Network Access Control, or NAC,
is used to protect our network
from both known and unknown devices.
Network Access Control is a technology
that's used to keep unauthorized users
or devices from accessing a private network.
With NAC, a device is scanned
to determine its current state
prior to being allowed access to the network.
NAC can be used for computers within our internal network
that are physically located inside of our buildings
or even applied to devices
that are remotely connected
into our network through a VPN.
Now in its most basic form,
NAC might only check for something
like a MAC address of the network card
to determine if your device is allowed
to connect to that network.
To bypass this type of NAC,
it's really easy because you can
just change your MAC address using MAC's spoofing.
Newer forms of NAC, though, are much more complex.
In these systems, when a device
attempts to connect to the network,
it's placed into a virtual holding area
while it's being scanned.
That device can be checked
for a number of different factors,
including if any virus definitions are up to date,
the status of its security patching,
and other items that might introduce
a security threat into the network.
If the device passes this examination,
it's then allowed to enter and receive access
to all the resources provided by that network.
If the device fails the inspection, though,
it's going to be placed into
a digital quarantine and remediation area.
While it's in this area,
that device can receive antivirus updates,
operating system patches and other security services,
but it cannot logically communicate
with the other portions of the network.
Just like a bad child,
the device has been placed into timeout
until it can be rehabilitated
and meet the requirements of the initial NAC examination.
Once it successfully meets the NAC requirements,
it's moved into the network
and receives full access to those network resources.
Now, there are three different types
of network access control systems
that you might run into.
These are persistent, non-persistent, and volatile agents.
Persistent agents are pieces of software
that are installed on the device
that's requesting access to the network.
This works well in corporate environments
because the organization owns all of the devices
and controls their software baseline.
A non-persistent agent solution
is quite popular on college campuses.
These solutions require the user
to connect to the network, usually over Wi-Fi,
and then log into a web-based portal and click on a link.
This link then downloads an agent
that scans the device for compliance
and then deletes itself from the user's machine
once it finishes with the scan.
Agentless NAC solutions, on the other hand,
install the scanning engine on the domain controller
instead of on the endpoint device.
This works well when the organization uses
a bring-your-own-device policy
or doesn't have access to the endpoint devices
to install the agent-based NAC solution.
Agent-based NAC solutions can usually provide us
with a deeper examination of a device,
but agentless solutions are getting better
and more in-depth all the time.
Agentless solutions are also called volatile solutions
because they completely run
in the volatile RAM of that device
once the scan begins from the active directory controller.
So, how can you bypass these more complex
network access control solutions?
Well, you really have two options:
one, you can exploit an authorized host,
or two, you can make your device look like something else.
Now, the first option is to exploit an authorized host
and then use that to access the network
and bypass the NAC appliance.
For example, if a victim's corporate laptop
has already been approved and authorized to use the network,
even if that NAC solution relies
on digital certificates with 802.1X authentication,
you're still going to be able to get past that NAC device.
Why? Well, it's because this authorized device
is well, authorized!
And since you've hacked into that device,
you can now use it as a pivot point
to send your traffic through this authorized device
and into the rest of the network
while bypassing the NAC appliance and its inspection.
The second option is for you
to spoof your attacking workstation
and make it appear as if it's something else;
something like a voiceover IP handset, for example,
that isn't subject to NAC inspection.
Now, many NAC appliances have an allowed list of devices,
usually based on their MAC addresses,
and these things are allowed
to connect without being inspected.
Most commonly, you're going to find
things like VoIP handsets,
VTC terminals, and printers included on this list
because they don't have a native operating system,
like Windows or Linux, that can support NAC inspection.
Since these devices are often considered
accepted devices, though,
if you can trick the NAC appliance
into thinking you are one of these devices,
you can bypass the NAC inspection completely.
The only real downside of this strategy
is that most networks are designed
to segment out these VoIP devices and printers
into their own separate VLANs
since they can't be inspected or trusted
by the NAC appliance.
So, while you may end up bypassing the NAC device
by pretending to be a VoIP handset,
you may then find yourself in an isolated VLAN
that you're now going to have
to use VLAN hopping to escape from.