2

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown capabilities as well) that is used to bounce rogue devices off the network. So far we have the following:

SIEM, Detection capabilties, Metasploit, OpenVAS, Rifleman

Rifleman gets interesting....this is essentially a session hijacker- BUT it needs to capture sessions before the handshake is completed. Meaning if the session is in DNS cache or currently talking we are out of luck.

Im looking for a way to "crash" a non-domain PC (but still on the network) so that when the session is restored on the network we can hijack common ports and route them where we want. I say "crash" but less violent options would be preffered as some of these devices are just unknown vendor DVRs/PCs/equipment that have slipped through our inventory processes. I have looked into LOIC but not sure of the capabilities against a single target....and dont really have the resources to build a botnet to point and shoot. I should also mention that just shutting down the wall jack port doesnt solve the problem as they can just opt to plug in elsewhere...especially if they are up to no good...and that causes the business to spend money each time for a ticket to open and and a ticket to close.

I know metasploit has vast capabilties, but there is a massive learning curve that I just dont have the time for. I was wondering if there was any other way or suggestions of things to look into. In order to not effect the business this needs to be very targetable to one IP/PC. Any thoughts on dealing with rogue network devices other than MAC filtering and shutting network ports down?

Thanks!

  • 1
    Are you asking us to break a system for you? because that would be out of scope for this website. – LvB Mar 14 '16 at 12:10
  • No, not break a system. Im curious to get any community expertise with the above mentioned tools, or other tools that can be used for rogue containment/erradication. This is not a blackhatted question...the devices are rogue on my network. – Charles Mar 14 '16 at 12:49
  • is physical access to the machine out of the question? I would try that first ;) – LvB Mar 14 '16 at 12:51
  • Unfortunatley yes. Only a small portion are located on site. Most of the infrastructure is splatted around the country at random. – Charles Mar 14 '16 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.