The problem
NetSecure Corp is a fictional 200-employee company with a head office and two branches. Its network was flat (10.0.0.0/16), with switches managed over Telnet using default passwords, no DMZ, no IDS and a weak Wi-Fi key.
The job: prove the risk from captured traffic, chain it into a realistic attack, then redesign and harden the network.
Attack chain reconstructed from the capture
- 01Weak Wi-Fi key
- 02SYN scan
- 03Telnet creds
- 04ARP spoofing
- 05Session hijack
- 06Exfiltration
Findings and fixes
| FINDING | FIX | LEVEL |
|---|---|---|
| Telnet admin credentials in clear text | SSH with keys | CRITICAL |
| ARP spoofing: one MAC claiming 3 IPs | DAI + DHCP snooping | CRITICAL |
| Flat network, total lateral movement | 5 VLANs | CRITICAL |
| Session cookie over plain HTTP | TLS + DMZ | HIGH |
| Port scan went unnoticed | Suricata rules | HIGH |
| No access control on ports | 802.1X + RADIUS | HIGH |
Straight from the code
Excerpts from the actual repository and deliverables, trimmed for length.
table inet filter {
chain forward {
type filter hook forward priority 0;
policy drop;
ct state established,related accept
# admin VLAN: full access
ip saddr 10.10.10.0/24 accept
# employees: internal DNS and file server only
ip saddr 10.10.20.0/24 ip daddr 10.10.30.10 udp dport 53 accept
ip saddr 10.10.20.0/24 ip daddr 10.10.30.20 tcp dport 445 accept
# Internet to DMZ web server
ip daddr 10.10.40.10 tcp dport 443 accept
# guests: Internet only, no internal access
ip saddr 10.10.50.0/24 ip daddr 10.10.0.0/8 drop
ip saddr 10.10.50.0/24 accept
log prefix "FORWARD_DROP: " drop
}
}Default-deny forwarding between VLANs: admins reach everything, employees only DNS and the file server, guests only the Internet.
# telnet
alert tcp any any -> any 23 (msg:"NETSECURE TELNET CONNECTION DETECTED"; sid:1000001; rev:1;)
# port scan: 5 SYN in 10 seconds from the same source
alert tcp any any -> any any (flags:S; msg:"NETSECURE POSSIBLE PORT SCAN"; threshold:type both, track by_src, count 5, seconds 10; sid:1000002; rev:1;)
# session cookie in clear text (session hijacking)
alert tcp any any -> any any (content:"Cookie:"; msg:"NETSECURE SESSION COOKIE OBSERVED"; sid:1000006; rev:1;)Custom Suricata rules written for the threats found in the capture, including a threshold to catch the SYN scan.
Results
What I'd do differently
The capture was only 76 packets, and it was enough to own the whole network. Next: validate DAI and port security on real switch images in a GNS3 lab, not only on paper.