COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-697

DHCP Spoofing

An adversary masquerades as a legitimate Dynamic Host Configuration Protocol (DHCP) server by spoofing DHCP traffic, with the goal of redirecting network traffic or denying service to DHCP.

Soyutlama

Standard

Tipik ciddiyet

High

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary masquerades as a legitimate Dynamic Host Configuration Protocol (DHCP) server by spoofing DHCP traffic, with the goal of redirecting network traffic or denying service to DHCP.

Genişletilmiş açıklama

DHCP is broadcast to the entire Local Area Network (LAN) and does not have any form of authentication by default. Therefore, it is susceptible to spoofing. An adversary with access to the target LAN can receive DHCP messages; obtaining the topology information required to potentially manipulate other hosts' network configurations. To improve the likelihood of the DHCP request being serviced by the Rogue server, an adversary can first starve the DHCP pool.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Determine Exsisting DHCP lease

An adversary observes network traffic and waits for an existing DHCP lease to expire on a target machine in the LAN.

Kullanılan teknikler

  • Adversary observes LAN traffic for DHCP solicitations
2

Experiment

Capture the DHCP DISCOVER message

The adversary captures "DISCOVER" messages and crafts "OFFER" responses for the identified target MAC address. The success of this attack centers on the capturing of and responding to these "DISCOVER" messages.

Kullanılan teknikler

  • Adversary captures and responds to DHCP "DISCOVER" messages tailored to the target subnet.
3

Exploit

Compromise Network Access and Collect Network Activity

An adversary successfully acts as a rogue DHCP server by redirecting legitimate DHCP requests to itself.

Kullanılan teknikler

  • Adversary sends repeated DHCP "REQUEST" messages to quickly lease all the addresses within network's DHCP pool and forcing new DHCP requests to be handled by the rogue DHCP server.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The adversary must have access to a machine within the target LAN which can send DHCP offers to the target.

Gerekli beceri

  • Medium: The adversary must identify potential targets for DHCP Spoofing and craft network configurations to obtain the desired results.

Gerekli kaynak

  • The adversary requires access to a machine within the target LAN on a network which does not secure its DHCP traffic through MAC-Forced Forwarding, port security, etc.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality, Access Control

Modify DataExecute Unauthorized Commands

Etkilenen alanlar: Integrity, Access Control

Resource Consumption

Etkilenen alanlar: Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Design: MAC-Forced Forwarding
2
Implementation: Port Security and DHCP snooping
3
Implementation: Network-based Intrusion Detection Systems

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
In early 2019, Microsoft patched a critical vulnerability ( CVE-2019-0547) in the Windows DHCP client which allowed remote code execution via crafted DHCP OFFER packets. [ REF-739 ]
CAPEC-697: DHCP Spoofing — DayBreach Saldırı Sözlüğü · DayBreach