Gobbler
Gobbler specializes in DHCP-only attacks. From its documentation,2 Gobbler is described as follows:
A tool designed to audit various aspects of DHCP networks, from detecting if DHCP is running on a network to performing a denial of service attack. The Gobbler also exploits DHCP and Ethernet to allow distributed spoofed port scanning with the added bonus of being able to sniff the reply from a spoofed host. This tool is based on proof of concept code "DHCP Gobbler" available from networkpenetration.com.
Gobbler even goes a step further than Yersinia. Certain DHCP servers periodically send Address Resolution Protocol (ARP) requests or Internet Control Message Protocol (ICMP) echo packets to probe for IP addresses that the server might have reclaimed. Servers do not perform this check for security purposes; instead, they do this because, sometimes, clients do not release their assigned IP address when shutting down.
The author(s) of Gobbler observed this DHCP server behavior and equipped Gobbler with the capability to counteract by responding to ARP requests!
Example 5-1 represents Gobbler's command-line interface (CLI) Help menu. Example 5-1 Gobbler's Help Menu
[root@linux-p4]# ./Gobbler
The Gobbler (Alpha release 2.0.1) from NetworkPenetration.com
Scanning Options
-A <b,g,n,s,w> Arp scan (b)cast (g)obble (n)et-broadcast (s)pec* (w)rong -C <g,s> Create a host (g)obble (s)pecified* -D Detect DHCP service / rogue servers on network
-G Gobble attack - DoS DHCP server via IP exhaustion / MAC spoofing attack -M <d,l,o> DHCP mitm attack ns mitm (l)eaving subnet (o)ther ip range -N <IP> None gobbled SYN scan* -P <IP> SYN scan using a gobbled IP address
-Q <IP-r,m,n,1a:2b:3c:4d:5e:6f> Src IP-MAC (r)andom (m)ulticast (n)on-spoofed -R <135-139,445,a,o,s,n> Port range (a)ll (o)sstm (s)ervices (n)nmap -S Start sniffer
-T Traceroute to target (use with -P or -N) -U ICMP ping target (use with -P or -N) -X Nmap OS detection (use with -P or -N) -Z Port 0 OS detection (use with -P or -N)
Misc
-a <x> Amount of pings (use with -U)
-c Closed ports displayed at end of portscan (all ports opposed to 20)
-d Filtered ports displayed at end of portscan (all)
-e <x> End of scan sleep for x seconds - wait for replies (default 2)
-f Fast mode - possible errors with port lists
-g Don't release gobbled IP's (might be handy when portscanning)
-h Don't ICMP ping target... useful if a firewall is blocking ICMP pings
-i <if> Interface (use before -Q if non spoofed mac)
-j Jump past rescanning filtered ports (useful when scanning all ports)
-l <x> Size of icmp echo request (default 32)
-n <x> Number of spoofed source hosts used in -P and -Cg
-o / -O <port num> Open port on spoofed host o(tcp) (O)udp
-r Don't reply to ICMP ping requests
-s <port> Source port for SYN scanner (Default: random)
-t Tag mac addresses for gobbled hosts(each will end in 4e:50)
-u <x> Closed UDP port used in OS detection (default port 1)
-v Verbose (may be used 3 times for crazy amounts of debugging info)
-V Display linked list after every update (used when gobbling a IP address)
-w Remove warnings at start of various scans
Examples
Gobbled scan single dynamically assigned host: Gobbler -P 192.168.1.1 -R n Gobbled scan multiple src hosts: Gobbler -P 192.168.3.1 -R 21-23,445 -n 4 Non-gobbled scan: Gobbler -N 10.0.0.1 -Q 10.0.0.50-r -Q 10.0.0.51-r -R n -f Sniffer: Gobbler -i eth0 -S -v Arp scan: Gobbler -i fxp0 -Ag
Detect rogue DHCP server: Gobbler -D -i eth0 DHCP DoS: Gobbler -G -i fxp0
continues
Example 5-1 Gobbler's Help Menu (Continued)
Note: all options with a * require -Q
Note: MITM -M is in the early stages of coding
Note: When performing a DoS attack the gobbler crashes
WARNING read README.1ST before using the Gobbler
If you do not understand what you are doing, do NOT use this program! [root@linux-p4#
NOTE All of Example 5-1's lines are just options for Gobbler: Many of them exist because Gobbler is a powerful attack tool against DHCP.
At the end of the day, both Yersinia and Gobbler make it all too easy to attack DHCP servers.
Continue reading here: Hijacking Traffic Using DHCP Rogue Servers
Was this article helpful?