1

I'm trying to create a lab environment to experiment with MiTM attacks. I want to learn docker also so I've decided to do this with docker. I created 2 images (attacker, victim):

Victim - based on Alpine, with curl installed
Attacker - based on Ubuntu, with installed iputils-ping iproute2 curl iptables vim ettercap-text-only dsniff and tshark.

They're both in bridged network, so the router here would be docker0 interface (default: 172.17.0.1)
I'm running the attacker container with --privileged flag, to enable using ettercap.

So when both images is running I'm executing ettercap(Tried with arpspoof tool too, same effect.) from attacker container with:
ettercap -T -i eth0 -M arp:remote //victim_ip/ //172.17.0.1/

Victim's traffic is getting through attacker, but there's a problem that when victim is trying to ping google.com there is no response. The MiTM attack is working because I can see this traffic on victim containers but something is blocking it.

I've found out what's the problem here. I opened 2 wiresharks on my host, one on docker0 interface one on my default wifi interface. Before attack, when I'm pinging something from global network, the docker is translating his docker ip address to my host ip address and that's working fine, but after arpspoofing, it doesn't work correctly - host is sending packets with ip source of docker victim container (172.17.0.3). Also, the weird thing is that, another container (attacker) is pinging external network with no problem (docker0 translates docker ip to host ip correctly). Picture from both wiresharks, below.

Picture from both wiresharks

Checked iptables and this rule (selected on the picture below) is translating my docker ip address to host ip address, but after the attack, this rule isn't working (pkts are not incrementing after the arp spoofing attack). I've tried to add some extra iptables rules but with no effect. I'm no iptables master so if someone have other ideas what should also check, give me hint.

enter image description here

Maybe someone could explain to me or give me some extra sources about how exactly docker is translating it's ip address to host ip address on bridge network and what I can do to restore correct translation after arp-spoofing attack. Every advice will be appreciated.

1 Answer 1

0
  • When Docker is installed, a network interface named docker0 is created to connect each container.
  • When Docker creates a container, by default it is given a virtual network interface with a name beginning with veth. Then Docker forwards the traffic of the host network interface to the virtual network interface through iptables rules.
  • If you create the container with command docker run --network=host ..., you will have the container use the host's network interface. At this point, the container's IP address is the same as the host.
1
  • My goal is to make it work in bridge network. In docker host network I can't create this MITM setup that i care about. Each container must have another ip address and they need to be in the same network (or virtual network) for this MITM to work.
    – Kankarollo
    Dec 23, 2020 at 1:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .