DHCP Server intranet attack test

Original address: http://www.freebuf.com/articles/network/74995.html

Usually intranet infiltration is based on ARP attacks, but ARP attacks on the internal network burden is too heavy, it is easy to be discovered. Today's talk is based on a DHCP protocol attack.

DHCP-based attacks are simple to understand, first forge the MAC address depletion of the normal DHCP server IP address, and then hackers with their own host to forge a DHCP server, then the new network host can only use the rogue DHCP server assigned IP, so the hacker's host becomes an intranet gateway , you can control the network traffic of other hosts in the intranet.

Attack environment

Operating system: Kali Linux

Gateway: 192.168.177.1

IP Address: 192.168.177.128

Network segment: 192.168.177.1/24

0x01 to turn on the operating system's route forwarding

echo "1" >/proc/sys/net/IPv4/ip_forward   

0x02 attacks a normal DHCP server, consumes light IP resources

Dhcpstarv -i eth0 -e 192.168.  177.128      

Kali default is not installed Dhcpstarv, you can also use Yersinia instead

0x03 Installing the DHCP server UDHCPD

# Apt-get Install UDHCPD

Then modify the configuration file

# Vim /etc/udhcpd.  conf      

0x04 Start the DHCP server

Service UDHCPD Start

Then start another Kali machine as the target target drone, because the normal DHCP server has no assignable IP resources, the new intranet host will use the IP assigned by the attacker's DHCP server

0x05 Grab the image of the target target drone on the attacking host to open driftnet

# driftnet-i Eth0

In the target target drone open Baidu pictures

The image can be seen on the attacker's server

0x06 Session Hijacking

Turn on Wireshark crawl the packet that flows through the local network card, because the other machine is walking the network card of the attacker's host, which means that Wireshark can crawl other hosts ' packets

Use Ferret to explain

# Ferret-r Demo.pcap

A file named Hamster.txt is generated locally

Then run Harmter, which will open port 1234 on the host

Configure Firefox Agent

Hijacking success

* Author/s1riu5, reprint please indicate from Freebuf hack with geek (freebuf.com)

DHCP Server intranet attack test