Is it possible to sniff traffic of a remote network? (With admin access to router)

Question

Me and a friend of mine are simulating a widespread scenario where router configurations are untouched (default passwords) and are visible from the internet. Him, acting as the victim, will constantly ping out a packet with a specific content (just a string) to a website, and me, as the bad guy, is supposed to sniff out those packets and tell him the string the next time we meet. Having said my purposes, here are my questions:

1. Is it possible to sniff out a remote network's traffic, provided that I have admin access over the router/modem? (We thought of exploiting the static routing and forwarding all traffic to a remote server, then said server will forward his traffic to his ISP. We also thought of the same thing, but instead of forwarding directly to the ISP, we somehow return the traffic to the router and let it take care of the ISP business)

2. How feasible is the attack vector we thought of? (We considered the impact on the network bandwidth, but we will ignore this fact for now.) ----Are there existing services that do exactly this? (act as a sort of man-in-the-middle server)

3. If it is possible, what other attack methods are available out there? How difficult would this be to implement? (consider the above-average, computer literate, logical Joe)

4. How detectable would those attacks be? (The ones we thought of are clear as daylight; connection would almost grind to a halt on heavy traffic)

I already read this, but I don't think the user has admin access over the network. Mirroring is not allowed, as not all routers have this feature (but ours has this).

---

Update: A few years later, I realized that anything is possible. I was able to root my own router, gain telnet access, then gain ssh access, and finally run a program as root, using an unsanitized input field (diagnostics -> ping) while using a non-privileged account.

The router involved was a TP-Link Archer C2. It was running some sort of Unix on MIPS. The program used was udp2raw compiled specifically for MIPS.

Answer 1

Question #3 is much too open ended to answer. For the others, the answer depends on the router model in question and, in function of that, the exact meaning of "admin access".

If the router is a Cisco IOS based device and you have privilege level 15 access you can use the regular packet sniffing commands of IOS which would certainly allow you to achieve your sniffing task. However, no Cisco admin in his or her right mind would make the admin interface accessible from the Internet, let alone with a default password, so the attack is not very feasible in real life. Also, every Cisco admin worth his or her pay would have set up logging to a central syslog server so your login and all the commands you use would be visible in the log.

If it is a regular cheap consumer router and you have access to the web GUI then most models do not offer a packet sniffing function there. A few do, though. (Often on a "hidden" URL but that's no obstacle of course.) Most models are not accessible from the Internet by default, but a few are. So if the router in question is one of the models with a built-in sniffer and accessible from the Internet then yes, the attack would be feasible, and might go undetected since most of these devices do not even support logging to a log server, and even if they do, an owner who doesn't change the default password will not configure logging either. So in this case the attack depends entirely on the specific router model and your knowledge of that.

If it is a Linux based router (either one of the many commercial models using a Linux kernel, or some homebrew device) and you have root access to the Linux kernel then you can of course do anything you wish. Root access with password authentication from the Internet is however definitely unwise, and not the default configuration for any device I've ever seen.

Answer 2

If you can login remotely, then there will be very little that you cannot do. Once you have a root shell, you can easily run tcpdump. You can read the local databases that supply encryption keys elsewhere. If within that shell, you are missing commands; you can write, or simply go find the commands you want. If you do manage to get in, there is probably a lot of bandwidth; and you might go unnoticed for a while as long as things continue to work.

http://www.tomshardware.com/answers/id-2199813/blocking-backdoor-fios-router.html

However, most people will let the ISP setup the router that connects to the ISP; and that's not going to have the default password and let the world in. Verizon uses an enormous UUID for the encryption key (written on a sticker on the modem), etc. There will be misconfigured stuff out there, but it's not like it used to be (with end users going to Best Buy and (mis)configuring it himself).

Answer 3

Given that we're talking about unencrypted http traffic (if it's encrypted just leave it) push up the server on desired port, push up bogus dns service, that'll be returning your server's IP on every dns request, and change router DHCP parameter "DNS server(s)" on your server's IP.

Answer 4

In addition to attempting to sniff packets at the router itself, there are, of course, methods that let you take advantage of the fact that you have some control over the router to enable attacks in other places where you have greater flexibility & ease of sniffing his traffic. Two examples:

1. If the router has the ability and you have the access, configure the router to forward outbound http traffic to a transparent proxy server that you have set-up, with whatever packet-sniffer you like running on the box or VM alongside it. The "transparent" part means the user on the end-client (ie. him, using his computer) will not be able to detect any changes in his device's network settings, because no such changes will be needed or occur; everything will be done by his router and your proxy. As for whether this would raise suspicions with an end-user by significantly affecting the speed of the connection, I suppose that depends on the performance of your selected proxy server and the latency added by the length of the segment between his router and your server, among other factors. Apache configured as a transparent proxy, running on an AWS instance with suitable specs, might be one fairly straightforward way to set something like this up and get non-lousy proxy performance. Against an ordinary user, the tactic would likely go undetected for quite a while in most cases. Against a tech-savvy person specifically watching for connection latency anomalies... no guarantees.

2. Change his DNS server settings to point to malicious DNS server you've set up, pointing him when he requests any unencrypted/plain http site to a legitimate-looking error page that contains a malicious element you've attached with Metasploit. If he's non-diligently running an unpatched Java client or Flash version you can drop a reverse https payload on his box, then go in and run a sniffer or share his screen and watch him as he fires off his ping to wherever. :-)

(Note: That second thing was a joke. Going beyond changing the config of the other guy's router to hacking his PC without his further expanded consent would be exceeding the scope of what you have permission to do. Which could/would affect the legality of your actions. Don't go there.)