Networks. Практическая работа №5

# Networks. Практическая работа №5 ## 5.0 Настройка среды Топология ![](https://i.imgur.com/GEQ3pfR.png) План адресации такой - Router - e0/1 192.168.225.254/24, e0/0 10.0.0.1/24, e0/0.1 10.0.1.1/24, e0/0.10 10.0.10.1/24, e0/0.20 10.0.20.1/24 GW 192.168.225.1 - Kali-Linux e0 10.0.1.225/24 GW 10.0.1.1 - Win7 e0 10.0.10.225 GW 10.0.10.1 - Debian e0 10.0.2n0.225/24 GW 10.0.20.1 Настроим роутер ```bash= enable configure terminal hostname Router interface e0/1 ip address 192.168.225.254 255.255.255.0 no shutdown do write interface e0/0 ip address 10.0.0.1 255.255.255.0 no shutdown do write interface e0/0.1 encapsulation dot1q 1 ip address 10.0.1.1 255.255.255.0 do write interface e0/0.10 encapsulation dot1q 10 ip address 10.0.10.1 255.255.255.0 do write interface e0/0.20 encapsulation dot1q 20 ip address 10.0.20.1 255.255.255.0 do write exit ip route 0.0.0.0 0.0.0.0 192.168.225.1 ip route 10.0.0.0 255.255.255.0 10.0.1.254 do write access-list 99 permit 10.0.0.0 0.0.255.255 ip nat inside source list 99 interface e0/1 overload interface e0/1 ip nat outside interface e0/0 ip nat inside interface e0/0.1 ip nat inside interface e0/0.10 ip nat inside interface e0/0.20 ip nat inside do write ``` Результат ![](https://i.imgur.com/iwHV5IW.png) Настроим DHCP на Router. Будем выдавать три пула ```bash= enable configure terminal ip dhcp excluded-address 10.0.1.1 ip dhcp excluded-address 10.0.10.1 ip dhcp excluded-address 10.0.20.1 ip dhcp excluded-address 10.0.1.254 ip dhcp excluded-address 10.0.10.254 ip dhcp excluded-address 10.0.20.254 ip dhcp excluded-address 10.0.1.225 ip dhcp excluded-address 10.0.10.225 ip dhcp excluded-address 10.0.20.225 ip dhcp pool POOL-VLAN1 network 10.0.1.0 255.255.255.0 default-router 10.0.1.1 dns-server 8.8.8.8 domain-name pt.local do write ip dhcp pool POOL-VLAN10 network 10.0.10.0 255.255.255.0 default-router 10.0.10.1 dns-server 8.8.8.8 domain-name pt.local do write ip dhcp pool POOL-VLAN20 network 10.0.20.0 255.255.255.0 default-router 10.0.20.1 dns-server 8.8.8.8 domain-name pt.local do write exit ``` Результат ![](https://i.imgur.com/gm5U8GR.png) Настроим Switch ```bash= enable configure terminal hostname Switch interface e0/1 switchport mode access switchport access vlan 1 do write interface e0/2 switchport mode access switchport access vlan 10 do write interface e0/3 switchport mode access switchport access vlan 20 do write interface e0/0 switchport trunk encapsulation dot1q switchport mode trunk do write ``` Результат ![](https://i.imgur.com/c4wwTsS.png) Проверим выдачу DHCP ![](https://i.imgur.com/pBO4llH.png) Выход в Internet ![](https://i.imgur.com/4OJUpQG.png) ## 5.1 Атака на DHCP. Starvation Установим yersinia ```bash= apt update apt install yersinia -y ``` Проверим состояние DHCP сервера до атаки ![](https://i.imgur.com/XoM3zbL.png) Запустим атаку Запустим yersinia ```bash= yersinia -G ``` ![](https://i.imgur.com/VeSTSz0.png) ![](https://i.imgur.com/T9WKVlf.png) ![](https://i.imgur.com/kQmEbxU.png) Состояние после атаки ![](https://i.imgur.com/4zIkKTd.png) Rogue DHCP Server ![](https://i.imgur.com/e5SmCax.png) ![](https://i.imgur.com/alxh1Bt.png) ![](https://i.imgur.com/9LasJDj.png) На