Hi! My Name Is [What?]: Abusing DHCP To Spoof DNS Records
summary
Demonstrates an unauthenticated route to create and overwrite Active Directory DNS records by sending an FQDN via a custom DHCP client utility so the DHCP server issues the DNS dynamic update; demos successfully create fake names, overwrite managed records, and — using an NTLM relay chain — achieve DC-arbitration to hijack domain names. Observed 40% of monitored networks run Microsoft DHCP and ~57% of those have a DC on the DHCP host, making the exploit practical; mitigations: disable dynamic updates, enable name protection or use dedicated DNS credentials.
AI-written summary · about
chapters (17)
- 0:00Research introduction
- 1:28DNS attacker targets
- 3:38Dynamic DNS in AD
- 8:55Live DHCP DNS spoof
- 12:33Previous DNS spoof limits
- 15:51Introducing DHCP DNS spoof
- 18:37DNS record ACLs
- 20:26Overwrite managed DNS records
- 22:56Overwrite client DNS records
- 23:41Self-overwrite DHCP attack
- 26:28DC DNS overwrite impact
- 27:57Live NTLM relay via DNS
- 30:06Real-world attack scenarios
- 31:56Name Protection limits
- 34:26Weak credentials for DNS updates
- 35:32Attacks and mitigations summary
- 36:36Microsoft response
related talks
40mOff The Record - Weaponizing DHCP DNS Dynamic Updates
47mDNS On Fire
26mMisuse of DNS, the Second Most Used Protocol
43mBlock DNS exfiltration with dnsmasq proxy
34mPractical Steps for Reducing Exposure and Detecting Compromise
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field