5

The computers on our office building are (via BIOS) configured to boot PXE as first option.
This is a useful setting, as long as, when needed, we can remotely restore non-booting machines and all that stuff.

But, if someone sets up a rogue PXE server, machines could be compromised at next reboot (i.e: automatic Windows reboots), so being able to detect such server is a must.

What methods could I use to test if there is any PXE Server running on my local network?
If possible, obtaining some info (like IP or MAC) to locate this rogue server could be fine.

Assumptions:

  • The network already has a DHCP server running. PXE and DHCP server are not on the same device/computer.
Improve this question
6
  • 2
    Isn't PXE information handed out by the DHCP server? So maybe the question should be how to detect rogue DHCP servers
    – multithr3at3d
    Commented Sep 8, 2019 at 17:39
  • DHCP server is already on the network, @multithr3at3d . Added info to original question to clarify.
    – Sopalajo de Arrierez
    Commented Sep 8, 2019 at 19:34
  • 3
    Your PXE setup depends on DHCP, and thus what you are really looking for is rogue DHCP (or BOOTP) servers. The rest of PXE is TFTP, but that only starts after DHCP has provided TFTP setup data to the system that tries to PXE boot. In normal setups: no DHCP==no PXE. PXE in itself is not a protocol or server, but rather a standard workflow.
    – John Keates
    Commented Sep 9, 2019 at 2:52
  • Note, @JohnKeates , the Serva PXE Server for Windows at vercot.com/~serva : it has the option to enable (or not) its own DHCP Server (if there is already another DHCP Server running). Of course you need some DHCP server somewhere, but you could have a rogue PXE server (like Serva) that does not run (feature) a rogue DHCP server.
    – Sopalajo de Arrierez
    Commented Sep 9, 2019 at 11:31
  • 3
    There is no such thing as a PXE server, PXE is DHCP plus TFTP. And without DHCP a client PC cannot connect to the rogue TFTP server because it doesn’t know where it is.
    – John Keates
    Commented Sep 9, 2019 at 14:46

2 Answers 2

Reset to default
2

If PXE (TFTP) server information is provided to the clients via DHCP options, then you may need to prevent that someone could set up a rogue DHCP server in the network to provide the clients with the adress of a malicious TFTP server. DHCP snooping may help you: it will allow DHCP reply messages (such as DHCPoffer) only in ports that have been configured as trusted by the network administrator. These trusted ports should be the ports where legitimate DHCP servers are connected to the network o where DHCP replies coming from the legitimate DHCP server are expected.

Besides effectively preventing rogue DHCP servers to work in your network it will also allow you to detect such servers and where they are connected if you monitor the log messages generated when DHCP snooping violations occur

Improve this answer
1
  • A possible method, indeed. Thanks you. But as long as DHCP server could be independent from PXE server, I would rather prefer some DHCP-independent way. Added to the original question in order to clarify.
    – Sopalajo de Arrierez
    Commented Sep 8, 2019 at 19:45
0

You can use nmap for this; read my answer here:

https://serverfault.com/questions/993783/how-can-i-check-my-pxe-server-configuration/

Gathering the different answers and filtering by e.g. MAC address, you can easily pinpoint the presence of a rogue PXE server.

It should be considered that PXE information (NBP and TFTP server IP) can be located either at the body of the DHCPOFFER packet (file and next-server fields) or as the corresponding DHCP options.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .