LO Level Shells

The talk presents a post-compromise technique for running a remote shell over raw Ethernet frames instead of TCP/IP. The premise is that layer 3 and above are closely watched while layer 2 often is not, so commands can ride inside frame payloads. The attacker sends commands as frames, the compromised host decodes them and passes them to a local listener over loopback, and the output returns the same way.

The demonstration used a Windows victim and a Debian operator, with a chosen Ethertype to blend into ordinary traffic. An endpoint EDR flagged netcat on the host but not the frame-based tool. After an administrator locked the machine and cut the RDP session, the frame-based shell still responded. Limits discussed include frames being dropped at routers, so reach is mostly confined to a broadcast domain unless an attacker pivots through multi-homed hosts or bridges. Admin rights, plus Python and C available on the host, were listed as requirements.

For defenders, the speakers said layer 2 detection needs sensors fed by span ports and baselining of frame sizes, entropy and expected Ethertypes, since unusual Ethertypes stand out while IPv4, ARP and IPv6 traffic is much harder to separate from normal activity. Correlating endpoint loopback traffic with network data was suggested as a useful signal. The main takeaway is that layer 2 is a blind spot that needs explicit monitoring.