Rogue DHCP server Intranet attack test

Rogue DHCP server Intranet attack test

Intranet penetration is usually Based on ARP attacks, but ARP attacks are too costly to the Intranet and are easy to detect. Today we are talking about DHCP-based attacks.

DHCP-based attacks are easy to understand. First, hackers use their own hosts to forge a DHCP server by forging a Mac address and exhausting the IP addresses of normal DHCP servers, the newly connected Intranet host can only use the IP address allocated by the rogue DHCP server, so that the hacker's host becomes an intranet gateway, which can control the network traffic of other hosts in the intranet.

Attack Environment
Operating System: Kali linux
Gateway: 192.168.177.1
IP Address: 192.168.177.128
Network Segment: 192.168.177.1/24

0 × 01 enable route forwarding for the operating system
Echo "1">/proc/sys/net/ipv4/ip_forward

0 × 02 attack the normal dhcp server and consume ip Resources
Dhcpstarv-I eth0-e 192.168.177.128

By default, dhcpstarv is not installed in Kali. You can also use yersinia instead.
0 × 03 install dhcp server udhcpd
# Apt-get install udhcpd
Modify the configuration file.
# Vim/etc/udhcpd. conf


0 × 04 start the DHCP server
Service udhcpd start

Then start another Kali host as the target. Because the normal DHCP server has no available IP Address resources, the new Intranet host will use the IP address allocated by the attacker's DHCP server.

0 × 05 capture the Target Image and enable driftnet on the target host.
# Driftnet-I eth0
Open Baidu images on the Target

Images can be seen on the attacker's server

0 × 06 session hijacking
Enable wireshark to capture packets flowing through the local Nic. Because other machines use the NIC of the attacker host, wireshark can capture packets from other hosts.

Use ferret to parse
# Ferret-r demo. pcap

A file named hamster.txt will be generated in the terminal.

Run the harmter command to enable port 1234 on the host.

Configure Firefox proxy

Hijacking successful