Whig Posted January 27, 2010 Share Posted January 27, 2010 Any idea how to "hack" port-security thing on procurve switch? It will disable port and send alert if you connect device with new unknown mac-address to port. Only way what comes to my mind is change your device mac-address to same as that device which is on that port already and then it should not disable that port... haven't tested it yet but... More about port-security example here: http://www.hiddenone.net/hp-procurve/local-port-security/ Quote Link to comment Share on other sites More sharing options...
Sparda Posted January 27, 2010 Share Posted January 27, 2010 Seems like you already found the solution to your problem. Quote Link to comment Share on other sites More sharing options...
Whig Posted January 28, 2010 Author Share Posted January 28, 2010 Seems like you already found the solution to your problem. Well... I was just interested does anybody know any other ways to do that. Quote Link to comment Share on other sites More sharing options...
3vi1john Posted August 8, 2011 Share Posted August 8, 2011 If you are able to find the r/w SNMP string of the switch via brute force, you could probably send an SNMP SET command to the switch instructing it to turn of port security. You would probably have to do an snmpwalk and read the docs to find this data. If you steal the mac address of an already connected device you need to get traffic sent before it or it will ignore you. <!--quoteo(post=151905:date=Wed, 27 Jan 2010 15:33:11 +0000:name=Sparda)--><div class='quotetop'>QUOTE (Sparda @ Wed, 27 Jan 2010 15:33:11 +0000) <a href="index.php?act=findpost&pid=151905"><{POST_SNAPBACK}></a></div><div class='quotemain'><!--quotec-->Seems like you already found the solution to your problem.<!--QuoteEnd--></div><!--QuoteEEnd--> Well... I was just interested does anybody know any other ways to do that. Quote Link to comment Share on other sites More sharing options...
digip Posted August 9, 2011 Share Posted August 9, 2011 If you are able to find the r/w SNMP string of the switch via brute force, you could probably send an SNMP SET command to the switch instructing it to turn of port security. You would probably have to do an snmpwalk and read the docs to find this data. If you steal the mac address of an already connected device you need to get traffic sent before it or it will ignore you. Thats if the device allows updating over SNMP, which I don't think it works that way. More than likely you would have to be signed into the device and turn off the sticky bits setting for the specific port or such. Not sure how thats maintained on a pro curve switch, but in cisco its "no switchport port-security" or if you want, you can make it so it allows more than one device, or adding your mac to the list, but generally, SNMP traps just get set off when their is a violation, I don't think they allow you to update anything over SNMP itself or that would be a huge attack vector. Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted August 9, 2011 Share Posted August 9, 2011 (edited) Thats if the device allows updating over SNMP, which I don't think it works that way. More than likely you would have to be signed into the device and turn off the sticky bits setting for the specific port or such. Not sure how thats maintained on a pro curve switch, but in cisco its "no switchport port-security" or if you want, you can make it so it allows more than one device, or adding your mac to the list, but generally, SNMP traps just get set off when their is a violation, I don't think they allow you to update anything over SNMP itself or that would be a huge attack vector. That would be done via the web admin interface, but some series of the HP ProCurve Switches will allow remote administration via a terminal just like Cisco switches. Edited August 9, 2011 by Infiltrator Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.