0

I just started my job as a penetration tester. Me and my mentor got to the client's office and our first order of business was to bypass the NAC system.

Searching for a printer or other similar devices was our first priority, so eventually, the network guy just gave us the MAC address of the printer to save us some time and we started spoofing our MAC using the printer's whitelisted MAC address.

Once I spoofed the MAC, it was not possible to ping us from other devices because we didn't have an IP address so the guy also gave us the IP address that was set for the printer.

The guy was surprised to see that we got a connection since his NAC was supposed to filter the vendor ID but for some reason, the NAC recognized us as a printer.

I have 3 questions (I won't have the ability to come back to the client anymore):

  1. Did we have to input a specific IP address once we spoofed the MAC address or any IP address would've done the job?

  2. If I had to spoof my vendor ID in order to get access, what is the most recommended procedure for doing that? (if possible)

  3. What if the printer didn't have any built-in interface to check it's MAC address (the one in the client's office did have a screen and a user interface on it), how would I have gotten the MAC address of the printer?

Improve this question

1 Answer 1

Reset to default
0

  1. This depends on the switch configuration. It's clear that DHCP was not configured (since you didn't get a lease automatically), but that doesn't mean you couldn't have used a different IP address. Worth testing.

  2. Depending on your vendor, MAC authentication can be pretty limited. In some cases, the vendor looks at the MAC address and compares it to MAC leases owned by specific vendors. Some go further and watch the traffic being generated by the device to ensure that it's only following protocols associated with printing. I'm not trying to avoid the question, but am pointing out that MAC authentication is really weak. A good defensive network will have printers on a separate network or leveraging 802.1x where available.

  3. I cannot think of a corporate printer I've used that didn't have the MAC Address listed within the network settings. This is pretty standard. However, you can also inspect the paneling for a hardware address as some manufacturers can print it on a label.

Improve this answer

You must log in to answer this question.