In this lesson, we're going to dive into the concept
of packet crafting, explaining what it is, how it works,
and providing detailed examples of using Impacket
to perform network attacks.
Packet crafting involves creating custom network packets
to test network devices, simulate attacks,
or explore vulnerabilities.
Now, it allows penetration testers
to manipulate packet headers
and payloads to observe how network devices may respond.
By carefully crafting these packets,
you can identify weaknesses in network defenses,
probe firewall rules,
and test intrusion detection systems.
To craft packets, tools like
Scapy, Hping, and Impacket are commonly used.
Impacket, a collection of Python classes
for working with network protocols
is one of the best tools in my opinion
for pentesters.
It supports a variety of protocols,
including SMB, MSRPC, and LDAP, and also more.
Now, let's walk through some examples of using
Impacket to perform network attacks.
First, let's discuss how we would perform
an SMB relay attack.
The SMB relay attack exploits the SMB protocols to intercept
and relay authentication attempts,
gaining unauthorized access to systems.
To perform this attack using Impacket,
you need to have the smbrelayx tool
from Impacket installed.
First, you need to configure your environment.
Ensure you have a system ready
to relay the SMB authentication request.
This can be an attacker machine in the same
network as the target.
To set up the attack, we will use the following command.
Now, in this example, you will replace the [Attacker IP]
with your IP address as the pentester.
[Target IP] with a target's IP address,
and [User] with the user whose credentials you want to relay
Next, we will wait for a connection.
We need to monitor for incoming connections
that you can relay.
The tool will capture SMB authentication attempts
and relay them to the target system.
After that, we would attempt to gain access.
Once the target system accepts the relayed authentication,
you can access a system with the same privileges
as the relay user.
Next, let's go over LDAP relay attack.
An LDAP relay attack is similar to an SMB attack,
but targets LDAP authentication.
Impacket provides the
ntlmrelayx.py tool for this purpose.
Here is an example of commands to start this attack.
Here, the [Target IP] is the IP address
of the LDAP server that you want to target.
The tool will listen for the incoming NTLM authentication
requests and relay them to the specified LDAP server.
Once the LDAP server receives the relayed authentication,
you can perform various LDAP operations,
such as curing user information or modifying entries.
Lastly, let's discuss packet crafting with Scapy.
While Impacket is powerful for protocol specific attacks,
Scapy offers flexibility for crafting custom packets
at a lower level.
Here's an example of a short Python script
using the Scapy library to craft a packet.
This script creates and sends a custom TCP SYN packet
to the target IP address,
192.68.1.1 on port 80.
The source IP address of 192.168.1.100
and the source port of 12345
are optional and can be customized.
The SYN flag is used to initiate a TCP connection.
Let's break down this code snippet:
the script begins by importing all necessary functions
and classes from the Scapy library using
from 'scapy.all import*'
Then we have the IP function.
The IP function is used
to create the IP layer of the packet.
The destination IP address is set using
'ip_layer.dst'
And the optional source IP address can be set using
'ip_layer.src'
The TCP function is used
to create the TCP layer of the packet.
The destination port is set using
'tcp_layer.dport'
And the optional source port can be set using
'tcp_layer.sport'
The TCP flags are set to "S" to indicate a SYN packet,
which is again used to initiate a TCP connection.
The IP and TCP layers are combined using the '/' operator
to form the complete packet.
The send function is used
to send the crafted packet over the network.
And at the last part of the program,
we have the 'print(packet.show())' function,
which is optional and is used to display
the details of the crafted packet
for verification and debugging purposes.
So, remember, packet crafting is a powerful technique
used by pentesters.
By understanding how to create
and manipulate network packets,
you can uncover vulnerabilities, test defenses,
and enhance the security posture
of the networks you assess.
Tools like Impacket and Scapy provide the flexibility
and power you need to perform these tasks effectively.