Bypassing NAC v2.0 - OSSIR

DHCP In-A-BoxRogue DHCP Server• The first DHCP server’s reply to reach a host sending a DHCPrequest would assign the DHCP server responding to be usedby the element– Assign the element a “quarantined” IP address– Direct DNS traffic to the rogue DHCP Server by assigning the DNSserver’s IP address with the DHCP reply to the rogue DHCP server– Present the user with a look-a-like authentication page (usingHTTPS, preferred)– Abuse the credentials collected• For example, wait for the disconnection of the element andabuse its credentials• Etc.