2

[story] Good Evening Guys, I just got out of a lan house which uses a system named Geto (Geto Lan House Management System 4.0), and I was wondering if it is hackable. [/story]

While searching for possible vulnerabilities, I found out that this system works like a RAT, machines are installed as servers running the software, which connects to the client on lan and receive info such as "unlock" and "lock".

So I was thinking, if the "rat-like system" is configured using a local address, and the main host uses a fixed ip address, can I force a reconnect for everyone on the wired network? If so, I could force my internal address to change and force everyone to reconnect on the same address, but this time I would be the "commander".

[idea] I would connect to the wired local network and search for the possible client (controller) machine, after obtaining the ip address, I would launch a deauth-like attack, forcing everyone to obtain a new ip address, during this time I could force my ip address to be X (Which was the client address before). As soon as it's changed, everyone would be reconnecting to this address, which would be now mine, and I would be running the client on my machine, thus "taking-over" all the machines. [/idea]

So here comes my questions:

1- What are the possible flaws on this?

2- Is there any "deauth-like" attacks for wired connections?

All of this is being done assuming the following:

1- The client (Controller) computer is the only one using a fixed ip address.

2- All other computers (servers) are connecting to the client and they don't use a fixed address.

3- I have a machine of my choice (eg. my computer), with total administrator rights connected to the wired (or wireless, which also exchange ips with wired) network.

Thank you and have a good day. - Fabricio20

Before anyone says I'm asking for a way to hack the lan-house, I'm not, this is just an idea that came to mind while walking home.

1

1- What are the possible flaws on this?

That depends on the exact configuration and security measures of the network because to migrate this you will need to mess around with some protocols. I can imagine some ways to migrate this but every solution relies on some protocol weaknesses and the exploitation of these might be detected by an IDS.

On the other hand it might happen that you can't simply "take over" the controll if ssl is used to verify the identity of both sides.

2- Is there any "deauth-like" attacks for wired connections?

In the way you described it: Yes that can be done by exploiting any protocol weakness that allows a MiTM attack. The only difference is that in this case you don't forward the received information but act as the server that was ment to be reached. In a local network this can be done by one of these attacks for example:

  • Port-Stealing
  • APR-Spoofing
  • DHCP-Rogue-Server (Requires you to be "nearer" at the victim then the real DHCP-Server. Ideally you are connected to the same switch but the DHCP-Server is not.)
  • Thanks for the answer, so essentially this could be "fixed" by using an encrypted connection between the machines and the controller. – Fabricio20 Jan 2 '16 at 22:13
  • It would at least make it very hard to steal the clients identity because this would require the private key of the client. – davidb Jan 2 '16 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.