7

Me and a friend of mine are simulating a widespread scenario where router configurations are untouched (default passwords) and are visible from the internet. Him, acting as the victim, will constantly ping out a packet with a specific content (just a string) to a website, and me, as the bad guy, is supposed to sniff out those packets and tell him the string the next time we meet. Having said my purposes, here are my questions:

  1. Is it possible to sniff out a remote network's traffic, provided that I have admin access over the router/modem? (We thought of exploiting the static routing and forwarding all traffic to a remote server, then said server will forward his traffic to his ISP. We also thought of the same thing, but instead of forwarding directly to the ISP, we somehow return the traffic to the router and let it take care of the ISP business)

  2. How feasible is the attack vector we thought of? (We considered the impact on the network bandwidth, but we will ignore this fact for now.) ----Are there existing services that do exactly this? (act as a sort of man-in-the-middle server)

  3. If it is possible, what other attack methods are available out there? How difficult would this be to implement? (consider the above-average, computer literate, logical Joe)

  4. How detectable would those attacks be? (The ones we thought of are clear as daylight; connection would almost grind to a halt on heavy traffic)

I already read this, but I don't think the user has admin access over the network. Mirroring is not allowed, as not all routers have this feature (but ours has this).


Update: A few years later, I realized that anything is possible. I was able to root my own router, gain telnet access, then gain ssh access, and finally run a program as root, using an unsanitized input field (diagnostics -> ping) while using a non-privileged account.

The router involved was a TP-Link Archer C2. It was running some sort of Unix on MIPS. The program used was udp2raw compiled specifically for MIPS.

  • Could you tell us which specific router are we talking about? Since some do not give you access to the traffic from the web or ssh interface. – user69377 Aug 11 '15 at 16:02
  • Just a hint : If you can edit DNS servers and your friend is resolving a domain to send these packets (not entering the IP directly), you can change the default DNS by one you control. – r00t Aug 11 '15 at 16:13
1

Question #3 is much too open ended to answer. For the others, the answer depends on the router model in question and, in function of that, the exact meaning of "admin access".

If the router is a Cisco IOS based device and you have privilege level 15 access you can use the regular packet sniffing commands of IOS which would certainly allow you to achieve your sniffing task. However, no Cisco admin in his or her right mind would make the admin interface accessible from the Internet, let alone with a default password, so the attack is not very feasible in real life. Also, every Cisco admin worth his or her pay would have set up logging to a central syslog server so your login and all the commands you use would be visible in the log.

If it is a regular cheap consumer router and you have access to the web GUI then most models do not offer a packet sniffing function there. A few do, though. (Often on a "hidden" URL but that's no obstacle of course.) Most models are not accessible from the Internet by default, but a few are. So if the router in question is one of the models with a built-in sniffer and accessible from the Internet then yes, the attack would be feasible, and might go undetected since most of these devices do not even support logging to a log server, and even if they do, an owner who doesn't change the default password will not configure logging either. So in this case the attack depends entirely on the specific router model and your knowledge of that.

If it is a Linux based router (either one of the many commercial models using a Linux kernel, or some homebrew device) and you have root access to the Linux kernel then you can of course do anything you wish. Root access with password authentication from the Internet is however definitely unwise, and not the default configuration for any device I've ever seen.

  • Linux based, and I gained access to it's shell (a secret URL). I have access to iptables, but no -tee support. – Gene Dela Rosa Aug 17 '15 at 14:10
  • 1
    You can get a root shell on almost every router from the web interface just by abusing the "firmware update" feature to upload a modified firmware image running an sshd and including all the tools you need (tcpdump, etc). – André Borie Dec 3 '15 at 1:54
  • This is only correct in the mathematical sense of "almost every", ie. "with a finite number of exceptions". :-) – Tilman Schmidt Dec 3 '15 at 9:59
  • To expand: For many existing routers you will not be able to pull off that feat because the firmware update feature won't work over the WAN interface, or because you don't have a firmware image for it that will be accepted by the firmware update procedure and successfully run on the router with sshd and all those tools. – Tilman Schmidt Dec 3 '15 at 10:11
  • @TilmanSchmidt usually either the web interface isn't available over WAN at all, in which case it's a bit more complicated to exploit (you need to use another service listening on the WAN port or trick the user to visit a page exploiting a CSRF in the router's interface to enable WAN access to the web interface), or the web interface is available with (almost always) all its features enabled, including firmware update. – André Borie Dec 10 '15 at 15:23
2

