In a previous video, which I've linked below, I showed you how to set up Kali or Kali if you prefer
Linux as a DHCP server and then implement a man-in-the-middle attack. In a topology such as this
Kali Linux is set up as a DHCP server to allocate IP addresses to PC, such as the Windows 10 host and
then set the default gateway to itself.
So the traffic is sent through the Kali Linux server onto the Internet and onto other destinations.
That allows us then to implement a man in the middle attack because all traffic is going through Kali
to other devices in the topology.
Now, to stop that from happening, we're going to set up this switch to use DHCP snooping.
So it's going to snoop or listen in on DHCP messages and only allow certain DHCP messages from trusted
servers.
So the switch will allow clients to request IP addresses, but will not allow Kali or other servers
on untrusted ports to offer IP addresses to clients.
We'll set up this interface on the switch as a trusted port so that the router is able to allocate IP
addresses to the PC, but Kali is not able to do that.
OK, so I'm now going to show you practically how to use DHCP snooping to stop these kind of attacks
but I've also added some additional information below this video.
There's a PowerPoint presentation that you can download as an example that gives you the commands to
set this up on a switch.
OK, so on the Windows computer, I'm going to open up command prompt, so open up a CMD prompt,
ifconfig shows me that this is the IP address of the PC at the moment, Default Gateway is 10.1.1
254 which is the router in the topology. On the router
show IP interface, brief notice, IP address of the router
is this. The router is configured as a DHCP server show IP DHCP binding shows me that two IP addresses
have been allocated, one to the Windows computer and one to Kali. On Kali
as an example, if I open up a terminal and type ifconfig
this is the IP address that's been allocated to the Kali Linux server.
Once again, this is the IP address allocated to the PC if I type IP config slash release to release the IP
address.
I'll make that a bit bigger and then type IPconfig, you'll notice that it's not being allocated an
IP address, it's using a link-local IP version 4 address and link-local IP version 6 address.
But if I type IP config slash renew, it should get an IP address from the DHCP server.
And there you go, IP address has been allocated by the router to the Windows computer.
But now let's set up Kali as a rogue DHCP server.
So to do that, I'm going to run Yersenia and use a graphical user interface.
I showed you previously how to use this application in a lot of detail.
So once again, refer to the previous videos, if you want to learn more about this application.
But it's quite simple.
All I'm going to do is launch an attack and I'm going to set up a rogue DHCP server.
So I'm going to select that option and click OK.
The IP address of the rogue DHCP server is going to be the local Kali Linux host, which has an IP address
of 10.1.1.2/24.
Now, I'll use a different range of IP addresses for hosts that we allocate addresses to using Kali.
So let's say 100 to 110, the least time and renewed time offset to 3600 seconds.
Subnet mask will be /24 mask, and this is how I can implement a man-in-the-middle attack.
I'm going to set myself as the default gateway.
That means that the host will send traffic to the Kali Linux host, which will then forward traffic
to the router so we can implement a man-in-the-middle attack without the user knowing what's going on.
DNS server, I'll set to Google and the domain I'll simply set to home.com and click OK.
So if we look at actions, the list of task, you can see that I'm running a rogue server attack, you
can see that the DHCP rogue server is currently running.
So on the client, I'm going to release my IP address again and then renew it.
Now, it may get an IP address from the router rather than from the Kali Linux server.
It just depends which device replies first.
So you can see it got its IP address from the router.
So on the router, I'm going to type no service DHCP, I'm going to disable the DHCP service on the router.
So show IP DHCP binding,
you can see that the bindings have been removed from the router, so on the PC, I'll release my IP address
and then I'll renew it and let's see if it gets an IP address from the Kali Linux server.
On Kali, you can see there's a DHCP Discover.
DHCP discovers are being received, now sometimes this application bombs out or breaks, so you have
to rerun the DHCP server.
That's a lesson in hacking.
You can't expect everything to work the first time you go to be persistent and be tenacious and keep
on trying.
So now it received a DHCP request from the client and it acknowledged it.
In other words, when I ran ipconfig/renew again
It got an IP address.
OK, so the PC has been given an IP address, but note previously, I had an error here saying unable
to contact your DHCP server request timed out.
The Yersinia application sometimes bombs out, especially the graphical user interface.
