to the site dependent on the cookies. What we can do is sniff out these cookies and inject them into our browser, and in this manner, we’ll have the capacity to sign into the account without entering the secret key, the very same way that the target is being authenticated to their account.

To do that, we will utilize a tool called ferret, and ferret doesn’t come installed with Kali. To install it, we will need to run apt-get install ferret-sidejack. When we have that, as a matter of first importance we will end up being the MITM utilizing a similar command that we’ve been utilizing in the past areas.

We should simply type in ferret, and after that we put our interface, which is eth0 for our situation. Once more, if we are utilizing our wireless, put as the interface the name of our wireless card. The command is as per the following:

ferret — I eth0

We’re additionally going to begin a graphical interface, a web GUI, that will permit us, to inject the cookies and explore into our framework’s session. To do that, we will utilize a tool called hamster.

We are going to copy the proxy link that hamster gave us, which is http://127.0.0.1:1234, and we will go to our browser. Presently, we have to adjust our proxy settings to utilize hamster, so in our Kali program we will go to Preferences | Advanced | Network | Settings, and we will set it to utilize a manual configuration, and we will set the port to 1234.

We go and select our adapter by going into adapters and entering eth0. Then, click Submit Query:

Our target is 10.0.2.5; that is our target IP. We will tap on it, and as should be obvious in the accompanying screen capture, on the left we have every one of the URLs that contain cookies related with our target:

If we click on URL, we will be actually logged in without having to enter a username or password.

1.5 MITMf code injection

We will utilize a similar command that we generally utilize. The main distinction is we will embed the — inject plugin, and after that we have distinctive choices for injection.

There are three fundamental options:

- We can have our code put away into a file, and we can utilize — js-file or — html-file to inject the code put away in the file that you indicate.

- Code can be put away on the web, and it has a URL. We can utilize that URL utilizing the — js-url or the — html-url option.

- We can really supply the code itself through the command utilizing the — js-payload or on the other hand the — html-payload option.

We will supply the code through the command the first run through, and after that do it utilizing a file. We will utilize — inject-payload, and after that we will do — js-payload. Our command will be equivalent to dependably, mitmf, and after that we will include the choice, the module, which is — inject, and after that we will reveal to it that we need to determine the code through the command. We will utilize the — js-payload, as then we can put the JavaScript code after the — js-payload alternative. We will put in our JavaScript code, and we will utilize extremely basic code that will just show a message on the target PC. Our code wouldn’t attempt to hack anything; all it will do is simply show a message box on the objective PC is as per the following:

mitmf — arp — spoof -i eth0 — gateway 10.0.2.1 — target 10.0.2.5 — inject — js-payload “alert(‘test’)”

Once more, we can really Google JavaScript codes and see codes that will be valuable for us. For instance, there are JavaScript keyloggers, there are codes that can take screen captures of the target PC, and there is a considerable measure of different codes. You can divert the target PC elsewhere, take their cookies; you can complete a considerable measure of these incredible attack.

2. Scapy

Scapy is a Python program that enables the user to send, sniff and dissect and forge network packets.

This capability allows construction of tools that can probe, scan or attack networks. In other words, Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. Scapy can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery. It can replace hping, arpspoof, arp-sk, arping, p0f and even some parts of Nmap, tcpdump, and tshark).

Scapy also performs very well on a lot of other specific tasks that most other tools can’t handle, like sending invalid frames, injecting your own 802.11 frames, combining techniques (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, . . . ), etc.

The thought is basic. Scapy for the most part completes two things: sending packets and accepting answers. You characterize an arrangement of packets, it sends them, gets answers, matches demands with answers and returns a list of packets couples (request, answer) and a list of unmatched packets. This has the enormous favorable position over tools like Nmap or hping that an answer isn’t decreased to (open/closed/filtered), however is the entire packet.

2.1 MyFirstPacket

Along these lines, how about we simply ahead and take a gander at our first packet. I will simply ahead and make one with a payload with a message MyFirstPacket embeded inside an ICMP packet. the packet breakdown and subtle elements of how I did it.

The breakdown is as per the following:

p: This is the name of the packet

IP(): This is the type of packet you need to make, for this situation an IP packet

(dst=”192.168.0.6"): This is the destination to send the packet to (for this situation my router)

/ICMP(): If you need to make an ICMP packet with the default value given by scapy

/”MyFirstPacket”): The payload to incorporate which you don’t need to give with the end

2.2 Sending and receiving

Scapy furnishes us with three functions for sending and receiving packets. The first two functions necessitate that it’s built for the network layer packets just, for example, IP, ICMP, and ARP packets. You may utilize sr() for sending and accepting packets whether they are answered or unanswered response. The other elective function is sr1() and this will just return one packet because of the packet sent. For layer 2 packet, you would utilize srp() which gives a similar capacity to sending/receiving packets.

