CAPEC の情報
実行フロー
1) Explore
[Determine Exsisting DHCP lease] An adversary observes network traffic and waits for an existing DHCP lease to expire on a target machine in the LAN.
技法
- Adversary observes LAN traffic for DHCP solicitations
2) Experiment
[Capture the DHCP DISCOVER message] The adversary captures "DISCOVER" messages and crafts "OFFER" responses for the identified target MAC address. The success of this attack centers on the capturing of and responding to these "DISCOVER" messages.
技法
- Adversary captures and responds to DHCP "DISCOVER" messages tailored to the target subnet.
3) Exploit
[Compromise Network Access and Collect Network Activity] An adversary successfully acts as a rogue DHCP server by redirecting legitimate DHCP requests to itself.
技法
- Adversary sends repeated DHCP "REQUEST" messages to quickly lease all the addresses within network's DHCP pool and forcing new DHCP requests to be handled by the rogue DHCP server.
前提条件
The adversary must have access to a machine within the target LAN which can send DHCP offers to the target.必要なスキル
The adversary must identify potential targets for DHCP Spoofing and craft network configurations to obtain the desired results.必要なリソース
The adversary requires access to a machine within the target LAN on a network which does not secure its DHCP traffic through MAC-Forced Forwarding, port security, etc.緩和策
Design: MAC-Forced ForwardingImplementation: Port Security and DHCP snooping
Implementation: Network-based Intrusion Detection Systems
関連する弱点
| 弱点名 | |
|---|---|
CWE-923 |
Improper Restriction of Communication Channel to Intended Endpoints The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. |
参考文献
REF-737
DHCP Spoofing 101Yuval Lazar.
https://pentera.io/blog/dhcp-spoofing-101
REF-738
DHCP Spoofing 101T. Melsen, S. Blake, Ericsson.
https://www.rfc-editor.org/rfc/rfc4562.html
REF-739
DHCP Spoofing 101Bosco Sebastian.
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/dhcp-client-remote-code-execution-vulnerability-demystified/
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
