1

I'm practicing penetration testing and I'm in front of a basic routing exercise. The context is the following: I'm using a virtual machine with Kali Linux from which I connect in VPN to the network that provides hosts for the exercises. Before connecting, typing the route command I get the following output:

root@kali:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    100    0        0 eth0
10.0.2.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0

after the connection instead, this one:

root@kali:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    100    0        0 eth0
10.0.2.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0
192.168.193.0   0.0.0.0         255.255.255.0   U     0      0        0 tap0

and this is the output of the ip route command:

root@kali:~# ip route show table main
default via 10.0.2.2 dev eth0 proto dhcp metric 100 
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100 
192.168.193.0/24 dev tap0 proto kernel scope link src 192.168.193.70

So, the 192.168.193.0/24 is the internal network; from this one, it is possible to reach other networks. One of the task is to find wich ones and add a route to reach them.

To find the network, I have a wireshark file that show as from the 192.168.193.0/24 network's hosts, we can reach 2 web server, with these ip address:

10.86.74.7
10.85.174.87

So, what I have to do is to add a route from my internal network to this 2 others. The problem is that I have NOT the gateway of this network, cause "How many routers there are in the network" is one of the proposed question. So, If i want execute these command:

ip route add -net 10.86.74.0/24 gateway_address dev tap0
ip route add -net 10.85.174.0/24 gateway_address dev tap0

what I miss is the gateway_address parameter. I tried to execute the command without this parameter, or:

ip route add -net 10.86.74.0/24 dev tap0

but, of course, I got the Destination Host Unreachable error when I try to ping one of the host.

So, my question is: how can I find the gateway address? May be the use of the wireshark file? And if yes, what I must search inside it?

Improve this question
3
  • Have you tried a simple traceroute to see if it shows the path?
    – Jesse P.
    Commented Aug 25, 2018 at 13:51
  • Did you try 10.86.74.1 for the gateway address to the 10.86.75.0/24 network? Or maybe there is something else that looks like a gateway that show up in wireshark or maybe in arp -a?
    – hft
    Commented Sep 25, 2018 at 22:48
  • Look for IP packets with a source / destination address not in the subnet (ignoring things like dhcp where you may find 0.0.0.0). The corresponding link layer addresses will be that of a router
    – Torin
    Commented Dec 24, 2018 at 23:08

2 Answers 2

Reset to default
1

My suggestion is to ping that address and check the TTL value and with tcpdump verify the path that the ICMP packets takes, over tap0 or eth0 according your configuration, if you get the ICMP destination unreachable is because your router can not find the address. As other users suggest you can use traceroute and verify the path, but with your setup probably with pings you will make it work.

Improve this answer
1

If this is a common ethernet network, the first step is to get the MAC-address of the packets to/from the ip-addresses to the other network (for example 10.86.74.7) (the gateway substituted the real MAC-address with its own) and then scan the network for the IP-address with the same MAC-address in the 192.168.193.0/24 network (using nmap or something similar).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .