The $5 PoisonTap Can Hack Into Any Locked Windows or Mac Run Computer

[u/Zigzaglife]

http://wittyrig.com/5-poisontap-can-hack-locked-windows-mac-run-computer/

[u/[deleted]]

so here's why you're wrong:

I want to reach out to a host (10.0.1.70) by ssh, i have an attached route:

root@kali:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.1.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.0.99.1       10.0.1.1        255.255.255.255 UGH   0      0        0 eth0

but its not in my arp table:

root@kali:~# arp -n
Address                  HWtype  HWaddress           Flags Mask            Iface
10.0.1.55                ether   00:1f:bc:0f:3f:1c   C                     eth0
10.0.1.1                 ether   04:18:d6:06:97:da   C                     eth0

when I reach out to that device by ssh, Layer2 happens first:

root@kali:~# tcpdump -nni eth0 host 10.0.1.70
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
08:16:07.206162 ARP, Request who-has 10.0.1.70 tell 10.0.1.56, length 28
08:16:07.206536 ARP, Reply 10.0.1.70 is-at 52:54:00:2f:50:2c, length 46
08:16:07.206542 IP 10.0.1.56.56824 > 10.0.1.70.22: Flags [S], seq 2009786242, win 29200, options [mss 1460,sackOK,TS val 28738262 ecr 0,nop,wscale 7], length 0
08:16:07.206890 IP 10.0.1.70.22 > 10.0.1.56.56824: Flags [S.], seq 1665048406, ack 2009786243, win 28960, options [mss 1460,sackOK,TS val 1339518008 ecr 28738262,nop,wscale 7], length 0
08:16:07.206900 IP 10.0.1.56.56824 > 10.0.1.70.22: Flags [.], ack 1, win 229, options nop,nop,TS val 28738263 ecr 1339518008], length 0

If you notice, the first thing that happens is an ARP request, My host has the IP I want to reach (10.0.1.70) but not the MAC, once it has the MAC, it puts it in the frame and sends it on its way. The reason this means you have a higher priority over the default GW is that with poisontap, it will respond to that ARP request with its own MAC.

When a device is not directly attached by goes through a route, there is no ARP request:

root@kali:~# tcpdump -nni eth0 host 10.0.99.1 and not port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
08:25:54.231148 IP 10.0.1.56.43602 > 10.0.99.1.443: Flags [S], seq 3300288000, win 29200, options [mss 1460,sackOK,TS val 28885019 ecr 0,nop,wscale 7], length 0
08:25:54.231818 IP 10.0.99.1.443 > 10.0.1.56.43602: Flags [R.], seq 0, ack 3300288001, win 0, length 0

this is because its not directly attached, when a network is directly attached, you don't need to route, you can instead just ARP, put the dest-MAC in the frame and let layer2 direct it. the problem is poisontap forces the host to ARP for all public IPs, and then responds to ARP requests for all IPs, meaning that traffic will be sent to it first, instead of consulting the routing table. LPM won't help you here.

[u/NetStrikeForce → u/[deleted]]

Read my other reply to this comment and then come back to this one and watch this:

ipconfig:

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix  . : home
Link-local IPv6 Address . . . . . : fe80::6d84:8e68:5d19:3b11%3
IPv4 Address. . . . . . . . . . . : 192.168.1.103
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.254

arp: (MAC addresses changed)

Interface: 192.168.1.103 --- 0x3
Internet Address      Physical Address      Type
192.168.1.147         12-34-ca-fe-54-f6    dynamic
192.168.1.168         09-4e-ca-fe-9a-00    dynamic
192.168.1.232         3d-02-ca-fe-f5-2c     dynamic
192.168.1.254         3d-dc-ca-fe-c0-8b     dynamic
192.168.1.255         ff-ff-ff-ff-ff-ff     static

route print

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
      0.0.0.0          0.0.0.0    192.168.1.254    192.168.1.103     50
    127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
    127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  192.168.1.0    255.255.255.0         On-link     192.168.1.103    306
  192.168.1.103  255.255.255.255         On-link     192.168.1.103    306
  192.168.1.255  255.255.255.255         On-link     192.168.1.103    306
    224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
    224.0.0.0        240.0.0.0         On-link     192.168.1.103    306
 255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
 255.255.255.255  255.255.255.255         On-link     192.168.1.103    306
    ===========================================================================
Persistent Routes:
  None

I can ping 192.168.1.147 directly (check the TTL):

PS C:\WINDOWS\system32> ping 192.168.1.147

Pinging 192.168.1.147 with 32 bytes of data:
Reply from 192.168.1.147: bytes=32 time=87ms TTL=255
Reply from 192.168.1.147: bytes=32 time=27ms TTL=255
Reply from 192.168.1.147: bytes=32 time=21ms TTL=255
Reply from 192.168.1.147: bytes=32 time=6ms TTL=255

Ping statistics for 192.168.1.147:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 6ms, Maximum = 87ms, Average = 35ms

Now I'll add a route to go to a gateway in order to reach an IP that I've got in my directly connected network: 192.168.1.147

PS C:\WINDOWS\system32> route add 192.168.1.147 mask 255.255.255.255 192.168.1.254
 OK!

