Off The Record - Weaponizing DHCP DNS Dynamic Updates
summary
Unauthenticated on‑network clients can use DHCP DNS Dynamic Update (by sending an FQDN via DHCP with dhclient) to make Microsoft DHCP register or overwrite AD DNS records; demos use Kali + dhclient and ntlmrelay to get intercepted authentication and remote code execution. Research finds Microsoft DHCP on ~40% of monitored networks and DHCP on a DC in ~57% of those, enabling DC arbitrary override and other variants. Tools released include Invoke-DHCPCheckup (scanner) and a planned DD spoof attacker; mitigation: use DNS credential and avoid managed records or disable the feature.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:36Motivation
- 6:31DHCP
- 7:32DHCP DNS Dynamic Updates
- 10:53Interesting Points
- 12:20How can we abuse this
- 15:55DHCP DNS Spoofing
- 19:02Two Types of DNS Records
- 20:43Manage Record Overwrite
- 21:53Impact of Overwrite
- 22:52Target Client Records
- 23:42DHCP Self Override
- 25:05DC Override
- 26:42Demo
- 29:51Impact
- 30:47What Can We Do With This
- 31:40Name Protection
- 33:49Caveats
- 35:23Summary
- 37:18New tools
related talks
38mHi! My Name Is [What?]: Abusing DHCP To Spoof DNS Records
47mDNS On Fire
37mThreat Hunting in Active Directory Environment
27mDHCPwned: Owning Cameras One Lease at a Time
40mAll Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
49mThe Remote Malicious Butler Did It!