It is an alpha release.
That's probably why you want to do stuff through the CLI if you can
but to keep things simple, I've done it through the GUI.
But the net result is that the PC has been given an IP address from the Kali Linux server, that's
what we don't want.
Notice the default gateway is Kali.
That means a man in the middle attack could be used here.
OK, so to stop this nonsense, now on the switch that the devices connect to, I'm going to enable DHCP
snooping.
This is a layer 2 switch.
Always configured as a layer 2 switch it does support other options, show IP DHCP snooping.
At the moment, DHCP snooping is disabled.
There's the command notice, DHCP snooping is disabled.
It's not configured on any VLANs and it's not operational on any VLANs.
No interfaces have been configured to be trusted.
So in global configuration mode, I'm simply going to type IP, DHCP snooping, that enables DHCP snooping
on the switch globally
but please note, that's not how you make it work.
This is the first step.
Type the command show IP DHCP snooping again, you can see that it's now being globally enabled, but
it's not enabled on any VLANs, so don't forget to enable it on the VLAN
and to do that, you type IP DHCP snooping VLAN 1.
So two commands are required.
Show, run, pipe include DHCP.
We have now used this command globally as well as this command globally on the switch, show IP DHCP Snooping
shows us that DHCP snooping is now enabled on a VLAN 1.
I'll type IP config slash renew on the PC now at this point, it's not going to get any IP addresses
because we've got DHCP snooping enabled.
The Kali Linux host won't be able to allocate IP addresses to the PC, but nor will the router.
So to prove that on the router.
I'll enable the DHCP service again, so show run shows us
that we've got this DHCP pool configured, this is the network.
This is the default gateway.
This is the DNS server, but the PC is not getting any IP addresses.
So IP config slash renew notice, no IP address is being allocated, show IP DHCP binding, no IP addresses
are allocated by the router and no IP addresses are being allocated by the Kali Linux host. Now to see
what's actually going on.
We can run a debug on the switch, so let's run debug IP DHCP snooping packets so we can see a lot of detail.
Be careful with packets.
You'll see a lot of detail in the output here.
So you may prefer to use events.
But let's run this again, IP config slash renew.
Notice we're seeing a lot of output
but what I'll do now is turn off debugging for the moment, we can see
received a new packet from input interface Gigabit 02, that is the PC.
It's a discover message, notice the source Mac address is this ending in 7c00 on the
PC IP config/all.
That is the Mac address of the Windows computer, so the Windows computers requesting an IP address.
At layer 2, we can see the source Mac address of the PC destination is a broadcast notice all FS.
So hexadecimal FS broadcast at layer 3
destination is a broadcast IP version 4 source IP address is unknown.
It doesn't currently have an IP address.
It's requesting an IP address.
So we've got invalid entry for flooding on ingress VLAN
1 bridge output port is null, packet is dropped.
So the switch is essentially just dropping that packet.
It's not forwarding it anyway, to forward that request to the router on this interface, we need to trust
this port.
So we need to make Gigabit 00 a trusted port so that that DHCP request can be forwarded to the router.
So on the switch interface, gigabit 00, that's the interface connecting to the router, IP,
DHCP, snooping.
We're going to trust the port.
Debug IP DHCP snooping packet, back on the PC
ipconfig/renew let's try and get an IP address.
Can see a lot happening here, but notice right at the bottom of this debug bridge packet sent to Port
Gigabit 00.
So the DHCP request received by the switch from the PC is being forwarded to the router.
We've got DHCP discover from the PC on gigabit 02 asking for an IP address.
But notice this problem we see here, option 82, option 82 can cause problems.
Option 82 is used when you need to forward DHCP requests from a router to a DHCP server as an example and
include information such as port numbers.
So if you have problems with that on the switch type no IP, DHCP snooping information option, enter.
So we're not going to forward option 82 information to the router.
So let's try that again.
IP config /renew,
notice the PC now gets an IP address.
So back on the switch, a lot of outputs in the debug.
So once again, the PC is requesting an IP address.
Inbound interface is gigabit 02, the switch is ending the packet to the router on gigabit 00.
The router replies back.
There's the DHCP packet inbound on gigabit 00, we see the router allocating an IP address to the client.
