DEMO: DHCP Starvation Attack

We're going to take a look at a DHCP starvation attack.

How DHCP Works

DHCP, or dynamic host configuration protocol, is a way that we can give a machine on a network an IP address, mask, default gateway, DNS server and other pieces of information. This machine will request it, and then a DHCP server will respond with what its IP address and all the rest of the information should be.

DHCP has something called scopes or pools. This is the list of addresses that can be handed out. So when a machine requests an address, then this server will choose one of the addresses within its scope or pool and then offer it up to this client on the network.

How the Attack Works

The scope and pool is limited in the amount of resources. So a DHCP starvation attack starves the scope or the pool from all of its addresses. How it does this is the machine requests, hey, I need an IP address, from one MAC address, which then it gets a reply back of one of the addresses here. Then it says, oh yeah, I need another one, but from a different MAC address, so it'll get a different IP address. And it'll just keep sending them out until it uses up all of the addresses that are within the scope. And now we're starved of IP addresses that we can hand out.

Now a new machine connects to the network and then asks for an IP address, but this server no longer can give those IP addresses, because you can't have duplicate addresses on the network.

Just a reminder that this video is for ethical hacking purposes only. Make sure you only do this on a network that either you own or have gotten permission to carry out these techniques.

Checking the Victim Machine

All right, I'm on my demo machine here, and I'm going to type in ipconfig so we can see what the IP address is, which is 10.110.199. I can also take a look at what the MAC address is. So I'm going to do ipconfig /all, and it's going to give me extra information to include the physical address. So this is the MAC address of the machine, and it starts out with BC-24.

The DHCP Server

The other thing that I'm going to show you is the DHCP server, which is on a switch, a Cisco switch. So I'm on this Cisco switch right here, and what I can do is I can see some stats on this by doing a show ip dhcp, and we're going to take a look at the bindings. So these are essentially the different IP addresses that are already handed out. So this is the 10.110.199, that's the IP that was handed out, and it was to this MAC address of BC-24. So we can see that there's a correlation here, and it's keeping track of what it's handed out and who it's handed out to.

So if I were to do a renew on this, release this, the demo machine that I first showed you, the victim machine, we'll call it the victim machine, would reach out and get the same IP address every time because it's associated with this MAC address right here. So that's how DHCP keeps track of who it's handed out to, is by those MAC addresses.

Setting Up the Adversary Box

So now we're going to jump on the adversary box. So we've got essentially three boxes now that are in play. We got the victim machine, we got the DHCP server, and now what we're going to do is we're going to use this adversary box, which is Kali Linux, to carry out this attack.

To carry out this attack, we're going to use a program called DHCPig, or DHCPig. So we're going to download this. I'm going to open up a command prompt, and I'm going to make this a little bit bigger so we can see it in our demo here, and then we're going to use this to install DHCPig. We'll start by typing our sudo apt-get update and hit enter. Now that that's installed, we are going to do an install, so apt-get install, and it's going to be of that DHCPig, and we'll hit enter.

All right, now that that's installed, what I can do is I can type in DHCPig to see what some of the details are of executing this command, and as we can see here, we've got a lot of options. And then we've got the interface that we're going to specify, which the one that we're going to hit is going to be eth0. And just to show you what that looks like, I'm going to do an ip a here, and we can see eth0 is going to be this 10.110.31 network, which is the network that we're trying to attack in this case.

Resetting Before the Attack

And now there's one more thing that I need to do before I carry out this attack. I'm going to do a little reset on some stuff. So let me show you how to do that.

The first thing is that this machine already has an IP address, so I need to first of all remove that address. So I'm going to do an ipconfig /release, so that way it gets rid of this IP address and it no longer has that IP address.

The other thing is that this has this binding already, so even though we're going to do this starvation, it's not going to clear this out, so we need to clear this out first. So I'm going to do a clear, and then we'll do an ip dhcp binding, so we'll type that out, hit enter. Oh, needs another, and then we're just going to clear all, so let's clear all and do that. And then let's go ahead and show that IP binding again, so we can see nothing's in there. Now what we've just done is, if we hadn't cleared that out, then during the renewal process it would have just picked that back up again. So now we've stopped that from picking up that same address again.

Launching the Attack

And now what we're going to do is we're going to launch this attack. So we're back on this machine, this adversary box. We're going to type in our DHCPig, and then it's for eth0, is what we're going to launch an attack against that network, and hit enter and let's see what happens. So what we're seeing right here is that it's going through and systematically asking for all of these IP addresses, and then every time it gives a new IP address, then it exhausts one more address, and it's going through that process of exhausting all of those addresses.

Okay, so we can see here that it thinks that the pool is exhausted now, and it's done with this operation. So let's take a look at our DHCP server and see what it looks like. We can do that show ip dhcp binding again. We can see now that it's been requested for all of these different IP addresses, and so now we've exhausted this pool.

So on this machine, let's do a renew to get a new IP address, and hit enter and see what it comes up with. All right, I've waited a while and it's still trying to renew. So what we can see here is that there are no addresses that are available now for these legitimate users, because we've starved that scope from any of these IP addresses.

So here's the attack on DHCP starvation. Essentially what we're doing is we're just using up all of these, whatever we can, all these IP addresses, so they can't be handed out for legitimate users.