TryHackMe Man in the Middle Detection

Overview

My View: Lab is well designed and informative; I loved it while solving the challenge.

	Follow @anir0y

Task 01: Introduction

Learning Objectives

This room focuses on the following learning objectives:

Understand common MITM attack vectors and techniques
Learn to identify indicators of compromise related to MITM attacks
Master network monitoring tools for detecting suspicious traffic patterns
Practice incident response procedures for MITM scenarios

Task 02: Lab Connection

Scenario

A routine network monitoring alert at Acme Corp revealed unusual traffic patterns suggesting a possible Man-in-the-Middle (MITM) attack inside the corporate LAN. Over several days, an attacker quietly intercepted communications, redirected connections, and captured user credentials. In this room, you’ll step into the role of a SOC Analyst investigating this incident. Using the provided packet capture and logs, you’ll uncover evidence of three chained MITM techniques.

ARP Spoofing (network interception).
DNS Spoofing (redirection).
SSL Stripping (credential capture).

Important Note

Important Note: To accomplish this room, we will be relying on the network traffic provided in the mitm folder on the Desktop. However, there are other ways to also examine and complete the room.

A complete log file named mitm_attack.log, containing the entire attack chain, is placed in the same folder. Same logs are ingested into Splunk, which can be accessed at MACHINE_IP:8000, and the logs are ingested into index=network_logs.

Task 03: MITM Attack: An Overview

A Man-in-the-Middle (MITM) attack is a cyberattack where an attacker secretly intercepts and potentially alters communication between two parties, such as a user and a service, without their knowledge. The attacker may eavesdrop to steal sensitive data like credentials and credit card info or inject malicious content. These attacks can target any organization or individual, especially where encryption or authentication is weak.

How MITM Attacks Work

MITM attacks generally involve two main steps:

Interception: The attacker inserts themselves into a communication stream, often by exploiting weaknesses in network protocols or by using techniques like ARP, DNS, or IP spoofing.
Manipulation/Decryption: The attacker tries to access or modify the communication, decrypting encoded data or injecting harmful content, such as altered website responses or fake login forms

Common Types of MITM Attacks

Packet sniffing: Capturing unencrypted data packets exchanged over a network, often on open Wi-Fi.
Session hijacking: Stealing and using session tokens to impersonate users.
SSL stripping: Downgrading HTTPS connections to insecure HTTP to steal or alter data transferred.
DNS spoofing: Redirecting legitimate website traffic to fraudulent domains by manipulating DNS responses.
IP spoofing: Crafting malicious IP packets that appear to come from trusted systems.
Rogue Wi-Fi access point: Creating fake networks to intercept user traffic.

MITM and Cyber Kill Chain

To effectively analyze and respond to security events, an analyst must contextualize alerts within a broader model of adversary operations. Isolated indicators gain significance when mapped to the attacker’s Tactics, Techniques, and Procedures (TTPs). A widely adopted model for this is the Cyber Kill Chain, a framework that sequences the typical stages of an advanced cyber intrusion.

The framework consists of seven distinct phases:

Reconnaissance: The adversary gathers intelligence on the target to identify vulnerabilities.
Weaponization: The adversary couples an exploit with a malicious payload into a deliverable package.
Delivery: The adversary transmits the weaponized package to the targeted environment.
Exploitation: The adversary’s code is triggered, and it takes advantage of a software, hardware, or human vulnerability to gain initial access.
Installation: The adversary installs malware or establishes a persistent backdoor on the compromised asset.
Command & Control (C2): The adversary establishes a covert channel to communicate with and control the compromised asset.
Actions on Objectives: The adversary executes their ultimate goals, such as data exfiltration, destruction, or lateral movement.

Situating MITM within the Cyber Kill Chain

Man-in-the-Middle is a versatile technique that adversaries primarily leverage during the Exploitation and Installation phases.

