Random Tech/Science Thought and Chatter

[Sight Unseen]

Installed xubuntu 11.04 on a flash drive, booted it on a school computer. I was bored, so I ran an openvas audit of the network. I found the nortel router (48port gigabit router/switch combo daisy chained to 8 other 48 port switches using a 8Gb infiniband trunk) running the school, and it had 23,22, and some other ports. Seeing 23 is telnet, I found the default gateway ip using ifconfig, and looked up the default password for that router, which is "admin" "config". Telnet, and wtf the router let me have a session. I turned on it's web configuration page, and used that to set it up to forward traffic from my computer's port directly to the fiber uplink phy. I set up two virtual network interfaces on my box, eth0:0 as 10.1.27.1, as to appear to the vpn server as the school's router, and eth0:1 as 10.0.0.1. I set up the router to use 10.0.0.1 as it's uplink, so the traffic flow is as follows:
1. Fiber to switch bypass to copper port 42.
2. To the desktop eth0:0, set up forwarding between eth0:0 and eth0:1 using iptables with no rules.
3. Out eth0:1 and back to router.
4. Set the router/switch to go back to it's default settings after 20 minutes using a cron job that deletes itself.

The net effect places my computer between the windows domain controllers, the internet, and basically everything else which is on a vpn. Once all set up, i hit apply and watched as my cpu utilization and nic utilization pegged at 100%.

Opened wireshark, now watching the traffic and DNS queries of 600 pc's, and if i was evil i could connect to any machine's vnc, samba serve, redirect people to questionable websites if i so chose, etc.

All in all, a great way to pass half a class period in the computer lab.

Moral of the story: not all students are technically inept, and anyone with skills is much less likely to be as nice as I am about returning everything to defaults or not pulling out personal or financial data. (yes, financedb transfers that in plaintext, Mr. B.) Protect your networks. It's a complete fail that I was able to set this up at all, let alone in 10 minutes on a school-provided pc, on a network of this size.