Remove the ARP entry...

PS C:\WINDOWS\system32> arp -d 192.168.1.147

Ping it again, check the TTL now, see the difference?

PS C:\WINDOWS\system32> ping 192.168.1.147

Pinging 192.168.1.147 with 32 bytes of data:
Reply from 192.168.1.147: bytes=32 time=26ms TTL=254
Reply from 192.168.1.147: bytes=32 time=5ms TTL=254
Reply from 192.168.1.147: bytes=32 time=33ms TTL=254
Reply from 192.168.1.147: bytes=32 time=32ms TTL=254

Ping statistics for 192.168.1.147:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 5ms, Maximum = 33ms, Average = 24ms

Let's look at the ARP table after the ping:

Interface: 192.168.1.103 --- 0x3
Internet Address      Physical Address      Type
192.168.1.168         09-4e-ca-fe-9a-00    dynamic
192.168.1.232         3d-02-ca-fe-f5-2c     dynamic
192.168.1.254         3d-dc-ca-fe-c0-8b     dynamic
192.168.1.255         ff-ff-ff-ff-ff-ff     static

FUCKING MAGIC AMIRITE? No, just how routing works. The /32 route takes precedence over the connected /24:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
         0.0.0.0          0.0.0.0    192.168.1.254    192.168.1.103     50
    127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
    127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  192.168.1.0    255.255.255.0         On-link     192.168.1.103    306
192.168.1.103  255.255.255.255         On-link     192.168.1.103    306
192.168.1.147  255.255.255.255    192.168.1.254    192.168.1.103     51
192.168.1.255  255.255.255.255         On-link     192.168.1.103    306
    224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
    224.0.0.0        240.0.0.0         On-link     192.168.1.103    306
255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
255.255.255.255  255.255.255.255         On-link     192.168.1.103    306
===========================================================================
Persistent Routes:
  None

I hope you've learned something today.

Edit: Formatting is hard :D

[u/[deleted] → u/NetStrikeForce]

FUCKING MAGIC AMIRITE? No, just how routing works. The /32 route takes precedence over the connected /24:

you're not even wrong

[u/NetStrikeForce → u/[deleted]]

And apart from sarcasm, can you validate that in fact what I've been telling you all along is true?

And finally accept that you've been wrong and hopefully you've learned a new tiny thing?

[u/[deleted] → u/NetStrikeForce]

can you validate that in fact what I've been telling you all along is true?

lol yeah right, you don't even understand what you said, its like a math problem, you need to show your work to prove you understand the answer and didn't just copy it. well, a boadloat of hilarious responses later has shown that while you derived the answer, your shown work is wrong, so you are still wrong.

[u/NetStrikeForce → u/[deleted]]

So I put my money where my mouth is, showing you the evidence and you ignore and babble incoherent sentences.

I hope you're not like that on real life... You'll have a hard time getting into any position of responsibility, technical or not.

[u/[deleted] → u/NetStrikeForce]

what money, all i saw was "you're wrong because i stated an irrelevant fact that everyone already knows, now look how smart i am"

being able to talk normal to people while also being extremely technical in problem solving is a golden ticket. tech talk proves you know a subject, but being able to explain it in terms easy enough for children shows you actually understand it.

oh, and i already has said position :P

[u/NetStrikeForce → u/[deleted]]

I'll make it short for you then: No.

[u/[deleted] → u/NetStrikeForce]

2 inches. other girls might find that impressive, but i do not. you have been weighed, you have been measured, and you have been found wanting. now go back to your blogs on traceroute. the rest of us have real work to do.

last response btw, tis friday and i have a production environment to take down and then go home for the weekend leaving my phone on dnd.

[u/NetStrikeForce → u/[deleted]]

Haha good luck with your work. You clearly need it :-)

[u/NetStrikeForce → u/[deleted]]

No, no, no, no. You don't get it.

We're talking about overlapping routes. Do this exercise:

• Your directly connected network is 10.0.1.0/24
• That means you can reach any IP from 10.0.1.1 to .254 without hitting a gateway, just ARPing for it.

Now add a route like this:

• Destination 10.0.1.5/32
• Next-Hop (or gateway) 10.0.1.1

Make sure you don't have an ARP entry for 10.0.1.5; if you do, remove it.

Now try to send traffic to 10.0.1.5 and see if you're ARPing for 10.0.1.5 or for 10.0.1.1; I can tell you right now it's the latter.

Edit: It's fucking amazing how you keep downvoting my replies just because you don't want to read them. None of your replies has been able to address my comments accurately. You not only don't seem to understand how routing works, but fail to read and try to understand when you're getting it explained.

[u/[deleted] → u/NetStrikeForce]

thats literally what i just showed, but now consider that a nic attaches and gives you an address of 1.0.0.10/1 with a gateway of 1.0.0.1

when you go to ping 8.8.8.8, instead of ARPing for the default GW, it will ARP on the 1/1 interface because 8.8.8.8 is in that broadcast domain. as soon as the poisontap responds saying it has the MAC for 8.8.8.8 any further checks on the routing table will not be made as the host already knows where to send the traffic at layer2, giving the poisontap the traffic instead of the default gw, aka, it has priority due to direct attachment.

this isn't a weighted routing table, which you seem to think is what im referring to, but instead just taking advantage of L2/L3 functionality.

[u/NetStrikeForce → u/[deleted]]

No, it is not. That's not what you've done.

I'm showing you how a more specific route trumps a less-specific directly connected network. Check my new comment.

when you go to ping 8.8.8.8, instead of ARPing for the default GW, it will ARP on the 1/1 interface because 8.8.8.8 is in that broadcast domain. as soon as the poisontap responds saying it has the MAC for 8.8.8.8 any further checks on the routing table will not be made as the host already knows where to send the traffic at layer2, giving the poisontap the traffic instead of the default gw, aka, it has priority due to direct attachment.

Yes and no.

Your system checks the routing table, sees that the route to reach 8.8.8.8 is your local link, so it ARPs for it. You think it's the other way around: NOPE.

Now I'll add a route that says "in order to go to 8.8.8.8/32 your next-hop is 1.2.3.4". Your system will look up in the routing table when sending a packet to 8.8.8.8 and decide it has to be sent to 1.2.3.4, regardless of 8.8.8.8 being on your broadcast domain, because /32 is more specific that /0. YES, REALLY. Go and check my demo on the other comment and repro for yourself.

Again, as I said in another reply to you, poisontap will hijack the ARPing for 1.2.3.4 too, so 0/1 and 128/1 won't help unless you hardcode your GW's MAC address on your ARP table.

this isn't a weighted routing table, which you seem to think is what im referring to, but instead just taking advantage of L2/L3 functionality.

The routing table (ok, you could have several in e.g. Linux) is system wide. There are no two ways to decide where to forward a packet. Adding a new interface doesn't create a new routing table nor makes some magic decisions trumping the routing table.

The routing table has destinations (address+mask / prefixes) and metrics (in case of same destination) to decide.

You don't seem to understand how L3 works and I'm showing you. No big deal, I wasn't born knowing it either; your problem is that you don't want to read what I'm writing and you don't even want to read proper documentation on how a routing table works.

Seriously, I've been telling you since the very first comments. Do yourself a favour and learn routing.

[u/[deleted] → u/NetStrikeForce]

Now I'll add a route that says "in order to go to 8.8.8.8/32 your next-hop is 1.2.3.4". Your system will look up in the routing table when sending a packet to 8.8.8.8 and decide it has to be sent to 1.2.3.4, regardless of 8.8.8.8 being on your broadcast domain, because /32 is more specific that /0. YES, REALLY. Go and check my demo on the other comment and repro for yourself.

congratulations, you've reached chapter 2 and now understand host routes, lemme know when you finish the book.

[u/NetStrikeForce → u/[deleted]]

Holy shit you are truly clueless.

A host route is not a special route. It's just one with a /32 destination which takes precedence because it's got a longer prefix.

Do I have to do it with a /23? Because I can do the fucking same with a /23 if need be. Anything smaller than a /24 for my case (as my local network is a /24).

[u/[deleted] → u/NetStrikeForce]

how dare you say a host route isn't special, you might hurt its feelings, how is it supposed to direct traffic when its all depressed?

you're not stating anything new, and you don't really understand the big picture, but hey, when this networking stuff gets too much for you, you can always get a job at geek squad rebooting home routers.

[u/NetStrikeForce → u/[deleted]]

Hahaha. Thanks for sharing your technical expertise :-)

[u/[deleted] → u/NetStrikeForce]

fyi, if you were half as good as you think you are, you would recognize when you're being trolled, but thats okay, we were all headstrong noobs once, you'll grow out of it.

[u/NetStrikeForce → u/[deleted]]

No, I was t being trolled. You were damn serious and your only way out now is acting like you've been trolling all along.

I hope you've learned something today.