Saturday, January 12, 2019

DHCP Starvation Attack and MAC Address Spoofing

It was a rainy holiday but I still enjoyed my stay in the Philippines last December 2018. My family visited the Mind Museum in BGC Taguig, which was just few minutes away from F1 Hotel where we stayed.


I always longed the fresh air and cool climate in Tagaytay, so we went there after celebrating the New Year. Our first stop was Paradizoo, a mini zoo where you can interact and feed various farm animals. They also have other attractions such as the butterfly garden and a honeybee farm.


We had Filipino lunch at Balay Dako and they have a spectacular view of Taal Lake and Volcano.


This helpful link describes the anatomy of a DHCP server spoofing attack. I also used a Layer 2 attack tool called Yersinia, which is included in Kali Linux distribution.

In my Cybersecurity lab, the Cisco ASA5506-X act as the DHCP server for the wired inside hosts on the 192.168.1.0/24 subnet and for the wifi hosts on the 192.168.10.0/24.

Both DHCP ranges has a maximum of 42 IP addresses that it could lease out:
  • 192.168.1.10 - 192.168.1.50
  • 192.168.10.10 - 192.168.10.50

The ASA firewall/DHCP server currently displays only 1 host with the assigned IP address 192.168.10.43 (my iPhone).


root@kali:~# yersinia --help
    Û²ÛÛ²²Û                                                                    
   ²Û°°°²²Û²²                                                                  
 Û²²²°ÛÛÛ°²Û²²                                                                 
²²°²°Û±²±Û²°°²²²Û                                                              
°²°°Û±²±²²±Û²²°²²Û                                                             
²°²°Û±²±±²²±Û°°²°²²               Yersinia...                                  
²²°°²Û²²±²²±²±Û°²ÛÛ²²²                                                         
Û²²²°Û±²²²±±²²±ÛÛ°²°ÛÛ²²²         The Black Death for nowadays networks        
 ²²²°²ÛÛ±²²²²²²²²±Û°°²²°²²                                                     
 ²ÛÛ°°²°Û±²²±±±²²²²²±Û°²²Û²²             by Slay & tomac                       
  Û²²Û²°°Û±²²²±±²²²²²²±Û²°°²²Û                                                 
     ²²Û²°Û±±²²±±±±±±²²²±Û°²°²Û        http://www.yersinia.net                 
      Û²°²²ÛÛ±±±²²±±±±²²²ÛÛÛ²Û²            yersinia@yersinia.net               
       Û²²°°²ÛÛ±±±²²²±²²²ÛÛ²°ÛÛ                                                
         ²Û²°²²°Û±±±²²²²±Û²°Û²²                                                
         ²Û²²Û°²°ÛÛÛÛÛ±ÛÛ°²²²²     Prune your MSTP, RSTP, STP trees!!!!        
             ²²Û°°²²²°°²°°Û²²                                                  

Usage: yersinia [-hVGIDd] [-l logfile] [-c conffile] protocol [protocol_options]
       -V   Program version.
       -h   This help screen.
       -G   Graphical mode (GTK).
       -I   Interactive mode (ncurses).
       -D   Daemon mode.
       -d   Debug.
       -l logfile   Select logfile.
       -c conffile  Select config file.
  protocol   One of the following: cdp, dhcp, dot1q, dot1x, dtp, hsrp, isl, mpls, stp, vtp.

Try 'yersinia protocol -h' to see protocol_options help

Please, see the man page for a full list of options and many examples.
Send your bugs & suggestions to the Yersinia developers <yersinia@yersinia.net>

MOTD: The world is waiting for... M-A-T-E-O!!!


root@kali:~# yersinia -G      // LAUNCH GUI

A pop-up message is displayed. Just click OK.

To launch a DHCP Starvation (DoS) Attack, go to DHCP tab > Launch attack (gear icon) > choose sending DISCOVER packet > OK.



The DHCP table went full (42 Active Leases) in less than a minute.


To stop the DHCP Starvation attack, click List attacks > Stop


No comments:

Post a Comment