As an Exploitation Technique: A MITM attack exploits the inherent trust and design limitations of core network protocols like ARP and DNS. By manipulating these protocols, an attacker can intercept a communication channel. This act of session interception is a form of exploitation, as it violates the integrity of the network and provides the adversary with their initial foothold for eavesdropping or active manipulation.
As an Installation Vector: Once an attacker has successfully established a MITM position, they control the data stream and can use it as a delivery mechanism for malicious payloads. For example, an attacker can inject a browser exploit, a malware dropper, or a remote access trojan (RAT) into legitimate, unencrypted downloads. This action corresponds to the Installation phase, where the adversary establishes persistence or deploys additional malicious tools onto the victim’s system. Detecting an MITM attack is a critical finding. It signifies that an adversary is actively engaged in the middle stages of an intrusion, presenting a crucial opportunity for the SOC to intervene and disrupt the attack chain before the final objectives are achieved.

Task 04: Detecting ARP Spoofing

ARP Protocol

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses in a local network. When a device wants to send data to another IP, it first asks: “Who has this IP?” The correct device replies with its MAC address.

ARP Spoofing

In ARP spoofing, an attacker sends fake ARP replies to trick devices into associating the attacker’s MAC address with a legitimate IP, usually the default gateway. This allows the attacker to intercept, modify, or redirect traffic.

Why ARP Spoofing Works

ARP has no authentication. Any device can send unsolicited is-at messages. An attacker exploits this vulnerability by sending fake ARP replies to victims and gateways:

192.16.10.100 is at 02:fe:BB:cd :55:55 attacker claims to be the gateway.

Results:

The Victim’s ARP cache becomes poisoned.
All traffic intended for the gateway flows through the attacker first (MITM).

Indicators of the Attack

We can look for the following key indicators while investigating the logs or network traffic for a potential Man-in-the-Middle attack using ARP spoofing.

Duplicate MAC-to-IP Mappings: Multiple MAC addresses claiming the same IP address. Indicates impersonation.
Unsolicited ARP Replies: High number of ARP replies without matching requests (“gratuitous ARP”).
Abnormal ARP Traffic Volume: A Large number of ARP packets in short intervals.
Unusual Traffic Routing: Traffic rerouted through the attacker’s MAC.
Gateway Redirection Patterns: Multiple destination MACs for the same gateway IP.
ARP Probe / Reply Loops: Many ARP requests with Who has 192.168.1.x? Tell 192.168.1.y patterns

Network Information

For the case investigated, we have the following information about the network:

Role	IP	MAC	Notes
Gateway	192.168.10.1	-	Legit router
Attacker	-	-	-
Victim	-	-	-
Domain	corp-login.acme-corp.local	-

Network Traffic Analysis

Let’s begin our investigation by examining the ARP traffic and seeing how we can identify and detect ARP spoofing in the network traffic. Open up the network-traffic.pcap placed at the mitm_traffic folder on the Desktop, and follow the steps mentioned below:

Narrowing down ARP traffic

As the ARP is the protocol of interest, we can start by isolating it using the following filter. This will allow us to inspect requests/replies and notice abnormal volume or patterns.

Filter: arp

You’ll see requests and replies (who-has and is-at) pointing to both ARP requests and responses. We can examine the results for any abnormal and repeated requests or responses.

Important Note: Press CTRL + ALT + 1 to fix the time displayed

ARP Requests

Let’s look at the ARP requests, as shown below.

Filter: arp.opcode == 1

This shows all the ARP requests captured from different hosts.

ARP Response

Forged ARP poisoning typically uses unsolicited is-at replies (gratuitous/unasked replies). These are strong indicators. Let’s look at the ARP response, as shown below:

Filter: arp.opcode == 2

This filter displays ARP responses from various hosts. Examining these closely reveals multiple responses, including gratuitous ones. Legitimate replies typically correspond to recent “who-has” requests. Suspicious activity is indicated by numerous replies with no visible requests or repeated advertisements of the same IP address from a suspicious MAC address.