So in the output here, we can see that this IP address, which is the router is sending a broadcast.
It's a broadcast at layer 2, broadcast at layer 3, allocating the IP address to the PC.
This, once again, if you remember, is the Mac address of the PC.
So the router has successfully allocated an IP address to the PC.
The PC got that IP address from the router.
Now it got given 10.1.1.100 because the PC will ask for the IP address that it had previously.
Previously it had been given that IP address by the Kali Linux server.
So Windows remembers that information and basically requests the IP address it had before.
So it got a different IP address
but that IP address is in the pool of IP addresses on the router.
So you can see that this IP address was allocated to the PC
and if we have a look at the DHCP pool once again, you can see that the pool is all IP addresses in 10.1.
1.0.
So 10.1.1.100 is a valid IP address in that range.
Okay, so back on the switch.
Let's recap what we configured.
Show run pipe include DHCP, we configured DHCP snooping globally on the switch, we configured it globally
on VLAN 1.
So those are global configuration commands.
We also stopped option 82 by configuring that globally
and then we trusted that Gigabit 00 Interface, so show run interface gigabit 00.
Notice this interface has been configured as a trusted interface.
We should do some show commands, so show IP DHCP snooping.
We can see through the output of this command that DHCP snooping is enabled globally, also enabled on
VLAN 1, none other VLANs
all the devices in this network on VLAN one gigabit 00 is a trusted interface.
We are not rate limiting that interface.
But what we may want to do is rate limit requests from PCs.
So we may want to rate this interface and this interface.
The reason why is on Kali Linux we could
do a DHCP
denial of service attack, so send DHCP packets and basically just flood the network with a huge amount
of DHCP requests and that can actually kill or cause problems in the network.
It's actually killing the switch.
So I'll stop that attack.
So actions list attacks
and I'll stop the DHCP discovery attack because it basically kills the switch.
I'm going to get a huge amount of debug output now because I was running a debug.
So an important lesson
don't leave a debug running.
And Kali sent a huge amount of packets to the switch.
So this may take a while.
So I'll turn off debugging.
Not sure if you saw that about a top that quickly, but there it is again, un all and what I'll do is
on the interface to the Kali Linux server.
Which is gigabit 01 all enable rate limiting, so IP DHCP snooping, limit rate to 10 packets.
That means 10 packets per second, so we'll rate limit this packet generation on Kali, basically stop
it from sending too many packets.
So back on the switch and notice DHCP snooping error disable.
We've received more than 10 DHCP packets on gigabit 00 DHP snooping rate limit is exceeded.
More packets have been received.
And what has happened?
The interface has been taken down.
So show IP interface brief on the switch.
There's the command again.
Notice this interface has gone down because Kali sent too many packets.
I'll shut it down to manually shut it and then no shut it and let's see what happens.
It's actually locked up my switch now you can see the CPU is gone crazy, so on
Kali, I'll stop that attack.
This is one of the problems using a virtual environment such as GNS3 or Cisco VIRL or EVENG.
The problem is this is not a physical switch, so it hasn't got the A6 to forward lots of traffic through
it.
So you can basically destroy the switch, which has happened here.
But after a while, what happened was the messages displayed, DHCP snooping, 10 DHCP packets have been
received.
And what has happened now is the interface is shut down once again.
So show IP interface, brief interface has gone down.
So basically what happened is I shut the interface.
No, shut it.
So many packets were being received from the Kali Linux host that the switch bombed out, now physical
switch would necessarily have that problem because it's got the A6, then the 10 packet limit kicked
in and the port was shut down to protect the switch.
So there was a delay from the interface going up, CPU being hammered by Kali to the port, being shut
down by that command.
And that's because I'm using a virtual switch rather than a physical switch.
Physical switch with built-in A6 would stop this kind of nonsense from happening.
Net result, however, is that the interface has gone down.
We've protected the network.
So in this video, I showed you how to protect a network using DHCP snooping.
I showed you how to stop rogue DHCP servers on the network.
I showed you how to stop a denial of service attack by Kelly Linux, where it sends a whole bunch of
DHCP messages.
The switch will shut the port down if it receives too many DHCP requests in a certain amount of time.
Don't forget option 82 can cause problems like it did here.