Copy Link
Add to Bookmark
Report
Phrack Inc. Volume 11 Issue 57 File 06
==Phrack Inc.==
Volume 0x0b, Issue 0x39, Phile #0x06 of 0x12
|=-------------------------=[ T A R A N I S ]=---------------------------=|
|=-----------------------------------------------------------------------=|
|=------------------------=[ Jonathan Wilkins ]=-------------------------=|
Taranis
-------
Code by Jonathan Wilkins <jwilkins@bitland.net>
Original concept by Jesse <jesse@bitland.net>.
Thanks to Skyper <skyper@segfault.net> for his assistance
URL: http://www.bitland.net/taranis
Summary
-------
Taranis redirects traffic on switch hardware by sending spoofed ethernet
traffic. This is not the same as an ARP poisoning attack as it affects
only the switch, and doesn't rely on ARP packets. Plus, it is virtually
invisible because the packets it sends aren't seen on any other port on
the switch. Evading detection by an IDS that may be listening on a
monitoring port is as simple as changing the type of packet that is sent
by the packet spoofing thread.
How it works
------------
First, some history. Back in the old days, we had 10base5, or thick Ethernet.
The 10 prefix meant that it was 10 Megabit and the 5 postfix indicated that
the maximum cable length was 500 meters. It used a coaxial cable, much like
cable TV uses. (The difference is in the maximum impedence of the cable, TV
cable is 75 ohm, ethernet is 50 ohm) Coaxial cable consists of a central wire
which is surrounded by a layer of insulator, which is enclosed in a shield
made of thin stranded wire. This is all encased in another thinner insulating
layer. A thick Ethernet network had a shared backplane and then a series of
trancievers that plugged into it. If the shared portion of the cable broke,
or rodents happened to chew through it, then the entire network went down.
Since the cable was usually strung throughout the ceiling and walls it was
quite inconvenient to fix. Long runs of cable had to be augmented by a
repeater, which was just a little device that boosted the signal strength.
A 10base5 network looked something like this:
Shared backplane
X-+------+------+------+------+------+-X (+ - Tranciever)
| | | | | | (X - Terminator)
| | | | | |
Host Host Host Host Host Host
A B C D E F
This was replaced by thin Ethernet (10base2, which means that it was 10Mbit and
had a maximum cable length of 200 meters)), which was based on a shared
cable but didn't require trancievers and so was less expensive. (10base2 was
also known as cheapernet) It was also vulnerable to the rodent attack.
10base2 looked something like this:
X------.------.------.------.------.------X
Host Host Host Host Host
A B C D E
(X - terminator which is just a 50 ohm resistor)
(. - BNC Connector, T shaped piece of metal that
connected two pieces of cable with a computer)
Then came 10baseT, or Twisted Pair Ethernet. This was based around a star
topology. The reason for the name is clear when you see a diagram.
Host A Host B Host C
| | |
\________ | ________/
\ | /
Switch or Hub
/ | \
/~~~~~~~~ | ~~~~~~~~\
Host D Host E Host F
Now if rats happened to chew through a network cable, only one computer would
lose network connectivity. If a giant rat happened to eat the network hub,
it was easy to crimp new ends on the twisted pair cable and buy a new hub.
An Ethernet Frame header looks like this:
| | | | | | | | | | | | | | |
0 6 11 13
Bytes 0-5 are the Destination Address
Bytes 6-11 are the Source Address
Bytes 12-13 is the Type Code (IP is 0x0800)
All of the discussed ethernet types (10base5, 10base2 and 10baseT) are based
around a shared medium. This means that packets are broadcast to every
connected machine. It also means that when one device is sending, no other
devices can send.
To increase bandwidth, switches were created. Ethernet switches only forward
packets to the port (a port is the hole you plug the cable into) that the
packet is destined for. (This means all ports in the case of a broadcast
packet) This meant that more total packets could be sent through the network
if a switch were used than if a hub was used.
Switches and hubs are built to allow uplinking (when you connect another switch
or hub into a port instead of just a single computer). In the case of a hub,
this just means that there are more machines sharing the available bandwidth.
In the case of a switch it means that the internal traffic from one hub won't
be seen on other ports. It also means that multiple ethernet addresses can be
on each port and that the switch must contain a list of all of the ethernet
addresses that are on a given physical port and only forward traffic to the
port that the destination host is on. It would be silly to require a network
administrator to track down the ethernet addresses for each of the connected
machines and enter them manually to build this list, so switches generate this
list automatically by watching network traffic.
As long as there is a way for this to be configured automatically, the switch
is probably vulnerable to this attack.
When run, Taranis will start sending packets with the mail server's ethernet
address as the source ethernet address and the attacking machine's real
ethernet address as the destination address. When the switch sees this
packet it will update it's internal table of port->ethernet address mappings.
(This is called the CAM table. For more information on how the CAM table
is updated check, http://routergod.com/gilliananderson/
For the record, CAM apparently stands for Content Addressable Memory, an
extremely generic term) The switch will not forward the packet to any other
ports as the destination ethernet address is set to an ethernet address
already associated with the current port.
This internal table looks something like this:
Port | Ethernet Addresses
-------+----------------------------------------
Port 1 | 01:00:af:34:53:62 (Single host)
Port 2 | 01:e4:5f:2a:63:35 00:c1:24:ee:62:66 ... (Hub/Switch)
Port 3 | 11:af:5a:69:08:63 00:17:72:e1:72:70 ... (Hub/Switch)
Port 4 | 00:14:62:74:23:5a (Single host)
...
As far as the switch is concerned, it has a hub connected on that port, and
it just saw a packet from one host on that hub to another host on the same
hub. It doesn't need to forward it anywhere.
Now that we are seeing traffic destined for the mail server, what can we do
with it? The initial idea was to perform a man in the middle attack, but
this proved to be more difficult than anticipated. (see the comments for
switchtest at the end of this file) Instead taranis spoofs enough of a pop
or imap session to get a client to authenticate by sending it's username
and password.
Taranis will store this authentication information to a logfile. To see
everything displayed in a nicer format run:
cat taranis.log | sort | uniq
Configuration
-------------
Taranis was developed under FreeBSD 4.3. It also builds under OpenBSD and
Linux. If you port it to another platform, send me diff's and I'll integrate
them into the release.
You will require a patch to your kernel to allow you to spoof ethernet source
addresses under FreeBSD and OpenBSD. LibNet has one for OpenBSD and for
FreeBSD < 4.0. I have updated this patch for FreeBSD 4+ and it is included
in this archive as if_ethersubr.c.patch. You can use it as follows..
- su root
- cd /usr/src/sys/net
- patch < if_ethersubr.c.patch
and then rebuild your kernel
Switchtest
----------
Switchtest was written during the development of Taranis. It is included in
case someone wants to test their switches and ip stacks. We weren't able to
find a switch that defaulted to hub mode when confronted with lots of packets
with random source ethernet addresses. Maybe someone else will.
It also tries a man in the middle attack. This shouldn't work as it is based
on resending traffic to ethernet broadcast or ethernet multicast addresses.
If a target IP stack is vulnerable, I'd like to hear about it.
We had discussed the possibility of a generalized man in the middle attack.
It is postulated that you could do a decent job of the attack by redirecting
traffic for a while, and queueing the packets, then resetting the switch (with
an arp request) and then sending the queued packets, then redirecting again.
This will probably cause a lot of packet drops, but tcp applications may be
able to continue in the face of this..
FAQ
---
Q: Where does the name come from?
A: Taranis was the name of a god in ancient Gaul. Whenever I can't think of
a name I randomly grab something from www.pantheon.org.
Q: Why do I keep getting PCAP open errors?
A: You're not root or your kernel doesn't have a pcap compatible way of
capturing packets. Perhaps your network is not ethernet.
Q: Why am I not seeing packets from the target machine?
A: There are several possibilities:
1. Your system is not spoofing ethernet traffic. Check the output with
ethereal (http://ethereal.zing.org/) or tcpdump (www.tcpdump.org)
If you are using tcpdump use the -e flag to display the link level
addresses
2. If the system you are on is spoofing the ethernet frames correctly
it is possible that the switch has a delay before it will switch the
port associated with an ethernet address. Some switches also have
a lock in mode, where they will not accept any changes to their
CAM table.
Q: Did [insert network type here] really look like that?
A: No. But I have no ascii graphics skills. When I get a chance I'll track
down some real pictures and post them at:
www.bitland.net/taranis/diagrams.html
|=[ EOF ]=---------------------------------------------------------------=|
