802.1x and Beyond!

on YouTube ↗32m

" summary

Demonstrates a practical attack chain against 802.1x/EAP and RADIUS: builds Peach-based Peach fuzzer models and custom publishers to fuzz EAP inside TLS, creates tooling (EP.NET, modified freeradius.net, radius E profile and eenum.exe), and finds multiple handler crashes. One flaw in Cisco ACS 4.2 leads to remote code execution over WPA‑Enterprise before client authorization; exploit reliably crashes and can be turned into RCE, vendor issues fixes after disclosure.

AI-written summary · about

" chapters (25)

1. 0:00Intro
2. 0:21Who is Brad
3. 1:17Agenda
4. 1:54What is 802
5. 5:24Playing around with 802
6. 9:16EEP
7. 10:48Decapsulation
8. 11:07Radius
9. 12:13Attack Surfaces
10. 14:20Known Attacks
11. 16:12Free Radius WPE
12. 16:40Hostapd
13. 18:27No Exploits
14. 19:01Peach Fuzzer
15. 19:43How it works
16. 20:51RFCs
17. 22:06Other publishers
18. 23:32Free stuff
19. 24:34Tools
20. 25:55Profile
21. 26:36Enumeration
22. 26:59WP supplicant
23. 27:29Notes for researchers
24. 28:07Redirect program flow
25. 28:49Exploit

" related talks

• 33mWi-Fi BrokeringMichael Kruger · Black Hat Asia 2020
• 37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-DaysBen Seri, Barak Hadad · Black Hat Asia 2020
• 39mDiving into Windows Remote Access Service for Pre-Auth BugsYuki Chen · Black Hat USA 2023
• 27mWIFI-Important Remote Attack Surface: Threat is ExpandingYe Zhang, Haikuo Xie, Ying Wan · Black Hat Asia 2020
• 46mInfiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNsOrange Tsai, Meh Chang · Black Hat USA 2019
• 29mLike Lightning From the Cloud: Finding RCEs in an Embedded TLS LibraryNiels Buchmann, Thomas Kemmer · Black Hat Asia 2022
• 45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol FuzzingAntti Levomäki, Olli-Pekka Niemi · Black Hat Europe 2017
• 44mManna from Heaven: Improving the State of Wireless Rogue AP AttacksDaniel Cuthbert · Black Hat Asia 2015