This is a guest post from Jed Kafetz.
After seeing
Christopher’s post I
decided to create a proof using GNS3 and Virtualbox.
The aim is to perform the exact attacking using Antonios Atlasis’
Chiron tools and run a Wireshark packet
capture to prove the hop limit drops below 255.
The following topology is used in GNS3:
The
routers used are Cisco C372 and the machine labled Ubuntu is running 14.04 LTS
Ubuntu Desktop, default installation. F0/0 is on the right and F0/1 is on the
left.
The following configs are extracts from the routers using ‘show run’:
highlighted are relevant commands
R1
ipv6 router rip rp
!
no ip domain lookup
ipv6 unicast-routing
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
ipv6 address 2212::/64 eui-64
ipv6 rip rp enable
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
ipv6 address 2211:1::/64 eui-64
ipv6 rip rp enable
R2
no ip domain lookup
ipv6 unicast-routing
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
ipv6 address 2213::/64 eui-64
ipv6 rip rp2 enable
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
ipv6 address 2216::/64 eui-64
ipv6 rip rp2 enable
!
no cdp log mismatch duplex
ipv6 router rip rp2
R3
ipv6 unicast-routing
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
ipv6 address 2217::/64 eui-64
ipv6 rip rp3 enable
!
ipv6 router rip rp3
The command run on the Ubuntu machine was:
./chiron_local_link.py eth0 -neighadv -d 2217::c003:52ff:fe6d:0
The packet capture was placed at f0/0 on R3 and the following packet was captured (full pcap can be found here):
The screen shot clearly displays the IPv6 source address is on the 2211:1:/64 network and the destination is on the 2217::/64 network, and the Hop limit is 253 which obviously violates the RFCs referenced in Christopher’s post.
As a result of this (some) NDP attacks that were possible on the link-local network are possible across the Internet.
If you have any comments please leave a comment or contact me on Twitter.
Thanks,
Jed Kafetz