nerdexam
CompTIA

PT0-001 · Question #197

A penetration tester found a network with NAC enabled Which of the following commands can be used to bypass the NAC?

The correct answer is A. macchanger. NAC systems that rely on MAC address authentication can be bypassed by spoofing the MAC address of an authorized device using macchanger.

Attacks and exploits

Question

A penetration tester found a network with NAC enabled Which of the following commands can be used to bypass the NAC?

Options

  • Amacchanger
  • Bsslbump
  • Ciptafcles
  • Dproxychains

How the community answered

(25 responses)
  • A
    84% (21)
  • B
    4% (1)
  • C
    4% (1)
  • D
    8% (2)

Why each option

NAC systems that rely on MAC address authentication can be bypassed by spoofing the MAC address of an authorized device using macchanger.

AmacchangerCorrect

Many NAC implementations authenticate endpoints based on their MAC address to control network access. The macchanger tool allows an attacker on Linux to change their network interface MAC address to one belonging to a known-authorized device, causing the NAC system to grant full network access as if the endpoint were a trusted machine.

Bsslbump

sslbump is an SSL/TLS traffic interception utility used to inspect encrypted traffic and has no capability to spoof MAC addresses or interact with NAC authentication mechanisms.

Ciptafcles

iptables is a Linux kernel firewall used to filter and route packets at the network layer and cannot modify a device's hardware address to bypass NAC.

Dproxychains

proxychains tunnels TCP connections through a series of proxy servers to obscure traffic origin and does not address the Layer 2 MAC address-based authentication used by NAC.

Concept tested: MAC address spoofing to bypass NAC authentication

Source: https://attack.mitre.org/techniques/T1036/

Topics

#NAC bypass#MAC spoofing#macchanger#network access control

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice