실습> ICMP Redirect 활성화/비활성화 테스트
공격자는 ICMP Redirect 공격을 시도한다.
Attacker# ./icmpRedirect.sh
HPING 192.168.108.105 (eth0 192.168.108.105): icmp mode set, 28 headers + 0 data bytes
ICMP Redirect를 비활성화 하고 Victim을 재부팅한다.
-- icmpRedirectOff.reg --
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"EnableICMPRedirect"=dword:00000000
-- icmpRedirectOff.reg --
라우팅 테이블을 확인한다.
C:\>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 0e 30 1e ...... AMD PCNET Family PCI Ethernet Adapter - 패킷 스
케줄러 미니 포트
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.108.2 192.168.108.105 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.108.0 255.255.255.0 192.168.108.105 192.168.108.105 10
192.168.108.105 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.108.255 255.255.255.255 192.168.108.105 192.168.108.105 10
224.0.0.0 240.0.0.0 192.168.108.105 192.168.108.105 10
255.255.255.255 255.255.255.255 192.168.108.105 192.168.108.105 1
Default Gateway: 192.168.108.2
===========================================================================
Persistent Routes:
None
ICMP Redirect를 비활성화 하고 Victim을 재부팅한다.
-- icmpRedirectOn.reg --
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"EnableICMPRedirect"=dword:00000001
-- icmpRedirectOn.reg --
C:\>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 0e 30 1e ...... AMD PCNET Family PCI Ethernet Adapter - 패킷 스
케줄러 미니 포트
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.108.2 192.168.108.105 10
8.8.8.8 255.255.255.255 192.168.108.102 192.168.108.105 1 <--
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.108.0 255.255.255.0 192.168.108.105 192.168.108.105 10
192.168.108.105 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.108.255 255.255.255.255 192.168.108.105 192.168.108.105 10
224.0.0.0 240.0.0.0 192.168.108.105 192.168.108.105 10
255.255.255.255 255.255.255.255 192.168.108.105 192.168.108.105 1
Default Gateway: 192.168.108.2
===========================================================================
Persistent Routes:
None
'Linux > 모의해킹' 카테고리의 다른 글
| LAND Attack (0) | 2022.01.11 |
|---|---|
| Ping Of Death (0) | 2022.01.11 |
| ICMP Redirect 공격하기 (0) | 2022.01.11 |
| ARP 정적 변경하기 (0) | 2022.01.11 |
| Victim2 의 IP 주소와 MAC 주소의 정책을 우회하기 (0) | 2022.01.08 |