Rogue DHCP server Intranet attack test

Rogue DHCP server Intranet attack test

Intranet penetration is usually Based on ARP attacks, but ARP attacks are too costly to the Intranet and are easy to detect. Today we are talking about DHCP-based attacks.

DHCP-based attacks are easy to understand. First, hackers use their own hosts to forge a DHCP server by forging a Mac address and exhausting the IP addresses of normal DHCP servers, the newly connected Intranet host can only use the IP address allocated by the rogue DHCP server, so that the hacker's host becomes an intranet gateway, which can control the network traffic of other hosts in the intranet.

Attack Environment

Operating System: Kali linux

Gateway: 192.168.177.1

IP Address: 192.168.177.128

Network Segment: 192.168.177.1/24

0 × 01 enable route forwarding for the operating system

Echo "1">/proc/sys/net/ipv4/ip_forward

0 × 02 attack the normal dhcp server and consume ip Resources

Dhcpstarv-I eth0-e 192.168.177.128

By default, dhcpstarv is not installed in Kali. You can also use yersinia instead.

0 × 03 install dhcp server udhcpd

# Apt-get install udhcpd

Modify the configuration file.

# Vim/etc/udhcpd. conf

 

0 × 04 start the DHCP server

Service udhcpd start

Then start another Kali host as the target. Because the normal DHCP server has no available IP Address resources, the new Intranet host will use the IP address allocated by the attacker's DHCP server.

0 × 05 capture the Target Image

Enable driftnet on the attack host

# Driftnet-I eth0

Open Baidu images on the Target

Images can be seen on the attacker's server

0 × 06 session hijacking

Enable wireshark to capture packets flowing through the local Nic. Because other machines use the NIC of the attacker host, wireshark can capture packets from other hosts.

Use ferret to parse

# Ferret-r demo. pcap

A file named hamster.txt will be generated in the terminal.

Run the harmter command to enable port 1234 on the host.

Configure Firefox proxy

Hijacking successful