New Red Team's Networking Techniques for Initial Access and Evasion

Overview: Su-Hao Tzeng presents novel red teaming methodologies targeting stateless tunneling protocols and misconfigured routing infrastructure for initial access, defense evasion, and lateral movement. Through deep network-layer analysis, Tzeng demonstrates how intranet IP spoofing can fracture incident response investigation trails and bypass boundary firewalls. He details automated exploitation workflows against Generic Routing Encapsulation (GRE), Virtual Extensible LAN (VXLAN), and Open Shortest Path First (OSPF) routing protocols, ultimately showing how unauthenticated network manipulations escalate to Active Directory domain compromise.

Key Topics: - Intranet source IP spoofing to blind incident responders and disrupt forensic attribution - Bypassing NAT and firewalls via H.323 NAT pass-through and TCP SYN spoofing - Discovering and exploiting stateless, unencrypted GRE tunnels using ICMP reflection - VXLAN forwarding database (FDB) MAC learning abuse and OSPF /32 host route injection for domain compromise

Technical Details: Tzeng demonstrates how an operator with a foothold on an internal host can execute lateral movement while spoofing arbitrary public source IP addresses (such as 99.9.99.99). If edge firewalls lack reverse path filtering on internal segments, response traffic from internal targets routes directly out to the attacker's public command-and-control server. Forensic analysts inspecting target logs observe attacks originating from external public IPs rather than the internal pivot machine, concealing the compromised host. To bypass stateful NAT firewalls without static port forwarding, Tzeng weaponizes H.323 Application Layer Gateway (ALG) helper modules—sending crafted H.323 packets to trick routers into creating temporary inbound destination NAT mappings—or spoofs TCP SYN packets matching internal target IPs to coerce the NAT table into establishing inbound session pinholes.

Turning to tunneling protocols, Tzeng details how unencrypted tunnels expose perimeter networks to unauthorized ingress. For GRE tunnels, he built a scanner script that sends GRE packets with spoofed source IPs matching external router interfaces, embedding target IP ranges within inner ICMP identifier and sequence fields. When a packet matches a valid configured GRE peer, the edge router decapsulates it and returns an ICMP Echo Reply, allowing the attacker to identify valid peer IPs and inject unauthenticated traffic into the corporate intranet. Similarly, Tzeng targets VXLAN overlays (UDP ports 4789 and 8472). In Linux and MikroTik RouterOS environments, VXLAN interfaces enable dynamic MAC learning by default; incoming frames cause the kernel's Forwarding Database (FDB) to bind the sender's MAC to the source IP. By sending broadcast MAC packets or inner Neighbor Discovery Protocol (NDP) requests, an attacker poisons the FDB, causing the router to forward intranet broadcast and unicast traffic to the attacker's endpoint. After attaching to the L2 overlay, the attacker listens for OSPF Hello packets, forms an adjacency with internal routers, and injects /32 host routes for critical assets like Domain Controllers. Because /32 routes take precedence via longest prefix matching, Domain Controller traffic is diverted through the attacker, enabling NTLM relay attacks and full domain compromise.

Key Takeaways: Defenders must deprecate unencrypted tunneling protocols (GRE, IPIP, SIT, VXLAN) across untrusted network boundaries and mandate IPsec or WireGuard encapsulation. System administrators must disable dynamic MAC learning (learning=off) on Linux and RouterOS VXLAN interfaces. Network teams must deploy strict egress filtering, BCP 38 / Unicast Reverse Path Forwarding (uRPF) to block spoofed IP packets, and disable stateful NAT helpers like H.323. Finally, enterprise routing protocols like OSPF must be secured using cryptographic authentication (HMAC-SHA), restricted via passive-interface default, and configured to reject unauthorized /32 host route advertisements.

(AI summary — Gemini Flash)