PT0-001 · Question #197
A penetration tester found a network with NAC enabled Which of the following commands can be used to bypass the NAC?
The correct answer is A. macchanger. NAC systems that rely on MAC address authentication can be bypassed by spoofing the MAC address of an authorized device using macchanger.
Question
A penetration tester found a network with NAC enabled Which of the following commands can be used to bypass the NAC?
Options
- Amacchanger
- Bsslbump
- Ciptafcles
- Dproxychains
How the community answered
(25 responses)- A84% (21)
- B4% (1)
- C4% (1)
- D8% (2)
Why each option
NAC systems that rely on MAC address authentication can be bypassed by spoofing the MAC address of an authorized device using macchanger.
Many NAC implementations authenticate endpoints based on their MAC address to control network access. The macchanger tool allows an attacker on Linux to change their network interface MAC address to one belonging to a known-authorized device, causing the NAC system to grant full network access as if the endpoint were a trusted machine.
sslbump is an SSL/TLS traffic interception utility used to inspect encrypted traffic and has no capability to spoof MAC addresses or interact with NAC authentication mechanisms.
iptables is a Linux kernel firewall used to filter and route packets at the network layer and cannot modify a device's hardware address to bypass NAC.
proxychains tunnels TCP connections through a series of proxy servers to obscure traffic origin and does not address the Layer 2 MAC address-based authentication used by NAC.
Concept tested: MAC address spoofing to bypass NAC authentication
Source: https://attack.mitre.org/techniques/T1036/
Topics
Community Discussion
No community discussion yet for this question.