From Spoofing to Tunneling: New Red Team's Networking Techniques for Initial Access and Evasion

by Shu-Hao, Tung 123ojp

Day 1 · LVCC - L1 - Exhibit Hall West 3 · Track 3 · 45 min · 3 min read

Offensive Security Network & Infrastructure

TL;DR

Shu-Hao Tung demonstrated how IP spoofing, GRE tunneling, and VXLAN hijacking give red teams initial access to intranets. A global scan found 900 VXLAN endpoints responding, exposing 4,000 internal IPs. He also showed how to abuse OSPF to hijack domain controller traffic. Defenses include filtering outbound traffic, disabling unencrypted tunnels, and restricting routing protocol exposure.

IP Spoofing for Initial Access

▶ Watch (3:13)

An attacker with a foothold on one device can spoof the source IP to bypass firewalls. Using H323 NAT pass-through, the attacker sends a special packet to the C2 server. The router creates a temporary destination NAT rule, opening a port to the intranet. In the demo, attacker 142 could not reach the intranet web server. After sending the H323 packet, the router gave a DNAT port. The web log showed a public source IP, not the private one. This breaks the incident response chain.

GRE Tunneling: Discovery and Exploitation

▶ Watch (14:42)

GRE is a stateless, unencrypted layer 3 tunnel. Attackers can scan for GRE peers by sending spoofed GRE packets with different source IPs. If the source matches a configured peer, the victim decapsulates the inner packet and replies with an ICMP response. The scanner encodes the peer IP into the ICMP ID and sequence fields. In the demo, the attacker created a fake GRE tunnel to the victim router and directly accessed the intranet web server at 192.168.1.2. The scanner script is on GitHub.

VXLAN Hijacking: The Nightmare Default

▶ Watch (24:15)

VXLAN is an unencrypted layer 2 tunnel. The Linux kernel has a learning feature enabled by default. It accepts VXLAN packets from any source IP as long as the VNI and port match. An attacker can send a broadcast NDP packet inside a VXLAN frame. The victim adds the attacker’s IP to its forwarding database and replies. A global scan found 900 VXLAN endpoints responding, revealing 4,000 internal IPs. With the victim IP, port, and VNI, the attacker can hijack the tunnel and access the intranet.

Routing Protocol Abuse

▶ Watch (34:39)

VXLAN tunnels often run routing protocols like OSPF or BGP. After hijacking a VXLAN tunnel, an attacker can inject a more specific route for the domain controller’s IP. Other routers redirect traffic to the attacker. If SMB signing is disabled or ADCS vulnerabilities exist, the attacker can take over the domain. OSPF hello packets on the intranet can also be exploited. If a hello packet is seen, the attacker can establish an OSPF adjacency and hijack routes directly.

Notable Quotes

we found like more than 900 VXL endpoint respond to the scanner Shu-Hao, Tung 123ojp · ▶ 31:59

this is a feature but not a bug Shu-Hao, Tung 123ojp · ▶ 25:46

the source IP in the log will not be the previous compromise machine Shu-Hao, Tung 123ojp · ▶ 7:46

if you see a hello package, there is a highly possible that you can direct establish an OPF connection with the router and hijack the routes Shu-Hao, Tung 123ojp · ▶ 37:53

Key Takeaways

Check all unencrypted tunnels (GRE, IP SIT, GR tap, VXLAN) and replace them with encrypted alternatives.
Use source IP spoofing during high-risk scanning to avoid detection and break the incident response chain.
After gaining initial access, abuse routing protocols like OSPF for lateral movement and privilege escalation.

About the Speaker(s)

Shu-Hao, Tung (123ojp) is a Threat Researcher at Trend Micro specializing in Red Teaming. He focuses on web, networking, and infrastructure vulnerabilities. He owns an ASN and has reported high-risk vulnerabilities via Bugcrowd.

Filed under

Offensive Security Network & Infrastructure