Welcome back!
In the last lecture we've executed a Discover flooding attack on the DHCP server which is also the default
gateway of the lan.
Now I'll show you a starvation attack which can have far more impact on the network and its users.
This time the attacker will not flood the DHCP server with hundreds of discov requests per second
but he will instead send the discov request packets at a slower rate allowing the DHCP to properly
handle them.
He will keep track of sent discover messages and wait for the matching OFFER replies.
Finally the hacker will send REQUEST messages in reaction to the received OFFERs, confirming the IP
lease. In just a few seconds
all available IP addresses will be leased meaning that there will be no available IP any more to
send to newly connected devices preventing them from accessing the network.
It's the classical definition of a denial of service attack.
Okay, let's go work. To launch of the attack
I'm gonna use another tool called the DHCPig.
It has a good implementation of this attack and there are tons of available options
The DHCPig is written in Python, has been tested on multiple Linux distributions and multiple the DHCP
servers and uses the scapy library. Even though it has a lot of options to start a basic starvation
attack
no configuration is necessary.
Just pass the interface as a parameter to the dhcpig command.
I'm gonna use the Linux Mint but you can use any Linux distribution you wish including Kali; you will
use it in the same way!
DHCPig is not installed but it belongs to the standard repositories so I'm gonna install it using
apt. As root
I'm executing apt
update && apt install
dhcpig
Okay, it was successfully installed!
I'm checking the machine's IP and then launching the attack dhcpig and the interface.
In this case it's enp0s3
We notice how it’s sending DHCP Discover packets, waiting for the Offer packets and then completes
the entire IP allocation process.
If you want to go deeper start Wireshark and see exactly what it sends and receives back from the
server.
Okay, done!
DHCP pool exhausted! This is that the DHCP server which is also the router and the victim of the
attack.
Let's check the logs of the DHCP server. And we see here
tons of requests received from DHCP peak and acknowledgements sent back by the server; all IP configurations
have been already offered.
If a legitimate client boots up it won't receive anything.
The DHCPig goes even farther.
Once there are no more free leases it will try to disconnect all Windows machines by simulating IP addresses
conflicts by sending gratuitous ARP packets.
This results in the Windows machines dropping their current address to fetch a new one from the DHCH server
but at that time there are no more IP addresses available. Okay!
That's all about the DHCP starvation attack. To bring my network back into its normal parameters
I think I'm gonna restart the router.