VirtualBox examines ARP and DHCP packets in order to learn the IP addresses of virtual machines.Īs a solution I use a wired network adapter. When VirtualBox sees an incoming packet with a destination IP address that belongs to one of the virtual machine adapters it replaces the destination MAC address in the Ethernet header with the VM adapter's MAC address and passes it on. All traffic has to use the MAC address of the host's wireless adapter, and therefore VirtualBox needs to replace the source MAC address in the Ethernet header of an outgoing packet to make sure the reply will be sent to the host interface. Bridged networkingīridging to a wireless interface is done differently from bridging to a wired interface, because most wireless adapters do not support promiscuous mode. This is what VirtualBox does when bridging to a wireless network adapter: From the VirtualBox manual: 6.5. The problem is indeed that for communication with the VM the host's MAC address is used. It seems like Wireshark is also capturing the traffic of the host OS. In Wireshak I can capture some data but I cannot make anything out of it. Maybe there are details about the briding I do not understand?Ģ) What should I change in order to make this attack work.
I think it has something to do with the briding of the virtual network adapter with the build in wifi adapter. It looks like Kali Linux is not receiving any data of interest and also cannot forward the data.Īs a result, the victim laptop loses its internet connection while Kali Linux should forward the ethernet traffic of the victim laptop to the actual destination.ġ) Why does the MAC address in the ARP tabel of the victim laptop becomes the MAC address of the host OS of the attacking laptop, and not the MAC address of the virtual adapter used by Kali Linux? Therefore, the victim laptop start sending information to the wrong MAC address. The new physical address is the MAC address of the host OS of the attacking laptop (so not the MAC address of the virtual adapter that Kali Linux uses)! I use the following commands: echo 1 > /proc/sys/net/ipv4/ip_forwardĪrpspoof -i eth0 -t 192.168.1.63 -r 192.168.1.254Īfter executing the commands above, I can see that the physical address of the 192.168.1.254 (the router) changes in the victim's laptop ARP tabel (using arp -a). In VirtualBox I bridged my build-in wifi adapter to the virtual environment (I have no external USB wifi adapter). To do this is run Kali Linux in a virtual environment using VirtualBox on the attacking laptop. With one laptop (attacking laptop) I try to get in the middle of the connection of other laptop (victim laptop). At home I have two laptops (running on Windows).
0 kommentar(er)
