IP Spoofing as a Lateral Movement Evasion Tool

▶ Watch (02:54)

Standard lateral movement leaves a log trail: the IR team traces the attacker’s IP hop by hop through each compromised machine. Source IP spoofing breaks that chain. Once inside the network with one compromised device, an attacker sends packets toward the next target using an arbitrary public address as the source. The victim server’s logs show 9.9.9.9 attacking the domain controller, not the actual pivot box.

The IR team bans the public IP, the attacker switches to another, and movement continues. Finding the real device requires checking layer 2 port logs on every switch, something almost no IR team does during an active incident.

NAT Traversal Techniques for Initial Access

▶ Watch (08:31)

H.323 NAT passthrough gives an attacker intranet access without a compromised internal host. The attacker sends a crafted H.323 packet; the victim router creates a temporary destination NAT entry mapping an internal port to a public IP. Tung showed the H.323 NAT passthrough demo (09:07): the web server logged the source as a public IP, creating a gap in the attack chain.

A second method spoofs a TCP SYN using the next target’s IP as source and sends it to the attacker’s C2. The router’s SNAT maps that connection back to the internal service.

GRE Tunnel Scanning and Hijacking

▶ Watch (13:05)

GRE is a stateless layer 3 tunnel with no encryption and no source IP check. Cloudflare Magic Transit and AWS Transit Gateway both run it. Salt Typhoon used GRE to collect traffic from compromised devices. Any host can craft a GRE packet claiming any source IP.

Tung built the GRE spoof scanner (15:42) to find valid peers: ICMP identifier and sequence fields encode all IPv4 space, so sweep responses reveal confirmed peer addresses. Once a peer IP is known, forging a GRE packet from that address drops traffic directly into the target intranet.

VXLAN Hijacking via Learning Mode

▶ Watch (21:28)

Linux VXLAN’s learning mode, on by default, accepts packets from any source IP with a valid VNI and port. An attacker sends a VXLAN packet with the broadcast MAC address; the kernel adds the attacker’s IP to the forwarding database. Every broadcast the router sends on the VXLAN interface then goes to the attacker.

“after looking at the Linux memo, you will see that this is a feature and not a bug” — Shu-Hao Tung

Tung’s VXLAN scanner demo (27:12) found the target running VNI 42 on port 4472 by brute-forcing default ports and VNIs under 100. A global scan using VNI 1 returned more than 900 responsive endpoints.

Routing Protocol Abuse for IP Hijacking and Domain Compromise

▶ Watch (30:55)

Tunnel access becomes domain compromise when routing protocols are running inside. VXLAN tunnels often carry BGP or OSPF between sites. After hijacking the tunnel and spoofing a connected router’s IP, an attacker announces the domain controller’s address as a /32. Other routers accept the more-specific route and redirect all domain controller traffic to the attacker.

Tung confirmed this during an actual red team engagement with OSPF. Visible hello packets let an attacker join the adjacency and inject any route. With ADCS ESC8 or NTLMv2 relay available, redirecting the domain controller’s IP is enough for full domain takeover.

Notable Quotes

J is dead and doesn’t provide encryption which means it is possible Shu-Hao Tung · ▶ 14:22

after looking at the Linux memo, you will see that this is a feature and not a bug Shu-Hao Tung · ▶ 22:56

more than 900 VXLAN endpoint response Shu-Hao Tung · ▶ 28:31

Key Takeaways

  • Unencrypted GRE and VXLAN tunnels exposed to the internet are entry points; audit and remove them.
  • VXLAN learning mode is on by default in Linux; an attacker needs only the victim IP, port, and VNI to hijack the tunnel.
  • OSPF or BGP running inside a hijacked tunnel lets an attacker inject /32 routes and redirect domain controller traffic.