Gabriel Ryan - The Black Art of Wireless Post Exploitation

### The Reality of Enterprise WPA2-EAP Security At 00:00, wireless security researcher Gabriel Ryan opens his presentation in the Packet Hacking Village by addressing a widespread industry misconception: many network administrators assume that enterprise 802.1X/WPA2-EAP wireless networks are impervious to attack. In reality, Ryan explains, common implementations like EAP-PEAP and EAP-TTLS have been fundamentally broken for years due to client-side certificate validation failures, leaving corporate networks vulnerable to rogue Access Point (Evil Twin) attacks that capture MSCHAPv2 challenge-response hashes.

### The Overlooked Domain of Wireless Post-Exploitation At 08:15 and 15:30, Ryan emphasizes that obtaining wireless network access is only the preliminary phase of a penetration test; the true objective is post-exploitation. Once an attacker associates to an enterprise Wi-Fi network—whether by cracking an employee's MSCHAPv2 hash or associating to a guest/BYOD network—they encounter complex network controls, including dynamic VLAN assignment, network access control (NAC) quarantines, and client-to-client traffic isolation.

### Circumventing Wireless Client Isolation and NAC Controls At 21:40 and 25:47, Ryan demonstrates advanced methodologies for bypassing wireless security boundaries. When access points enforce client isolation (blocking direct peer-to-peer Wi-Fi communication), attackers can route traffic through upstream default gateways or exploit layer-2 broadcast frames that APs forward across the wireless cell. He walks through pivoting techniques via SSH and VPN tunnels established through compromised wireless endpoints, effectively turning a single wireless client into an internal network bridge.

### Weaponizing Man-in-the-Middle Attacks Over Wireless At 33:10 and 42:15, the presentation explores aggressive man-in-the-middle (MitM) tactics executed across wireless segments. Ryan details deploying LLMNR and NetBIOS Name Service (NBT-NS) spoofing using Responder, intercepting broadcast name resolution requests from corporate laptops searching for network shares. He demonstrates capturing plaintext credentials, relaying NTLM authentication to internal SMB servers, and executing WPAD (Web Proxy Auto-Discovery) spoofing to intercept outbound corporate web traffic.

### Hardening Enterprise Wireless Infrastructure Concluding between 47:30 and 51:43, Ryan outlines comprehensive hardening strategies for enterprise network architects. He urges organizations to migrate from password-based EAP-PEAP to certificate-based EAP-TLS, which mandates mutual cryptographic authentication and neutralizes rogue AP attacks. Furthermore, he recommends enforcing strict client isolation at the controller level, disabling multicast and broadcast name resolution protocols (LLMNR/mDNS) via Group Policy, and implementing micro-segmentation between corporate and mobile device subnets.

(AI summary — Gemini 3.8 Flash)