CAPEC 信息
执行流程
1) Explore
[Determine Exsisting DHCP lease] An adversary observes network traffic and waits for an existing DHCP lease to expire on a target machine in the LAN.
技术手段
- Adversary observes LAN traffic for DHCP solicitations
2) Experiment
[Capture the DHCP DISCOVER message] The adversary captures "DISCOVER" messages and crafts "OFFER" responses for the identified target MAC address. The success of this attack centers on the capturing of and responding to these "DISCOVER" messages.
技术手段
- Adversary captures and responds to DHCP "DISCOVER" messages tailored to the target subnet.
3) Exploit
[Compromise Network Access and Collect Network Activity] An adversary successfully acts as a rogue DHCP server by redirecting legitimate DHCP requests to itself.
技术手段
- Adversary sends repeated DHCP "REQUEST" messages to quickly lease all the addresses within network's DHCP pool and forcing new DHCP requests to be handled by the rogue DHCP server.
前提条件
The adversary must have access to a machine within the target LAN which can send DHCP offers to the target.所需技能
The adversary must identify potential targets for DHCP Spoofing and craft network configurations to obtain the desired results.所需资源
The adversary requires access to a machine within the target LAN on a network which does not secure its DHCP traffic through MAC-Forced Forwarding, port security, etc.缓解措施
Design: MAC-Forced ForwardingImplementation: Port Security and DHCP snooping
Implementation: Network-based Intrusion Detection Systems
相关弱点
| 弱点名称 | |
|---|---|
CWE-923 |
Improper Restriction of Communication Channel to Intended Endpoints The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. |
参考资料
REF-737
DHCP Spoofing 101Yuval Lazar.
https://pentera.io/blog/dhcp-spoofing-101
REF-738
DHCP Spoofing 101T. Melsen, S. Blake, Ericsson.
https://www.rfc-editor.org/rfc/rfc4562.html
REF-739
DHCP Spoofing 101Bosco Sebastian.
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/dhcp-client-remote-code-execution-vulnerability-demystified/
提交记录
| 名称 | 组织 | 日期 | 发布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
