Hack a Cisco Switch with a Raspberry Pi - CCNA Security - CCNP Security - Network+

Key Takeaways

hey guys welcome back to network chuck well welcome to my network closet this is sorry my kids are going crazy this is the best I can do in an apartment right now so excuse my mess and kind of a slob to be honest I just like to make things work I was never one of those like super clean cable guys you know so I posted earlier or actually last week about this guy here and if you don't already know who he is this is my good buddy Malcolm he is my Raspberry Pi now Malcolm he's kind of a bad guy he's a bad dude he's running Kali Linux and that's a flavor of Linux that has a bunch of tools for networking attacks so while I've been playing with this and it's super fun and I wanted to show you guys a few of the attacks I like and kind of walk through those so I got them powered up I can remotely accessing via SSH and also B and C via Auto logs in so that's good so now I'm gonna plug him up to the switch here I want to show you a really awesome attack it's called a VLAN hopping attack and you're basically hacking into a switch it's amazing so um I'm gonna plug him in and I'm gonna I'm gonna go somewhere else he's gonna walk away and and try to hack into my own network just give it a try alright I'll like you Malcolm in let's get this thing going looking Malcolm to the port 14 remember that alright let's do this let's do this okay so I am in a public area attempting to attack or hack into my own and network my own switch now yeah I'm connected to my own VPN connection so that's one thing first things first remember I plugged my Raspberry Pi into my switch on port 14 so let's go and just take a look at things so before I actually do the attack what is a VLAN hopping attack you may not know what it is well well let's start with what is a VLAN you mean I even know what a VLAN is so in networking a VLAN is stands for a virtual and local area network and what VLANs allow us to do is partition or separate off networks in a switch basically where we're creating a little virtual switches inside of a switch and these break up what's called broadcast domains let's say you're connected to a switch in a port that's on be land one you can access computers in VLAN two unless you go to a router that can then route you to be Atlanta two so those VLANs are kind of like an extra layer of security they separate the traffic on the switch you cannot get to a host from VLAN one to VLAN two unless you go to a router or some kind of layer 3 device now that layer 3 could the device could also be the switch itself but it still has to go through the routing process to get back to that VLAN so it's an extra layer of security now what a VLAN hopping attack will do is it will attempt to pack that security now there are a couple ways to actually implement a beeline hopping attack I'm going to demonstrate today with my good old buddy Malcolm how to do it with the most popular method and it's called switch spoofing now when you have a port on a switch it's going to be one of two kinds it'll either be an access port which is you know typically what you plug your your computer into your your your printers and everything else or it'll be a trunk port and the trunk ports are usually connected to other switches whereas an access port you'll have one VLAN configured that's it when you plug your computer into that one access port you only have access to one VLAN so if you if that access port is configured for VLAN 1 you can only communicate with devices and via one unless you go to a router so you only have layer 2 access to devices in the in VLAN 1 and then you have your trunks your trunks I always pick your tree trunks these are your multi VLAN ports and they usually connect the switches and they'll pass traffic for multiple VLANs that's what they're designed for and they'll do this with a technology called 802 dot1q which is standard for trunking and it will tag these frames with a VLAN tag so the switch will know what what VLAN to send the frame to so using malcolm our Raspberry Pi with Kali Linux we will try to turn this room harmless access port that only gives people access to one VLAN into a trunk port giving us access to all of the VLANs opening up the door for a number of amazing attacks so let's keep going on this so first let's verify the state of the access port we're connected to so this was interface 14 so let's do a show interface status we'll do show interface FA 1 0 14 status we see right now is connected VLAN 1 now what you would typically see right here that where a trunk is it would say trunk so like let's look at one of my drawings let's do show interface trunk and spoken amongst air show interface FA 1 0 24 status and yeah so right here under VLAN assess Trump we want our interface sport team that look like that so let's uh let's power up our Raspberry Pi let's wake up Malcolm wake up the Beast alright here he is we're gonna launch an application called Yersinia alright so you can see that we can do a ton of attacks but in particular we're gonna do a DTP attack the dynamic trunking protocol which is what switches will use to negotiate if the report is going to be a trunk or an access port now again it's normally used by switches right but we're going to impersonally it switch with our mr. Malcolm here and try to hack into it so we'll use that attack dzp and then we'll select our attack type now this is kind of cool it's really stinking easy this is all I'm doing I'm selecting one for enabled trunking and that was it so let's go to our switch and see if it actually worked so let's go show interface fa1 0 14 status oh that's you believe that we just changed our look back up our uh our status here so before not moments ago it was just in an access port VLAN 1 now it's a stinkin trunk port show interface trunk there he is right there you know what he has access to all VLANs that's crazy now what we can do is sit ourselves and our your seniya malcolm attack here to 802 dot1q mode and listen for all the broadcast on the VLANs [Music] now you see what I'm seeing here so not only did I convert this accessport it's harmless access port into a trunk I been and I'm now able to see what IP addresses they have and the VLANs now at this point I could just assign myself an IP address and the VLAN of my choosing and access that network no problem so if I were a malicious hacker trying to do this pretty easy right now if you're studying for your CCNA or CCNA security or CCMP security you might know wolf chuck default security practices is to do something this one thing that will prevent this what is that so that's a really cool attack we change an access port into a trunk port with a really simple ill and took us a few seconds well guys that's about it if you like this type of video like security stuff hacking into things let me know I'll make more of these I love security and if you want to try this yourself look in the links below I'm gonna list the Raspberry Pi I bought everything you might need to get this started so links below check that out and what's amazing is the first time I actually did this attack was not with the Raspberry Pi it was actually in gns3 you can run the entire attack in gns3 not even kidding I let me know if you want to see that too whoo anyways I'm tired all that attacking right well if you haven't already subscribe hit that like button and I'll catch you guys later