CS434 Computer Security Mitnick Attack Lab Group09

Summary

This demonstration showcases a Midnight Attack Lab, where participants learn to exploit network vulnerabilities using Docker Compose and tools like Wireshark. The session begins with establishing a connection between the attacker and trusted computers by creating an authentication file. Participants then manipulate TCP sequence and acknowledgment numbers to create unauthorized access, culminating in the setup of a backdoor through the `midnight_ack.py` file. The demo effectively illustrates the techniques involved in executing a cyber attack and emphasizes the importance of network security awareness.

Takeaways

• 💻 The demo focuses on the setup of the Midnight Attack Lab using Docker Compose for environment configuration.
• 🔗 The attacker and trusted computers are connected through an `outhouse` file for automatic authentication.
• 📊 Wireshark is used to monitor network traffic, enabling analysis of the attack process.
• 🔍 The TCP three-way handshake is observed, with emphasis on capturing sequence and acknowledgment numbers.
• ⚙️ The `midnight ack` file is manipulated to swap ACK and sequence numbers, crucial for establishing communication.
• 📁 A command is executed to create a file (`tmpxyz`) on the trusted computer, indicating successful session establishment.
• 📡 Port 1990 is set up and confirmed active through Wireshark, demonstrating successful port manipulation.
• 🗂️ The presence of the `xyz` file is checked on the trusted computer after executing the touch command.
• 🔑 A backdoor is established by modifying the 'midnight ack.py' file to facilitate unauthorized access.
• ✅ The demo concludes with the successful setup of the backdoor, showcasing the entire attack process.

Q & A

What is the main purpose of the Midnight Attack Lab demo?

The demo illustrates how to establish a backdoor connection between an attacker computer and a trusted computer using network protocol manipulation.

What tools are being used in the demo?

The demo utilizes Docker Compose for environment setup, Wireshark for monitoring network traffic, and a custom program called 'midnight spoof' for manipulating TCP sequences.

How does the attacker authenticate and connect the two computers?

The attacker creates an 'outhouse' file that echoes the IP address of the trusted computer, allowing automatic authentication and connection.

What role does Wireshark play in the demonstration?

Wireshark is used to monitor the TCP traffic, allowing the attacker to capture and analyze sequence numbers necessary for exploiting the connection.

How are TCP sequence and acknowledgment numbers manipulated?

The attacker captures a sequence number from the initial communication and modifies the acknowledgment number in the 'midnight ack' file to facilitate further communication.

What command is executed to confirm that the backdoor is successfully established?

The command 'touch tmpxyz' is executed, which creates a file on the trusted computer, indicating that the session has been successfully established.

What is the significance of the command 'echo plus plus' in the setup process?

The 'echo plus plus' command is used to add host information into the 'outhouse' file, which is crucial for maintaining the backdoor connection.

What does the phrase 'midnight ack' refer to in the context of this demo?

'Midnight ack' refers to a specific program or script used to modify TCP acknowledgment numbers as part of the exploitation process.

Why is it important to swap the sequence and acknowledgment numbers?

Swapping these numbers allows the attacker to impersonate legitimate communication, effectively hijacking the session and gaining unauthorized access.

What does the demo reveal about potential vulnerabilities in network security?

The demo highlights how easily attackers can exploit weaknesses in network protocols, underscoring the need for robust security measures to protect against such attacks.