2.3 Layering

There are different approaches to push out packets with send() for layer 3 and sendp() for layer 2 that’ll be spoken to by a progression of periods, every one of which represents to 1 packet sent when executed. Sending various packets should be possible by controlling the time to live function in the IP, giving a loop function…etc

A very important feature you need to know about is layering between upper- and lower-layer data is done using the key/to bridge the two sets of data together.

Here’s a simplified view of several various examples of layer packets. The first line was just an IP packet. The next line we layered a UDP protocol which could be a TCP. Remember UDP is connectionless and TCP is connection oriented requiring a 3-handshake at the initiation of a connection. The third packet we created is now a frame when it becomes encapsulated with the Ethernet header which operated down in layer 2. For the fourth one, we are back at layer 3 and the GET / HTTP… would reference to the inputted dns that’s being requested by a host ( so basically anytime someone is try to reach a or clicks on a link would commonly be sending get request). The Last statement defines what IP protocol to use which we input the value 58, which is IPv6 ICMP. These are just a few common examples to help you understand how easy it is to create a multi-layered protocol with scapy that’s very customizable to test for vulnerability, network issues, and packet inspection.

2.4 Viewing the packet

Scapy offers several ways for the end users to examine packets. Use the following commands as a reference to get your desired output with the example, packets=IP(dst=”192.168.0.2" ttl=14). You can customize the packet protocol to your heart’s content. Then you can use the fallowing methods to view the data:

packets.summary(): This provide short list of details such as the IP protocol, source and destination address, and payload details

packets.nsummary(): Gives the same result as the summary() with a packet number

packets.show(): This provides a much more organized display and component details of the packet

packets.show2(): This is very similar to the previous function except checksum is calculated

packets.psdump(): Maps a PostScript illustration explaining the breakdown of the packet

packets.pdfdump(): This provides a PDF Visual explaining the breakdown of the packet

packets.sprintf(): This returns field values of the packet data in a string format

packet.decode_payload_as(): You may alter the decoding method of the payload using this function

ls(packets): This lists packet content values

hexdump(packets): This gives you the hexadecimal dump of the packet

str(packets): This builds a packet with defaulted values If you have a list of a pcap file it may also be helpful to know the following to help you organize the data to be more easily readable. We are going to be using what are called lambda functions. Don’t let the term intimidates you; they are only capable of executing:

filter(): Provides a lambda function to filter the provided list of packets

plot(): Plots a list of packets with the provided lambda function

Make table(): The table of table is also organized based on the given lambda function

2.5 Classical attacks:

- Malformed packets:

>>> send(IP(dst=”10.1.1.5", ihl=2, version=3)/ICMP()) - Ping of death: >>> send( fragment(IP(dst=”10.0.0.5")/ICMP()/(“X”*60000)) )

- VLAN hopping

In very specific conditions, a double 802.1q encapsulation will make a packet jump to another VLAN:

>>>sendp(Ether()/Dot1Q(vlan=2)/Dot1Q(vlan=7)/IP(dst=target)/ICMP()) - Wireless sniffing: >>> sniff(iface=”ath0",prn=lambda x:x.sprintf( {Dot11Beacon:%Dot11.addr3%\t%Dot11Beacon.info%\t%PrismHeader.channel%\t%Dot11Beacon.cap%}”))

- ARP poisoning commands

The following is an example of how to use scapy to poison the ARP cache on a network. By using the following commands, the targeted device is prevented from joining the gateway of the network. The commands direct the attack to poison the ARP cache by using a VLAN hopping attack. That is why we set /Dot1Q(vlan=1)/Dot1Q(vlan=2):

>>> send( Ether(dst=XX-XX-XX-XX-XX)/ARP(op=”who-has”, psrc=gateway, pdst=client), inter=RandNum(10,40), loop=1 ) Double 802.1q encapsulation: >>> send( Ether(dst=XX-XX-XX-XX-XX)/Dot1Q(vlan=1)/Dot1Q(vlan=2) /ARP(op=”who-has”, psrc=gateway, pdst=client), inter= The short-cut: >>>arpcachepoison(target, victim, interval=60)

Reference:

Applied Network Security[Arthur Salmon-Warun Levesque-Michael McLafferty]

Scapy Documentation[Philippe Biondi and the Scapy community]

Learn ETHICAL HACKING from Scratch[Zaid Sabih]

Fragmentation (Overlapping) Attacks One Year Later…[Antonios Atlasis]