Gratuitous ARP Responses

A suspicious host sends many unsolicited (gratuitous) ARP replies, especially to multiple destinations. Repeated gratuitous ARPs can indicate an attacker maintaining their poison state. We can also filter on the gratuitous packets, as shown below:

Filter: arp.isgratuitous

ARP traffic associated with the Gateway

We have the information about the IP and the MAC address associated with the gateway. Let’s apply the following filter to examine the ARP traffic associated with the gateway, as shown below:

Filter: arp && arp.src.proto_ipv4 == 192.168.10.1 && eth.src == 02:aa:bb:cc:00:01

Looking at the output, we can see only the ARP responses. Let’s now narrow down on the Gateway IP to further probe about the MAC addresses associated with the IP, using the following filter as shown below:

Filter: arp.opcode == 2 && arp.src.proto_ipv4 == 192.168.10.1

This output looks interesting. Looking closely, we see some ARP replies pointing the Gateway’s IP to the suspicious MAC address. The frequency of these ARP replies indicates that this is indeed an ARP spoofing. Let’s confirm by applying another filter, as shown below:

Filter: arp.opcode == 2 && _ws.col.info contains "192.168.10.1 is at"

This filter has two parts. The first part focuses on the ARP responses and the second part _ws.col.info contains "192.168.10.1 is at" filters on the content shown in the information column. This filters out the ARP responses, which are pointing the Gateway’s IP 192.168.10.1 to the MAC address. But if we look closely, we can see that the attacker uses ARP spoofing to tell the IP to its MAC address. We can also use this filter arp.opcode == 2 && arp.src.proto_ipv4 == 192.168.10.1, which shows the same result.

Examining the suspicious MAC address

Now that we have identified ARP spoofing in action, let’s narrow down on the attacker’s MAC address that has associated itself with the Gateway’s IP address, using the following filter:

Filter: arp.opcode == 2 && arp.src.proto_ipv4 == 192.168.10.1 && eth.src == 02:fe[REDACTED]

Check for Duplicate IP-to-MAC Mappings

The last thing we can check and confirm is by filtering on the Check for duplicate MAC address mappings to a single IP address.

Filter: arp.duplicate-address-detected || arp.duplicate-address-frame

This result indicates that the attacker successfully performed ARP spoofing and positioned himself between the victim and the gateway. Let’s move on to the next task and examine how the attacker could perform a DNS spoofing attack to get the redirection.

Answer the questions below

How many ARP packets from the gateway MAC Address were observed?

arp && arp.src.proto_ipv4 == 192.168.10.1 && eth.src == 02:aa:bb:cc:00:01

Answer: 10 packets captured in the filtered view.

What MAC address was used by the attacker to impersonate the gateway?

arp.duplicate-address-detected || arp.duplicate-address-frame

Answer: 02:fe:fe:fe:55:55.

How many Gratuitous ARP replies were observed for 192.168.10.1?

arp.isgratuitous && arp.src.proto_ipv4 == 192.168.10.1

Answer: 2 gratuitous replies.

How many unique MAC addresses claimed the same IP (192.168.10.1)?

arp.opcode==2 && _ws.col.info contains “192.168.10.1 is at”

Answer: 2 MAC addresses (the legitimate gateway and the impersonating attacker).

How many ARP spoofing packets were observed in total from the attacker?

arp.opcode == 2 && arp.src.proto_ipv4 == 192.168.10.1 && eth.src == 02:fe:fe:fe:55:55

Answer: 14 spoofed responses originated from the attacker.

Task 05: Unmasking DNS Spoofing

DNS Protocol Simplified

First, let’s understand DNS. Think of it as your phone’s contact list. You don’t remember your friends’ phone numbers; you tap on their names. Similarly, DNS translates human-friendly website names (like www.google.com) into computer-friendly IP addresses.

DNS Spoofing (or DNS Cache Poisoning) is when an attacker corrupts this system. They give your computer the wrong “phone number” for a website you’re trying to visit.

This is a powerful technique for launching a Man-in-the-Middle (MITM) attack. Here’s how it works:

The Victim tries to visit their bank at my-real-bank.com.
The Attacker, who is already on the local network (perhaps via ARP spoofing), intercepts the victim’s DNS query.
The Spoof: The attacker quickly sends a fake DNS response to the victim. This fake response says, my-real-bank.com is at my IP address: ATTACKER_IP.
The Interception: The victim’s computer trusts this fake response and saves it in its DNS cache. When the victim tries to connect to their bank, they unknowingly connect directly to the attacker’s server, which might host a perfect replica of the real banking site. The attacker is now in the middle, capturing everything the victim types, including their username and password.