4

I'm currently doing a penetration test for a client, who are using Trustwave NAC to prevent unauthorized physical access to their network.

I would like to know if there are any possible ways to bypass this. Client is putting a lot of faith in their implementation (with good cause so far), but I would like to be able to bypass it if possible to demonstrate, if nothing else that reliance on a single security technology is not a good solution.

Short of trying to DOS the device (I have permission to try this), I'm not sure what could be attempted.

This device does is not simple port security. It uses ARP poisoning to hide the actual gateway, and puts all devices in a quarantine LAN until they are authenticated against an Active Directory server. Spoofing a MAC of someone else in the quarantine LAN will not help, unless I can also trick the NAC device into think I was a device that had previously authenticated against AD.

Looking for known techniques, academic papers, conference presentations etc.

Improve this question
20
  • I have a similar product and I haven't found a way around it. I have been curious to try to 'freeze' my ARP tables so that I am not affected by the ARP poisoning techniques it uses. – schroeder♦ Jul 8 '14 at 2:39
  • Can you see any broadcast trafic on a network port if you don't send a packet? – dan Jul 8 '14 at 5:46
  • I wouldn't start with any form of DOS or cache poisining since these are pretty known and noisy technics. These noisy attacks may be quickly detected and blocked by blacklisting a network port. – dan Jul 8 '14 at 5:49
  • @daniel yes, can see some broadcast traffic. Some arp requests and dhcp traffic, that's it. – Sonny Ordell Jul 8 '14 at 7:42
  • Start collecting it, get the correct map of @MAC → @IP. Start investigation (Wireshark, tcpdump…) by analysing the initial traffic of an @MAC which is the most talkative. Since this software is agentless, everything is played on the wire. Since everything can't be broadcasted, you will have to start stealing valid @MAC when they are off (to avoid easy duplicate detection). – dan Jul 8 '14 at 9:54
1

Based on what you are asking (testing physical access with NAC), I would suggest pwnie express' pwnplug (if you can afford it, I think the powerpwn is even better https://www.pwnieexpress.com/penetration-testing-vulnerability-assessment-products/sensors/pwn-power/).

As to how they are bypassing NAC, here is their explanation:

  • First, the Pwn Plug is placed in-line between an 802.1x-enabled client PC and a wall jack or switch.
  • Using a modified layer 2 bridging module, the Pwn Plug transparently passes the 802.1x EAPOL authentication packets between the client PC and the switch.
  • Once the 802.1x authentication completes, the switch grants connectivity to the network.
  • The first outbound port 80 packet to leave the client PC provides the Pwn Plug with the PC’s MAC/IP address and default gateway.
  • To avoid tripping the switch’s port security, the Pwn Plug then establishes a reverse SSH connection using the MAC and IP address of the already authenticated client PC.
  • Once connected to the plug’s SSH console, you will have access to any internal subnets accessible by the client PC. As an added bonus, connections to other systems within the client PC’s local subnet will actually appear to source from the subnet’s local gateway!

Source: https://www.pwnieexpress.com/support/product-documentation/

Disclaimer: I have never used the NAC bypass functionality of the pwnplug.

Hope that helps!

Improve this answer
1
  • Thank you, but that won't work in this situation. I need to be able to do it form my laptop. Whatever that device is doing, I should be able to replicate. – Sonny Ordell Jul 15 '14 at 1:02
0

Find a printer and spoof its ip and mac.... Start there.. This solution requires everything to be categorized based on function. You can try to impersonate a trusted device.

Improve this answer
2
  • This looks like a good beginning of an answer. Please elaborate: answer on snmp/udp, 515/tcp… – dan Jul 14 '14 at 13:21
  • 1
    That won't work against the Trustwave NAC. it's using arp poisoning and checking for authentication against an AD server before permitting access, it isn't simple port security. – Sonny Ordell Jul 15 '14 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.