I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown capabilities as well) that is used to bounce rogue devices off the network. So far we have the following:
SIEM, Detection capabilties, Metasploit, OpenVAS, Rifleman
Rifleman gets interesting....this is essentially a session hijacker- BUT it needs to capture sessions before the handshake is completed. Meaning if the session is in DNS cache or currently talking we are out of luck.
Im looking for a way to "crash" a non-domain PC (but still on the network) so that when the session is restored on the network we can hijack common ports and route them where we want. I say "crash" but less violent options would be preffered as some of these devices are just unknown vendor DVRs/PCs/equipment that have slipped through our inventory processes. I have looked into LOIC but not sure of the capabilities against a single target....and dont really have the resources to build a botnet to point and shoot. I should also mention that just shutting down the wall jack port doesnt solve the problem as they can just opt to plug in elsewhere...especially if they are up to no good...and that causes the business to spend money each time for a ticket to open and and a ticket to close.
I know metasploit has vast capabilties, but there is a massive learning curve that I just dont have the time for. I was wondering if there was any other way or suggestions of things to look into. In order to not effect the business this needs to be very targetable to one IP/PC. Any thoughts on dealing with rogue network devices other than MAC filtering and shutting network ports down?