[Music] what's going on everyone in this video
i want to show a little bit about mac address filtering and how you go about
bypassing that network access control even in today's world where there's
better solutions like 802.1x where you'd actually need
credentials or a certificate to access a network
people are still using mac addresses to whitelist their devices onto a network
so what i'm going to show you in this video is an example meeting room
a device that you might find in there or a few devices you might find in there
and how to bypass the mac address white listing
so if we walk into my fake meeting room here
what you will typically find on a client site or your attack environment
is an empty desk where a corporate employee would obviously put their
laptop
a place to connect their laptop and this device could either be a switch
it might be an ip phone it could be a printer
or any sort of network device and as an attacker
you want to gain access to the corporate network so obviously
ethernet cables are something you want to be dealing with and plug it into your
laptop to try and get on that network so using your attack laptop
which i've got here we're going to show you how to
bypass mac address filtering so the first thing you want to do
is actually just unplug the ethernet cable
plug it into your laptop and see if you can get corporate access
because there's actually no authentication needed to get on the
network if i do an ipa in cali you'll see that
i do have an ip address and my mac address is this but
if i do a ping the host network is unreachable
so that probably means that even though you have an ip address
you're not gaining connections to the corporate network
so what you need to do is change your mac address
and this is quite simple so on this switch
it literally says the mac address on the switch
and this is quite common even though it sounds quite dumb
so you can take that mac address put it into a program called mac changer
and symbolize being that switch and thus connect to the network
so this could also be an ip phones you can literally go to the settings and
find the mac address and same with the printer go into the
printer settings you know on the actual screen and see the mac address
this is commonly not password protected and a very easy way to bypass mac
address filtering so the first thing you need to do is
take down the eth0 ethernet connection within linux
go to mac changer use sudo mac changer eth0
with the m flag and then the mac address which is the same address we found on
this device
enter that in and you can now see that the old mac which was this has now been
swapped to the new mac which is this so if we try and ping now
we're still not going to get anything that's because we need to do a dh client
to get an ip address again and actually connect
and authenticate to the network so if we do that
and now we ping well actually firstly let's just show you another ipa
you'll see that we've now got an ip address again and the
mac address here has changed to the same mac address that was on this switch
so if i do the ping again to google which symbolizes connecting to the
internet instead of using a corporate network
because i don't actually have a corporate network here
you'll see that i'm now pinging whereas before
i couldn't ping at all and that's totally down to me changing my mac
address
and now being allowed on a corporate network because
my mac address for this laptop has changed to the whitelisted device
that's kind of all i need to show you that's how easy it is to gain access to
a corporate network that uses mac address
whitelisting and that's why you really need to be using
a more what a better method such as 802.1x
anyway guys thanks for watching i hope you learned something
give us a subscribe and a like and shout out to the wife of the filming
[Music]