{"id":3040,"date":"2021-05-02T10:26:02","date_gmt":"2021-05-02T08:26:02","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=3040"},"modified":"2023-12-24T12:43:47","modified_gmt":"2023-12-24T11:43:47","slug":"vlan-attacks","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=3040","title":{"rendered":"<span class=\"caps\">VLAN<\/span> attacks"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Def\u00adi\u00adn\u00adi\u00adtions:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A trunk con\u00adnec\u00adtion is a con\u00adnec\u00adtion between two switches.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Tools<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/tomac\/yersinia\"><strong>Yersinia<\/strong><\/a> is a lay\u00ader 2 mod\u00adi\u00adfi\u00adca\u00adtion framework.<\/li><li><strong><a href=\"https:\/\/github.com\/iknowjason\/voiphopper\">VoIPHop\u00adper<\/a><\/strong> is a sim\u00adple tool which can sniff VoIP traf\u00adfic and out\u00adput the <span class=\"caps\">VLAN<\/span> <span class=\"caps\">ID<\/span> from the VoIP net\u00adwork:<br><code>voiphopper -c 0 -i eth0<\/code><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Enumerate existing VLANs<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>Start Yersinia<br><code>yersinia -I<\/code><\/li><li>Press g<\/li><li>Select <span class=\"caps\">DTP<\/span><\/li><li>Press 5 to see the status<\/li><li>Press g<\/li><li>Select 802.<span class=\"caps\">1Q<\/span><\/li><li>The list will update with the detect\u00aded <span class=\"caps\">VLAN<\/span>&nbsp;IDs.<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Create <span class=\"caps\">VLAN<\/span> interface<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to com\u00admu\u00adni\u00adcate with\u00adin a <span class=\"caps\">VLAN<\/span>, con\u00adfig\u00adure your net\u00adwork inter\u00adface as follows:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><code>modprobe 8021q<\/code><\/li><li><code>vconfig add eth0 100<\/code><\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">A new eth\u00ader\u00adnet device was cre\u00adat\u00aded with <span class=\"caps\">VLAN<\/span> id 100 which can be con\u00adfig\u00adured nor\u00admal\u00adly. For exam\u00adple, request a <span class=\"caps\">IP<\/span> address with<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><code>dhclient eth0.100<\/code><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">You can now use the <span class=\"caps\">IP<\/span> address nor\u00admal\u00adly. All traf\u00adfic through this inter\u00adface will use the <span class=\"caps\">VLAN<\/span> <span class=\"caps\">ID<\/span> you set. To remove it,&nbsp;use<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><code>vconfig rem eth0.100<\/code><\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Notes<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Check if there are VoIP VLANs and try them first. Often, e.g. in Cis\u00adco net\u00adworks, VoIP VLANs are open so that each VoIP device can con\u00adnect to the net\u00adwork directly.<ol><li>Start Wireshark\/tcpdump<\/li><li>Fil\u00adter for the <span class=\"caps\">CDP<\/span> Cis\u00adco Dis\u00adcov\u00adery Protocol<\/li><li>Look into the <code>VoIP VLAN Reply<\/code> field, which con\u00adtains the <span class=\"caps\">VLAN<\/span> <span class=\"caps\">ID<\/span> for the VoIP network.<\/li><\/ol><\/li><li>There are only 4096 <span class=\"caps\">VLAN<\/span> IDs pos\u00adsi\u00adble. There\u00adfore, you could also brute-force the <span class=\"caps\">VLAN<\/span> <span class=\"caps\">ID<\/span> by cre\u00adat\u00ading eth0.<span class=\"caps\">XXXX<\/span> in a loop, request\u00ading an <span class=\"caps\">IP<\/span> or set\u00adting one and then try to ping\/connect to your tar\u00adget which should be reach\u00adable with\u00adin the tar\u00adget <span class=\"caps\">VLAN<\/span> you want access to.<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Def\u00adi\u00adn\u00adi\u00adtions: A trunk con\u00adnec\u00adtion is a con\u00adnec\u00adtion between two switch\u00ades. Tools Yersinia is a lay\u00ader 2 mod\u00adi\u00adfi\u00adca\u00adtion frame\u00adwork. VoIPHop\u00adper is a sim\u00adple tool which can sniff VoIP traf\u00adfic and out\u00adput the <span class=\"caps\">VLAN<\/span> <span class=\"caps\">ID<\/span> from the VoIP net\u00adwork:voiphopper \u2011c 0 \u2011i eth0 Enu\u00admer\u00adate exist\u00ading VLANs Start Yersini\u00aday\u00adersinia \u2011I Press g Select <span class=\"caps\">DTP<\/span> Press 5 to&nbsp;see&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[468],"tags":[387],"class_list":["post-3040","post","type-post","status-publish","format-standard","hentry","category-general","tag-vlan"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3040"}],"version-history":[{"count":8,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3040\/revisions"}],"predecessor-version":[{"id":3055,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3040\/revisions\/3055"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}