When a workstation reboots or plugs into a network, a broadcast DHCP request is emitted. It's goal is to ask for network settings like an IPv4 address.
Windows uses several custom DHCP options such as NetBIOS, WINS, WPAD settings. When a workstation sends a DHCP request to get its networking settings, these additional settings can be included in the DHCP answer to facilitate straightforward connectivity and name resolution. (Laurent Gaffié)
DHCP's option 252 provides Windows machines with a WPAD configuration. An attacker able to answer broadcast DHCP queries faster than the legit DHCP server can inject any network setting on the requesting client.
- race against the legit DHCP server to answer
- sent a DHCP ACK response with a rogue WPAD server address in
option 252in the network parameters, with a short lease (10 seconds). Responder can also be used to attempt at injecting a DNS server instead.
- wait the lease to expire so that the poisoned client asks for a new lease
- let the client obtain a legitimate lease from the real DHCP server, allowing the client to obtain the right network settings and have connectivity
- the injected WPAD server address will stay until the client reboots. If the injected field was a DNS server, it will be overwritten with the new legit DHCP lease.
- with the injected WPAD server address, the Windows client will try to obtain the
wpad.datfile on the rogue WPAD. Responder will then require the client to authenticate.
The attack can be started with the
-d/--DHCP(WPAD injection) argument. By default, a rogue WPAD server will be injected in the configuration. If the additional
-D/--DHCP-DNSargument is set, a rogue DNS server address will be injected in the configuration instead of a WPAD.
Additional arguments and options should be used when doing DHCP poisoning with the
-d/--DHCPargument. Those options can also be used along
-D/--DHCP-DNSsince the WPAD DNS entry will be one of the first queries by the poisoned machine.
-w/--wpadoption to start the WPAD rogue server so that fake
wpad.datfile can be served to requesting clients (i.e. WPAD spoofing)
-P/--ProxyAuthoption to force the Windows client to authenticate after the
wpad.datis accessed and when the client starts using the proxy
# DNS injection
responder --interface "eth0" --DHCP --DHCP-DNS --wpad --ProxyAuth
responder -I "eth0" -wPdD
# WPAD injection
responder --interface "eth0" --DHCP --wpad --ProxyAuth
responder -I "eth0" -wPd
The proxy auth NTLM authentication can either be
responder --interface "eth0" --DHCP --DHCP-DNS --wpad
ntlmrelayx -t $target --http-port 3128