So let's see how we can perform a Dhcp starvation attack and consume the Dhcp pool using Yersinia.
Yersinia is a network tool designed to take advantage of some weaknesses in different network protocols.
The protocols currently implemented in Yersinia are shown in the slide.
Now we're going to use our VMs in net mode during this demo.
So I'm on my host machine and open the virtual machine library.
This is the collie that I'll use.
So click this icon to see the VM settings.
Click the network adapter icon.
It says Internet is shared with my Mac.
So if you look at the explanation in the right hand side of the frame, it means the VM is in that mode.
So this is what we want.
So just leave it as it is.
The Connect Network adapter is selected so Kali is ready to use with a network connection.
So Windows 8 is the other VM that I'll use to demonstrate Dhcp starvation attack.
Let's have a look at the network settings of windows as well.
Yeah, it's in that mode and the network adapter is connected.
So I'll disconnect the network adapter by clicking here because I just want to show you that the Dhcp
of VMware is working properly.
So I want to add a second network interface for my Windows system.
Click show all and go to the settings menu.
And click on Add device at the upper left hand corner.
Select Network Adapter and click Add.
The details of the new adapter are listed here.
The Nat mode is selected by default already.
So uncheck the Kinect network adapter box for now.
Okay.
So as you see, we have two network adapters for the Windows system.
Both of them are in that mode and are disconnected.
So now I'll start the Windows 8 system.
Log in.
And sure enough, it's ready.
Right click on the network icon at the lower right corner and select Open Network and Sharing Center.
And right there, we don't have an active network at the moment.
That's to be expected.
So now I connect the first adapter and activate the network in VMware Fusion.
You can see and change the setting in several ways.
If you use the VM in full screen mode like I do, just go to the upper side for VMware Fusion menu.
There it is.
And if the menu does not appear, just press command control buttons together.
Right.
So this is the default setting of VMware Fusion to turn back to the host system when you're inside a
VM.
And these are the network adapters.
When you click on them, you'll see the short menu for network adapter.
And here you can connect or disconnect the network adapter, change the network mode, Nat bridge or
host only, and you can use this pop up for the network adapter settings.
Now, the second way to see and change the network settings is to click the settings icon, then select
the adapter to see the settings.
So the third way is to go to the virtual machine menu.
Go to the network adapter and you will see the short menu of the adapter.
Now go to the first network adapter icon and click on the Connect Network adapter menu item.
And now you see in the network and sharing center window, we now have an active network connection.
So click the network name and the details button.
Here are the connection details.
And right there.
There it is.
Dhcp is 172.16.99.254 and it assigned an IP address for the VM.
172.16.99.221.
As well as the gateway and the DNS address.
Now I'll go back to Cali and open a terminal screen.
Using the ifconfig command to see the network interface configuration and sure enough, it has the IP
address.
So ping the Windows 8 system to validate the network.
Two, two, one.
Okay, we received the ICMP reply, so everything looks okay.
Now is the time for your cinema.
So type men Yersinia and hit enter to see the menu.
And right here in the manual, Yersinia is a framework for performing layer two attacks.
And here's a list of protocols implemented in Yersinia.
Scroll down, you'll see the options.
We can use uppercase G to start a graphical interface.
So let's go ahead and use it in graphical mode.
You can press Q to quit from the manual and turn back to the terminal.
Now type Yersinia Uppercase G and press enter.
So this is the graphical user interface of Yersinia.
Before running the attack.
Lets open Wireshark and monitor the network packets to see what happens when we start the attack.
You can type Wireshark in terminal to start it or just click the Wireshark icon to select the interface
to listen.
Double click Eth0.
And to discard the different packets and focus only on the Dhcp packets.
We can filter the packets in the filter box, type boot IP and hit enter.
So boot P is the short form of bootstrap protocol which I mentioned earlier.
It's basically a computer networking protocol to automatically assign an IP address to network devices
from a configuration server and obviously it's used by the Dhcp server.
Now we can turn back to Yersinia and prepare and run the attack.
So click launch attack.
That's the link at the upper left hand corner.
The tabs in the window are the implemented protocols.
Choose Dhcp and select sending Discover packet.
Now click.
Okay.
As soon as we click the button, Yersinia starts sending dozens of Dhcp requests in a second.
It'll keep sending the packets till we stop the attack.
Now look at the wireshark window.
These are the Dhcp Discover packets sent by Yersinia.
So now, while Yersinia is sending the Dhcp Discover packets, let's activate the second interface of
the Windows VM and let's see if the Dhcp server assigns an IP address for the second interface.
All right, So we're in the Windows VM now.
Go to the second network adapter, click Connect.
Network adapter two to activate the second interface.
Now, do you remember what happened when we activated the first interface?
We saw the new network activated.
But now there is still no network because the Dhcp server is busy replying to the request created by
Yersinia.
It's not going to answer the Windows 8 second interface.
So let's turn back to Cali and stop the attack.
In your seniors interface.
Just click list attacks and then click Stop or stop all.
And the wireshark window.
Look at the bottom of the packets list.
We now have a complete Dhcp sequence.
Discover, offer, request and ack packets.
In the Windows 8 VM.
We now have the second network.
The first one was Ethernet zero two.
This one is Ethernet zero.
Click on it in the status window, click on details.
The second interface has an IP address now assigned by the Dhcp server.