Switch настроим защиту от Rogue DHCP Server и от DHCP starvation ```bash= ip dhcp snooping ip dhcp snooping vlan 1 ip dhcp snooping vlan 10 ip dhcp snooping vlan 20 do write interface e0/0 ip dhcp snooping trust do write interface range e0/1-3 ip dhcp snooping limit rate 10 switchport mode access switchport port-security switchport port-security maximum 1 switchport port-security violation restrict do write exit ``` Результат ![](https://i.imgur.com/h0CanDw.png) ## 5.2 Атака VLAN hopping. Сначала проверим что мы ходим через роутер ![](https://i.imgur.com/6A1MBYb.png) Запустим yersinia ```bash= yersinia -G ``` ![](https://i.imgur.com/LL6rGet.png) ![](https://i.imgur.com/lVXX3vy.png) ![](https://i.imgur.com/ErJr77u.png) ```bash= modprobe 8021q vconfig add eth0 20 ifconfig eth0.20 up ``` ![](https://i.imgur.com/i9b4W86.png) ![](https://i.imgur.com/Y1x1o1S.png) Настроим защиту ```bash= enable configure terminal interface range e0/1-3 switchport mode access switchport nonegotiate do write interface e0/0 switchport trunk native vlan 99 do write ``` Результат ![](https://i.imgur.com/WWZ2Yu4.png) ## 5.3 Атака CAM-table overflow. Установим dsniff ```bash= apt update apt install dsniff -y ``` Запустим ```bash= macof ``` Результат ![](https://i.imgur.com/Wj2z1Ir.png) Защита от CAM-table overflow это Port Security. Данная мера реализована в рамках 5.1 ```bash= enable configure terminal interface range e0/1-3 switchport mode access switchport port-security switchport port-security maximum 1 switchport port-security violation restrict do write ``` Результат ![](https://i.imgur.com/AzH1pCg.png) ## 5.4 Атака MAC-spoofing. ifconfig eth0 down macchanger -m 50:00:00:04:00:00 eth0 ifconfig eth0 up macchanger -s eth0 ![](https://i.imgur.com/rddjady.png) Защита от атаки MAC-spoofing это Port Security. Данную меру реализовали в 5.1. ```bash= enable configure terminal interface range e0/1-3 switchport mode access switchport port-security switchport port-security maximum 1 switchport port-security violation restrict do write ``` Результат ![](https://i.imgur.com/SbVivkI.png) ## 5.5 Настройка ACL. Сконфигурируем расширенный ACL и применим его на интерфейсе роутера. ```bash= enable configure terminal #Kali access-list 100 deny tcp host 10.0.1.225 host 10.0.20.225 eq 80 #Win7 access-list 100 deny ip 10.0.10.225 0.0.0.0 10.0.20.0 0.0.0.255 access-list 100 deny ip 10.0.10.225 0.0.0.0 10.0.10.0 0.0.0.255 access-list 100 deny ip 10.0.10.225 0.0.0.0 192.168.225.0 0.0.0.255 #Debian access-list 100 deny ip 10.0.20.225 0.0.0.0 10.0.1.0 0.0.0.255 access-list 100 deny ip 10.0.20.225 0.0.0.0 10.0.10.0 0.0.0.255 access-list 100 deny ip 10.0.20.225 0.0.0.0 10.0.20.0 0.0.0.255 access-list 100 deny ip 10.0.10.225 0.0.0.0 192.168.225.0 0.0.0.255 #Other access-list 100 permit ip 10.0.0.0 0.0.255.255 any #Default access-list 100 deny ip any any do write ``` Результат ![](https://i.imgur.com/jx7kqSV.png) Применение ACL на интерфейсе: ```bash= enable configure terminal interface e0/0 ip access-group 100 in do write ``` Результат ![](https://i.imgur.com/DipM3tq.png) На этом данная работа закончена

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.