1

I was trying to run a Rogue DHCP Server which should cause a MITM attack. I did the following

  • Exhaust the real DHCP Server using DHCPig (worked)
  • Run a Rogue DHCP Server using the auxiliary/server/dhcp module (runs)
  • Cause a device to send a DHCP request

I see the incoming request in wireshark but the real DHCP Server which has no more leases is sending a DHCP NACK Packet which causes the client to cancel his request instantly. This results in the client ignoring the DHCP Offer from my Rogue DHCP Server.

I can thihnk of not exhausting the DHCP Server and "just" be faster which did not work out very well when I tried it.

What is the best way to move the client to accept my DHCP offer?

Improve this question

1 Answer 1

Reset to default
1

Plan A: Try using another ip range than the real DHCP server.

A DHCP server is not supposed to NACK a request for an ip outside it's IP range.

Plan B: it is a race condition, so flood the client with DHCPOFFER messages.

Plan C: use arpspoofing, it's much easier.

Improve this answer
2
  • Solution A wont work becase the NACK isn't send as a response to my fake offer its send because the DHCP Server does not have any leases left but B might be possible when I start before the request is sent.
    – davidb
    Oct 6, 2015 at 13:46
  • Does your client ignore your offers once the first DHCP gives its answer ?
    – Nate
    Oct 6, 2015 at 13:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .