An apptainer implmentation for ARP poisoning across containers running on Amazon EC2
For this lab you will need to connect multiple times to your virtual machine in order to properly deploy an Apptainer container for both the attacker and victim hosts. To connect to your VM, log as the seed user and edit the hostname of the VM by changing the value of USER to your WFU username (email address without @wfu.edu).
ssh seed@ettercap.USER.cs.ar53.wfu.edu
Once connected ensure that the temporary session directory for Apptainer exists.
mkdir -p /tmp/apptainer/mnt/session
Then you can start the attacking container by excuting the following command:
sudo ./start_attacker.sh
This script is essentially a wrapper script that deploys the Apptainer container with the following options:
apptainer shell --net --network 1234567890 --network-args "portmap=5901:5901/tcp" --hostname seed-container --dns 8.8.8.8 --add-caps NET_RAW,NET_ADMIN ettercap.sif
You should see the following prompt if the container successfully deployed
[Apptainer-Security-Lab] /home/seed $
After deploying the attacking container you should run the following command to improve VNC performance on the victim container after you perform your ARP poison attack:
echo 1 > /proc/sys/net/ipv4/ip_forward
This container is connected to an isolated network within your VM, and each time you deploy a the attacking container it will receive the IP address 10.22.020/24. The default gateway for this VLAN is 10.22.0.1 and you should always see that default gateway IP no matter the number of containers you deploy. After deploying the attacking container, second victim container will have the IP 10.22.0.3.
You can always verify the IP address that was assigned to your container with the command ip a
ip a
IP Info Example:
2: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether ea:65:98:60:38:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 10.22.0.2/24 brd 10.22.0.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::e865:98ff:fe60:38e7/64 scope link
valid_lft forever preferred_lft forever
Once your attacker container is deployed you can deploy your victim container in a new SSH session by excuting the following command:
sudo ./start_victim.sh
This script is essentially a wrapper script that deploys the same Apptainer container with slightly different options:
apptainer shell --net --network 1234567890 --network-args "portmap=5902:5902/tcp" --hostname seed-container --dns 8.8.8.8 ettercap.sif
If you deployed this container after deploying the attacker then it should receive the IP addresss 10.22.0.3 and you should be able to ping the attacker container using the network bridge if you know its IP address.
ping 10.22.0.2
PING output:
PING 10.22.0.2 (10.22.0.2) 56(84) bytes of data.
64 bytes from 10.22.0.2: icmp_seq=1 ttl=64 time=0.095 ms
64 bytes from 10.22.0.2: icmp_seq=2 ttl=64 time=0.055 ms
64 bytes from 10.22.0.2: icmp_seq=3 ttl=64 time=0.051 ms
After deploying your Apptainer container you can then launch a VNC server process from within the container using the following command:
tigervncserver :1 -localhost no -geometry 1920x1080 -depth 24 -xstartup /usr/bin/startxfce4
For the attacker container you should start the VNC server using :1 for the port.
For the victim container you should use :2 for the port.
tigervncserver :2 -localhost no -geometry 1920x1080 -depth 24 -xstartup /usr/bin/startxfce4
To connect to VNC you will need to use an application such as VNC Viewer to connect to your containers host. Each container's VNC port is mapped to the EC2 instance's VNC port and you should be able to connect directly using your VM's FQDN.
Then within VNC Viewer you should be able to connect to ettercap.USER.cs.ar53.wfu.edu:5901 to connect to the VNC server within your attacker container and ettercap.USER.cs.ar53.wfu.edu:5902 to connect to your victim container where USER is your username.
Within your VNC session you can start the Ettercap GUI by opening a terminal and executing the following command:
ettercap -G
NOTE: When performing the APR poison attack on the victim container, ensure Target 1 is the default Gateway 10.22.0.1 and Target 2 is the victim container's IP 10.22.0.3 and ensure both Sniff remote connections and Only poison one-way are checked before performing the attack.
To start Wireshark you can use the Applications menu in the upper left corner of the desktop and select Applications -> Internet -> Wireshark
To open a Google Chrome web browser you can execute the following command in your terminal:
google-chrome --no-sandbox 2> /dev/null
