CAPEC 정보
실행 흐름
1) Explore
[Determine Exsisting DHCP lease] An adversary observes network traffic and waits for an existing DHCP lease to expire on a target machine in the LAN.
기법
- Adversary observes LAN traffic for DHCP solicitations
2) Experiment
[Capture the DHCP DISCOVER message] The adversary captures "DISCOVER" messages and crafts "OFFER" responses for the identified target MAC address. The success of this attack centers on the capturing of and responding to these "DISCOVER" messages.
기법
- Adversary captures and responds to DHCP "DISCOVER" messages tailored to the target subnet.
3) Exploit
[Compromise Network Access and Collect Network Activity] An adversary successfully acts as a rogue DHCP server by redirecting legitimate DHCP requests to itself.
기법
- Adversary sends repeated DHCP "REQUEST" messages to quickly lease all the addresses within network's DHCP pool and forcing new DHCP requests to be handled by the rogue DHCP server.
사전 조건
The adversary must have access to a machine within the target LAN which can send DHCP offers to the target.필요 기술
The adversary must identify potential targets for DHCP Spoofing and craft network configurations to obtain the desired results.필요 리소스
The adversary requires access to a machine within the target LAN on a network which does not secure its DHCP traffic through MAC-Forced Forwarding, port security, etc.완화 방법
Design: MAC-Forced ForwardingImplementation: Port Security and DHCP snooping
Implementation: Network-based Intrusion Detection Systems
관련 약점
| 약점 이름 | |
|---|---|
CWE-923 |
Improper Restriction of Communication Channel to Intended Endpoints The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. |
참고 자료
REF-737
DHCP Spoofing 101Yuval Lazar.
https://pentera.io/blog/dhcp-spoofing-101
REF-738
DHCP Spoofing 101T. Melsen, S. Blake, Ericsson.
https://www.rfc-editor.org/rfc/rfc4562.html
REF-739
DHCP Spoofing 101Bosco Sebastian.
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/dhcp-client-remote-code-execution-vulnerability-demystified/
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
