802.1X NAC bypass via printer MAC spoof

§ Context

Assumed environment: target uses 802.1X for endpoint devices but allows MAC-Auth-Bypass for legacy devices (printers, VoIP phones, IoT). MAC-allowlist is the only verification.

§ Steps

1. 01
   Obtain LAN addressInitial Access

   T1078— Valid Accounts
2. 02
   Physical access to a network dropInitial Access

   T1078— Valid Accounts
3. 03
   Continue chain (LLMNR poison / Kerberoast / etc.)Credential Access

   T1557.001— LLMNR/NBT-NS Poisoning and SMB Relay
4. 04
   Sniff for MAB-eligible devices (printer / VoIP)Reconnaissance

   N-ARP-RECON— ARP Sweep / LAN Discovery
5. 05
   Internal nmap sweepDiscovery

   N-NMAP-INTERNAL— Internal Nmap Sweep
6. 06
   Clone MAC on attacker NICDefense Evasion

   N-NAC-BYPASS-MAC— NAC Bypass via MAC Spoof

§ References

• T1078Valid Accounts
• T1557.001LLMNR/NBT-NS Poisoning and SMB Relay

§ Frequently asked

What is the "802.1X NAC bypass via printer MAC spoof" attack path?

Plug into the LAN, sniff a printer / IP-phone MAC, clone it on your laptop, get full LAN access via MAC-Auth-Bypass — bypass NAC entirely. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Obtain LAN address (T1078) — a initial access primitive. Assumed environment: target uses 802.

What is the final impact of this kill-chain?

The final step lands on Clone MAC on attacker NIC (N-NAC-BYPASS-MAC), which falls under Defense Evasion. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques3

  WPA2-PSK handshake capture + crack → LAN access

  Deauth a connected client to force re-association, capture the 4-way handshake with airodump-ng, crack the PSK offline with hashcat.

• Shared techniques2

  Industroyer2 IEC-104 substation hijack

  Timed payload speaks IEC-60870-5-104 to substation RTUs at attacker-chosen hour; sends 'open breaker' commands across a substation, blackouts a grid section.

• Shared techniques2

  z/OS TN3270 → RACF userID brute → mainframe shell

  Internet-/intranet-exposed TN3270 mainframe terminal. Userids follow predictable HR scheme. Brute-force passwords; many environments allow short / dictionary passwords for legacy reasons.

• Shared techniques2

  Reconfigure MFP LDAP → harvest service-account credentials

  Walk up to / network-into the MFP admin web panel (default creds), change the LDAP address-book server to attacker IP — printer immediately re-binds and sends its service-account creds in cleartext.

• Shared techniques2

  HMI default credentials → operations disruption

  Wonderware / iFix HMI exposed to the corporate network with vendor-default credentials. Operators see attacker-controlled values + commands sent to PLCs through legit channels.

• Shared techniques2

  npm typosquat → developer workstation → corporate VPN

  Publish a typosquat npm package; the developer's `npm install` runs the postinstall script, exfils SSH keys + VPN profile, then connects to the corporate network.