Rogue DHCP and Network Threats

DHCP is an unauthenticated protocol: the client accepts the first response it receives. An attacker with physical or virtual access to the network can exploit this to make itself the Gateway and DNS for the victim — i.e., a full Man-in-the-Middle.

Main attack vectors

• Rogue DHCP Server — a fake server that hands out the attacker's Gateway and DNS, enabling eavesdropping on all traffic.
• DHCP Starvation — flooding the legitimate server with requests using spoofed MAC addresses until the Scope is exhausted (DoS), leaving the rogue server as the only one responding.
• mitm6 / DHCPv6 — Windows prefers IPv6. The attacker responds to DHCPv6 requests and sets itself as DNS, then performs NTLM Relay to LDAP or ADCS.
• DNS Hijack via Option 006 — redirecting the client to the attacker's DNS server and spoofing the Domain Controller's location.
• Unsecured Dynamic Updates — overwriting DNS records of legitimate servers.

Defenses

• DHCP Snooping on switches — only defined (Trusted) ports may send DHCP responses.
• Port Security / 802.1X — preventing unapproved devices from connecting to the network.
• DHCP Authorization in AD — blocks unauthorized Windows servers (does not block Linux/scripts).
• Blocking DHCPv6 or disabling IPv6 where it's not in use, and RA Guard on switches.
• Enforcing Secure Dynamic Updates on zones integrated with AD.
• Monitoring: Conflict events, anomalous Leases, and unexpected detailed traffic.

# Locating authorized DHCP servers in AD (anything outside the list is suspicious)
Get-DhcpServerInDC

# Checking for address conflicts - a possible sign of a Rogue Server
Get-DhcpServerv4Scope | Get-DhcpServerv4Lease -AllLeases |
  Where-Object { $_.AddressState -like "*Conflict*" }

# Is DHCPv6 active and listening on the server
Get-DhcpServerv6Binding

! Cisco - DHCP Snooping
SW(config)# ip dhcp snooping
SW(config)# ip dhcp snooping vlan 10,20
SW(config)# interface gi0/24
SW(config-if)# ip dhcp snooping trust
SW(config)# interface range gi0/1-23
SW(config-if-range)# ip dhcp snooping limit rate 15

# Detect Rogue DHCP from Windows
dhcploc.exe 10.0.0.5
Get-DhcpServerInDC   # Only authorized ones