Công c
Attack Options Browse -> apply crack
Thông tin Ports: medusa User
28 BÀI 4: user/password Connection Details vào Connect
Vào Hosts Add hosts 192.168.2.151 add
Host Nmap_Scan Quick Scan (OS detect)
OK lên máy192.168.2.151 Attack smb ms08_067_netapi
Meterpreter 1 interact Command Shell abcpassword Ptithcm123$ administrator trên máy tiêu:
CAIN & ABEL
Vào start setting control panel add or remove program Add/Remove windows components thành
- Vào my computer c:\ inetpub wwwroot
- Vào start programs addministrative tools Internet Information Services (IIS) Manager
Authentication and access control anonymous access: clear text)
5.2.4 Bài t p m r ng password trên máy attacker.
CDP FLOODING ATTACK
5.3.1 Gi i thi u CDP (Cisco Discovery Protocol)
CDP là m t giao th c quy n l p c phát tri n b i Cisco Systems c s d chia s thông tin v các thi t b Cisco k t n i tr c ti p khác, ch ng h n nh phiên b n h a ch IP CDP c ng có th c s d ng cho On-Demand Routing, là m t ph ng pháp bao g nh tuy n các giao th nh tuy ng không c n ph i s d ng trong các m n gi n
Yersinia là m t ch th c hi n các cu c t n công l p 2 Yersinia c thi t k t n d ng l i th m t s y m trong các giao th c m ng khác
52 BÀI 5: nhau Yersinia gi v là m t ch ng trình khung v ng ch c cho vi c phân tích và th nghi m các m ng và h th c tri n khai Các cu c t n công vào các giao th c m ng nh :
- Dynamic Host Configuration Protocol (DHCP)
- Hot Standby Router Protocol (HSRP)
- Inter-Switch Link Protocol (ISL)
5.3.3 Mô hình tri n khai a b Kích c d
5.3.4 Quá trình th c hi n a b no shutdown
R1(config-if)#no shutdown cdp enable
R1(config-if)#cdp enable ki m tra CDP neighbor, traffic, CPU cho quá trình x lý gói tin CDP c Yersinia root@kali:~#yersinia G
54 BÀI 5: ch : CDP, DHCP, ng trình Yersinia flooding CDP table OK
- Show process cpu sorted | incude CPU|PID runtime| CDP Protocol
56 BÀI 5: ng trình Yersinia List attacks Cancel all attacks d no cdp enable
R1(config-if)#no cdp enable
DHCP STARVATION ATTACK
5.4.1 Gi i thi u t n công DHCP Starvation Attack
R1(config)#ip dhcp pool VLAN1
R1(config)#ip dhcp excluded-address 192.169.10.1
Trên má - root@kali:~#yersinia G trình :
60 BÀI 5: tab DHCP và sending DISCOVER packet OK
tra các trình và lý CPU show process
Trên máy Client, hành xóa IP ipconfig /release trong cmd) và xin phát IP DHCP Server n không thành công thông báo không liên DHCP server (xem hình bên
62 BÀI 5: n công, vào nút List attacks Cancel all attacks
Trên router R1, gõ show ip dhcp binding có IP mà DHCP Offer do quá trình công DHCP Starvation gói tin Discover liên router R1 show ip dhcp server statistics trong database d hình
- Port security switchport port- security maximum
SW(config-if)#switchport port-security
SW(config-if)#switchport port-security maximum 2
- DHCP Snooping gói tin DHCP DISCOVER, DHCP REQUEST hay DHCP RELEASE Các interface trust gói tin DHCP OFFER
SW(config)# ip dhcp snooping
SW(config)# ip dhcp snooping vlan 1
SW(config-if)# ip dhcp snooping trust
SW(config)#no ip dhcp snooping information option
66 BÀI 6: ng còn IDS có tích Base (Basic Analysis and Sercurity Engine)
6.2.2 Cài ph n m m Iptables và c u hình
[root@ngoclong ~]# rpm qa | grep iptables
[root@ngoclong ~]# rpm ivh iptables-1.3.5-4.el5.i386.rpm
[root@ngoclong ~]# rpm qa | grep iptables iptables-ipv6-1.3.5-4.el5 iptables-1.3.5-4.el5
-A INPUT -p icmp icmp-type any -j DROP
-A INPUT -m state state NEW -m tcp -p tcp dport 22 -j DROP
-A INPUT -m state state NEW -m tcp -p tcp dport 80 -j DROP
-A FORWARD -s 0/0 -i eth0 -d 192.168.211.131 -o eth1 -p tcp / sport 1024:65535 dport 80 -j DROP
-A FORWARD -s 0/0 -i eth0 -d 192.168.211.131 -o eth1 -p tcp / sport 1024:65535 dport 22 -j DROP
-A PREROUTING -d 192.168.0.38 -i eth0 -p tcp dport 80 -j DNAT / to- destination 192.168.211.131:80
-A PREROUTING -d 192.168.0.38 -i eth0 -p tcp dport 22 -j DNAT / to- destination 192.168.211.131:22
-A POSTROUTING -o eth0 -j SNAT to-source 192.168.0.38
-A INPUT -p icmp icmp-type any -j ACCEPT
-A INPUT -m state state NEW -m tcp -p tcp dport 22 -j ACCEPT
-A INPUT -m state state NEW -m tcp -p tcp dport 80 -j ACCEPT
-A FORWARD -s 0/0 -i eth0 -d 192.168.211.131 -o eth1 -p tcp / sport 1024:65535 dport 80 -j ACCEPT
-A FORWARD -s 0/0 -i eth0 -d 192.168.211.131 -o eth1 -p tcp / sport 1024:65535 dport 22 -j ACCEPT
# yum install gcc gcc-c++ kernel-devel patch make libxml2 pcre-devel php php-common php-gd php-cli php-mysql flex binson libcap libcap-devel mysql mysql-devel mysql-bench mysql-server y eb
# wget http://pear.php.net/go-pear
# pear install Image_GraphViz-1.3.0RC3 http://www.filewatcher.com/m/libnet-1.0.2a.tar.gz
# tar zxvf /Download/libnet-1.0.2a.tar.gz
# /configure && make && make install http://www.snort.org red-
# tar zxvf /Download/snort-2.8.5.3.tar.gz
# /configure enable-sourcefire enable-targetbased with-mysql
# chown snort:snort /var/log/snort
# tar zxvf /Download/snortrules-snapshot-CURRENT.tar.gz
# ln s /usr/local/bin/snort /usr/sbin/snort
# cd /etc/snort/so_rules/precompiled/CentOS-5.0/i386/2.8.5.3
# cp * /usr/local/lib/snort_dynamicrules/
Var RULE_PATH /etc/snort/rules
Var SO_RULE_PATH /etc/snort/so_rules
Var PREPROC_RULE_PATH /etc/snort/preproc_rules
# vi /etc/snort/rules/local Rules
70 BÀI 6: alert tcp any any -> any 23 (msg:"Telnet Connection=> Attempt"; sid:100001;) alert tcp any any -> 192.168.0.0/24 any (msg:"SYN-FIN=>scan detected"; sid:1000002;) alert icmp any any -> 192.168.0.0/24 any (flags: A; ack: 0; msg:"TCP ping detected"; sid:100003;) alert tcp any any -> any 22 (msg:"ssh connection=>Attempt"; sid:1000004;)
# /usr/local/bin/snort -Dq -u snort -g snort -c /etc/snort/snort.conf
-rw - 1 root root 6205014 Dec 3 16:32 snort.alert
-rw - 1 root root 6205014 Dec 3 16:32 snort.log
# wget http://snort.org/dl/barnyanrd2-1.8.tar.gz
# tar zxvf /Download/Barnyard2-1.8.tar.gz
# cp barnyard.conf /etc/snort
Mysql> grant create, insert, select, delete, update on snort.* to snort@localhost;
# cd /usr/local/snort-2.8.5.3/schemas/
6.2.5 C Snort th c hi n alert vào MySQL
# vi /etc/snort/snort.conf
- output database: log, mysql, user=snort password3456 dbname=snort host=localhost
# mysql usnort -p"123456" -D snort -e "select count(*) from event"
280278 http://nchc.dl.sourceforge.net/sourceforge/adodb/
# tar zxvf /Download/adodb4991.tgz
6.2.6 t và c u hình Basic Analysis and Sercurity
Engine (Base) các Snort alert
# tar zxvf /Download/base-1.4.5.tgr.gz
# cp base_conf.php.dist base_conf.php
$archive_exists=1; # set this to 1 if you have an archive DB câu l
# snort c /etc/snort/snort.conf i eth0
Firewall và IDS có 2 network interface, hi n ang c c m sau:
- Account qu n tr : root/root
Basic Analysis and Security Engine 1.4.5
- File c u hình: /etc/snort/snort conf
- Th m ch a t p lu t: /etc/snort/rules/
- File log: /var/log/snort/
# /usr/local/bin/snort Dq u snort g snort i eth0 c /etc/snort/snort.conf
6.3.3 K t qu th ng kê th c nghi m Firewall Iptables
Pinging 192.168.0.38 with 32 bytes of data:
Reply from 192.168.0.38: Destination host unreachable
Reply from 192.168.0.38: Destination host unreachable
Reply from 192.168.0.38: Destination host unreachable
Reply from 192.168.0.38: Destination host unreachable
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Login as: root password: last login: Mon Nov 29 17:02:45 2010 from 192.168.0.11
Pinging 192.168.0.38 with 32 bytes of data:
Reply from 192.168.0.38: bytes2 time=9ms TTLd
Reply from 192.168.0.38: bytes2 time=9ms TTLd
Reply from 192.168.0.38: bytes2 time