Pentest Tools

Published on September 22nd, 2015 📆 | 3555 Views ⚑

0

DHCPig — DHCP exhaustion attack

iSpeech.org
DHCPig initiates an advanced DHCP exhaustion attack. It will consume all IPs on the LAN, stop new users from obtaining IPs, release any IPs in use, then for good measure send gratuitous ARP and knock all windows hosts offline.

It requires scapy >=2.1 library and admin privileges to execute. No configuration necessary, just pass the interface as a parameter. It has been tested on multiple Linux distributions and multiple DHCP servers (ISC,Windows 2k3/2k8,..).

When executed the script will perform the following actions:

• Grab your Neighbors IPs before they do
  Listen for DHCP Requests from other clients if offer detected, respond with request for that offer.
• Request all available IP addresses in Zone
  Loop and Send DHCP Requests all from different hosts & MAC addresses
• Find your Neighbors MAC & IP and release their IP from DHCP server
  ARP for all neighbors on that LAN, then send DHCPReleases to server

[adsense size='1']

Finally the script will then wait for DHCP exhaustion, (that is no received DHCP OFFERs for 10 seconds) and then

• Knock all Windows systems offline
  gratuitous ARP the LAN, and since no additional DHCP addresses are available these windows systems should stay offline. Linux systems will not give up IP even when another system on LAN is detected with same IP.

Protocol

• IPv4
  • SEQUENCE
    1. —-> DHCP_DISCOVER
    2. <—- DHCP_OFFER
    3. —-> DHCP_REQUEST
    4. <—- DHCP_REPLY (ACK/NACK)
  • DHCPd snoop detection (DHCPd often checks if IP is in use)
    • Check for ARP_Snoops
    • Check for ICMP Snoops
• IPv6
  • SEQUENCE
    1. —-> DHCP6_SOLICIT
    2. <—- DHCP6_ADVERTISE
    3. —-> DHCP6_REQUEST
    4. <—- DHCP6_REPLY
    5. DHCPd snoop detection (DHCPd often checks if IP is in use)
       • Check for ICMPv6 Snoops

[adsense size='1']

Usage:

enhanced DHCP exhaustion attack plus.

Usage:
    pig.py [-h -v -6 -1 -s -f -t -a -i -o -l -x -y -z -g -r -n -c ] <interface>

Options:
    -h, --help                     <-- you are here :)
    -v, --verbosity                ...  0 ... no         (3)
                                        1 ... minimal
                                       10 ... default
                                       99 ... debug

    -6, --ipv6                     ... DHCPv6 (off, DHCPv4 by default)
    -1, --v6-rapid-commit          ... enable RapidCommit (2way ip assignment instead of 4way) (off)

    -s, --client-src               ... a list of client macs 00:11:22:33:44:55,00:11:22:33:44:56 (Default: <random>)
    -O, --request-options          ... option-codes to request e.g. 21,22,23 or 12,14-19,23 (Default: 0-80)

    -f, --fuzz                     ... randomly fuzz packets (off)

    -t, --threads                  ... number of sending threads (1)

    -a, --show-arp                 ... detect/print arp who_has (off)
    -i, --show-icmp                ... detect/print icmps requests (off)
    -o, --show-options             ... print lease infos (off)
    -l, --show-lease-confirm       ... detect/print dhcp replies (off)

    -g, --neighbors-attack-garp    ... knock off network segment using gratious arps (off)
    -r, --neighbors-attack-release ... release all neighbor ips (off)
    -n, --neighbors-scan-arp       ... arp neighbor scan (off)

    -x, --timeout-threads          ... thread spawn timer (0.4)
    -y, --timeout-dos              ... DOS timeout (8) (wait time to mass grat.arp)
    -z, --timeout-dhcprequest      ... dhcp request timeout (2)

    -c, --color                    ... enable color output (off)

[adsense size='1']

Defense

Most common approach to defending DHCP exhaustion is via access layer switching or wireless controllers.

In cisco switching simplest option is to enable DHCP snooping. Snooping will defend against pool exhaustion, IP hijacking, and DHCP sever spoofing all of which are used in DHCPig. Based on examined traffic, DHCP snooping will create a mapping table from IP to mac on each port. User access ports are then restricted to only the given IP. Any DHCP server messages originating from untrusted ports are filtered.

Enable the following to defend against pool exhaustion, IP hijacking, and DHCP sever spoofing:

• enable snooping

   ip dhcp snooping

• specify which port your DHCP is associated with. Most likely this is your uplink. Doing the following will limit DHCP server responses to only the specified port, so use after testing in lab environment .

  int fa0/1 (or correct interface)

  ip dhcp snooping trust

• show status

  show ip dhcp snopping

  show ip dhcp snopping binding

• Additional Info

Source && Download