If you can login remotely, then there will be very little that you cannot do. Once you have a root shell, you can easily run tcpdump. You can read the local databases that supply encryption keys elsewhere. If within that shell, you are missing commands; you can write, or simply go find the commands you want. If you do manage to get in, there is probably a lot of bandwidth; and you might go unnoticed for a while as long as things continue to work.

http://www.tomshardware.com/answers/id-2199813/blocking-backdoor-fios-router.html

However, most people will let the ISP setup the router that connects to the ISP; and that's not going to have the default password and let the world in. Verizon uses an enormous UUID for the encryption key (written on a sticker on the modem), etc. There will be misconfigured stuff out there, but it's not like it used to be (with end users going to Best Buy and (mis)configuring it himself).

  • 4
    "and that's not going to have the default password and let the world in." That's not always the case. Here in the Philippines, you can access every router* in the country provided that you know the technician password (which is the same for the 3 biggest ISP's here.). So, if you know the IP address, it's just a matter of knowing the ISP then using one of the three "backdoor" credentials which are not even changeable and are even publicly known! They are burnt in. There is practically no defense here unless you change routers. – Gene Dela Rosa May 13 '15 at 14:23
  • 1
    That's bobo. Most ISPs here learned their lesson, because it costs more to deal with the botnets than it does to just set them up right. – Rob May 13 '15 at 14:25
  • Ikr. Fun fact: The publicly-known credentials give you full root access to the router which actually has higher privileges than the "admin" account. (e.g. Engineer mode, fiddling with memory, ssh/telnet access, direct access to files (They come with a built-in file manager, which is convenient), etc.) – Gene Dela Rosa May 13 '15 at 14:26
  • 1
    Having the password for the web interface doesn't mean he will be able to run commands as tcpdump. Some interfaces permit only restricted network configurations. – user69377 Aug 11 '15 at 16:06
1

Given that we're talking about unencrypted http traffic (if it's encrypted just leave it) push up the server on desired port, push up bogus dns service, that'll be returning your server's IP on every dns request, and change router DHCP parameter "DNS server(s)" on your server's IP.

0

In addition to attempting to sniff packets at the router itself, there are, of course, methods that let you take advantage of the fact that you have some control over the router to enable attacks in other places where you have greater flexibility & ease of sniffing his traffic. Two examples:

  1. If the router has the ability and you have the access, configure the router to forward outbound http traffic to a transparent proxy server that you have set-up, with whatever packet-sniffer you like running on the box or VM alongside it. The "transparent" part means the user on the end-client (ie. him, using his computer) will not be able to detect any changes in his device's network settings, because no such changes will be needed or occur; everything will be done by his router and your proxy. As for whether this would raise suspicions with an end-user by significantly affecting the speed of the connection, I suppose that depends on the performance of your selected proxy server and the latency added by the length of the segment between his router and your server, among other factors. Apache configured as a transparent proxy, running on an AWS instance with suitable specs, might be one fairly straightforward way to set something like this up and get non-lousy proxy performance. Against an ordinary user, the tactic would likely go undetected for quite a while in most cases. Against a tech-savvy person specifically watching for connection latency anomalies... no guarantees.

  2. Change his DNS server settings to point to malicious DNS server you've set up, pointing him when he requests any unencrypted/plain http site to a legitimate-looking error page that contains a malicious element you've attached with Metasploit. If he's non-diligently running an unpatched Java client or Flash version you can drop a reverse https payload on his box, then go in and run a sniffer or share his screen and watch him as he fires off his ping to wherever. :-)

(Note: That second thing was a joke. Going beyond changing the config of the other guy's router to hacking his PC without his further expanded consent would be exceeding the scope of what you have permission to do. Which could/would affect the legality of your actions. Don't go there.)

  • We don't really care about legality. +1 for Metasploit – Gene Dela Rosa Dec 3 '15 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.