Follow us:

  • Google play
  • Pheniix bootique

©2020 Pheniix All Rights Reserved – Privacy Policy- Terms of Service , TRADEMARK LEGAL NOTICE

Hack the protocol! (This chapter: RIPv1)

 

And Yet Another Weekend Post! (YAWP)


What is RIP?
Is it really Rested In Peace already ??!!!

 

RIP (Routing Information Protocol) is one of the oldest IGP (Interrior Gateway Protocol) and uses Hop-Count as its metric. It comes in fact in two different flavours: 1 and 2.
Version 1 is a distance vector protocol (RFC 1058) and Version 2 is a hybrid protocol (RFCs 1721 and 1722)
.

Routing Information Protocol Version 1 (RIPv1) RIPv1 uses local broadcasts to share routing information in a really dummy manner 😝

These updates are periodic and occurring, by default every 30 seconds.
To prevent packets from circling around a loop forever, both versions of RIP solve counting to infinity by placing a hop count limit of 15 hops on packets. Any packet that reaches the sixteenth hop will be killed.
RIPv1 is a Classfull protocol. RIP supports up to six equal-cost paths to a single destination. Equal-Cost load balancing will take place re for  paths where the metric is same (Hop count).
Routing Information Protocol (RIPv2) is a distance vector routing protocol with some great updates and featues built into it, and it is based on RIPV1.
Therefore, it is commonly called as hybrid routing protocol.RIPv2 uses multicasts instead of broadcasts. RIPv2 supports triggered updates. when a change occurs, a RIPv2 router will immediately propagate its routing information to its connected neighbours. RIPv2 is a classless protocol and it supports variable-length subnet masking (VLSM). Both RIPv1 and RIPv2 uses hop count as the metric.

 

 

Differences between RIPv1 and RIPv2

 

 

 


Like in our CEH-Lab we also build this one in GNS3 and link it to a Virtual Box machine running Kali. Our objective is to build a network with three routers all using RIP for routing information exchange. We will then use the Attacker-box to inject a fake route into the network in this way divert traffic away from its real target.

 

If you are not familiar with RIP it is hop based system where each hop is a router in the path and traffic is routed across the shortest number of hops.

 

This is the topology I built:

 

 

 

I added an NM-4E module to each of the devices, this wasn't required technically but it gives four extra Ethernet interfaces that may come in handy later.

 

The following table shows the configuration of each router:

 

 

 

SW1 and SW2 are standard GNS3-image switches, I tried to use a 3660 with a switch module installed to give more flexibility in the future but for some reason this didn't work properly so stuck with the generic GNS3 one. C3 isn't really necessary but was useful just for  connectivity verification reasons.

 

Here is the configuration on each router up to this point for the sake of illustration:

 

 

 

 

Once you have set up routers, you can verify that RIP is running correctly by using the

 

show ip route

 

As the help text explains, an R in the left-hand column means the device learned the route through RIP. Assuming you have the correct routes you can check connectivity by pinging other devices.

 

 

 

If everything works as expected, then the next step to do is to setup the virtual PCs and the VirtualBox machine.

To get out of our Subnet and see the world you need to to add a default gateway. You do this in the second parameter to the ip command. The gateway IP is the IP of the machine which connects the Subnet to the rest of the network so for C1 this is 192.168.0.1 and for C2 192.168.1.1.

 

Once you have set the IP of both machines you can check connectivity with some pings.

 

 

 

If your pings are not working , the best way to debug is to go back to the routers and check each of them can ping correctly, check R1 can talk to both IPs on R2, that R2 and can talk to R3 then R1 to R3. Check the routing table on each to make sure it knows where to send the traffic. If all that works then check C1 can talk to each of the routers. Break it all down and the mistakes tend to be a lot easier to find. This is where C3 can be useful to check that the mistake isn't with C1.

For the VirtualBox machine I'm using the same machine as in the VLAN lab. In here I set the IP and default route and again test connectivity.

 

 

 

The Attack

 

After setting up all of this now it's finally show-time! The plan is to hijack traffic from C1 heading to C2 and have it delivered to the VBox instead. This will be done by injecting a new route into the network by generating our own RIP packets. We will need to send a packet advertising a route to the 192.168.1.0/24 subnet with a lower metric (number of hops) than the real router. Verifying the router table on R1 shows the metric to get to 192.168.1.0/24 is 2 so we will have to advertise our route with a lower number (metric of 1) to be successful.

 

I was initially thinking of using some kind of attack tool or creating custom packets in Scapy but while researching this project I came across Quagga, which is a linux routing software suite and implements a router in software. As this is specifically designed to talk the various routing protocols, including RIP, I figured it would be much better to use this than an "attack" tool.

 

Quagga is pretty simple to set up and can be installed on VBox with:

 

apt-get install quagga

 

The config files are stored in /etc/quagga and all we need to edit are the following two files:

 

daemons

 

ripd=yes

 

 

ripd.conf

 

hostname restinpeace

password pheniix

router rip

network eth0

version 1

route 192.168.1.0/24

 

 

This simply tells the router that it is talking RIP on eth0 and advertising the route to 192.168.1.0/24.

 

As we are planning to hijack traffic heading to C2 I also add a virtual interface to eth0 with the IP address of C2 which allows us to act as C2 once the traffic arrives. If all you want to do is to sniff traffic then you can create a dummy interface on the machine and give that the appropriate IP. I found that if I didn't have an interface on the machine with an IP in the right network then things didn't work as well as with it. This may just have been the way I was doing things but as setting up the interface is easy either way it is worth doing.

 

 

To create the virtual interface you can do:

 

ifconfig eth0.1 192.168.1.100 up

 

Type this command to create a dummy interface:

 

modprobe dummy ifconfig dummy0 192.168.1.100 up

 

Before starting Quagga lets start up Wireshark so we can see the packets we are creating and make sure they look right. To do this in GNS3 right click on the link between R1 and SW1 and select "Start capturing", in the capture list on the right hand side, right click on the capture and select "Start Wireshark". Add a RIP filter in Wireshark and put it to one side.

Now that everything is in place we can start Quagga.

 

/etc/init.d/quagga start

 

Switch back to Wireshark and, if everything is setup correctly, you will start to see RIP packets coming from 192.168.0.101 advertising it's ability to route to 192.168.1.0 with a metric of 1.