任务二 DHCP欺骗劫持与防御策略
一、任务目的
掌握DHCP的欺骗原理与DHCP监听配置
二、任务设备、设施
Win10、华为ENSP、VMware、Win7、Typora
三、任务拓扑结构图
四、基本配置
1.接口IP与默认路由配置
(1)R1
<Huawei>system-view
[Huawei]sysname R1
[R1]undo info-center enable
[R1]interface GigabitEthernet 0/0/0
[R1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[R1-GigabitEthernet0/0/0]quit
[R1]interface GigabitEthernet 0/0/1
[R1-GigabitEthernet0/0/1]ip address 192.168.2.1 24
[R1-GigabitEthernet0/0/1]quit
[R1]rip 1
[R1-rip-1]version 2
[R1-rip-1]network 192.168.1.0
[R1-rip-1]network 192.168.2.0
[R1-rip-1]quit
[R1]ip route-static 0.0.0.0 0.0.0.0 192.168.2.2
(2)R2
<Huawei>system-view
[Huawei]sysname R2
[R2]undo info-center enable
[R2]interface GigabitEthernet 0/0/1
[R2-GigabitEthernet0/0/1]ip address 172.16.1.1 24
[R2-GigabitEthernet0/0/1]quit
[R2]interface GigabitEthernet 0/0/0
[R2-GigabitEthernet0/0/0]ip address 192.168.2.2 24
[R2-GigabitEthernet0/0/0]quit
[R2]interface Serial 2/0/0
[R2-Serial2/0/0]ip address 202.116.64.1 24
[R2-Serial2/0/0]quit
[R2]rip 1
[R2-rip-1]version 2
[R2-rip-1]network 192.168.2.0
[R2-rip-1]network 172.16.0.0
[R2-rip-1]quit
[R2]ip route-static 0.0.0.0 0.0.0.0 Serial 2/0/0
(3)R3
<Huawei>system-view
[Huawei]sysname R3
[R3]undo info-center enable
[R3]interface Serial 2/0/0
[R3-Serial2/0/0]ip address 202.116.64.2 24
[R3-Serial2/0/0]quit
[R3]interface GigabitEthernet 0/0/0
[R3-GigabitEthernet0/0/0]ip address 203.203.100.1 24
[R3-GigabitEthernet0/0/0]quit
2.路由器R2 Easy-IP设置
[R2]acl 2000
[R2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R2-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255
[R2-acl-basic-2000]rule permit source 172.16.1.0 0.0.0.255
[R2-acl-basic-2000]quit
[R2]interface Serial 2/0/0
[R2-Serial2/0/0]nat outbound 2000
[R2-Serial2/0/0]quit
3.配置R2路由器DHCP服务,给技术部和工程部主机分配IP地址
(1)R2
[R2]dhcp enable
[R2]ip pool jishu
[R2-ip-pool-jishu]network 192.168.1.0 mask 24
[R2-ip-pool-jishu]gateway-list 192.168.1.1
[R2-ip-pool-jishu]dns-list 192.168.2.254
[R2-ip-pool-jishu]excluded-ip-address 192.168.1.2 192.168.1.9
[R2-ip-pool-jishu]quit
[R2]ip pool gongcheng
[R2-ip-pool-gongcheng]network 172.16.1.0 mask 24
[R2-ip-pool-gongcheng]gateway-list 172.16.1.1
[R2-ip-pool-gongcheng]dns-list 192.168.2.254
[R2-ip-pool-gongcheng]excluded-ip-address 172.16.1.2 172.16.1.9
[R2-ip-pool-gongcheng]quit
[R2]interface GigabitEthernet 0/0/0
[R2-GigabitEthernet0/0/0]dhcp select global
[R2-GigabitEthernet0/0/0]quit
[R2]interface GigabitEthernet 0/0/1
[R2-GigabitEthernet0/0/1]dhcp select global
[R2-GigabitEthernet0/0/1]quit
(2)R1
[R1]dhcp enable [R1]interface GigabitEthernet 0/0/0 [R1-GigabitEthernet0/0/0]dhcp select relay [R1-GigabitEthernet0/0/0]dhcp relay server-ip 192.168.2.2 [R1-GigabitEthernet0/0/0]quit
4.配置百度服务器HttpServer
5.配置DNS Server
6.基本配置验证
(1)PC2
(2)PC1
五、入侵实战
1.网络拓扑结构图
2.伪造DHCP服务器R4配置
<Huawei>system-view
[Huawei]sysname R4
[R4]interface GigabitEthernet 0/0/0
[R4-GigabitEthernet0/0/0]ip address 192.168.1.9 24
[R4-GigabitEthernet0/0/0]quit
[R4]undo info-center enable
[R4]dhcp enable
[R4]ip pool forget
[R4-ip-pool-forget]network 192.168.1.0 mask 24
[R4-ip-pool-forget]gateway-list 192.168.1.1
[R4-ip-pool-forget]dns-list 192.168.1.8
[R4-ip-pool-forget]quit
[R4]interface GigabitEthernet 0/0/0
[R4-GigabitEthernet0/0/0]dhcp select global
[R4-GigabitEthernet0/0/0]quit
3.伪造DNS服务器配置
4.验证入侵结果
六、防御策略
1、交换机SW1的配置
<Huawei>system-view
[Huawei]sysname SW1
[SW1]undo info-center enable
[SW1]dhcp enable
[SW1]dhcp snooping enable
[SW1]dhcp snooping enable vlan 1
[SW1]interface GigabitEthernet 0/0/3
[SW1-GigabitEthernet0/0/3]dhcp snooping trusted
[SW1-GigabitEthernet0/0/3]quit
2.任务验证
(1)IP地址更新
(2)DNS服务器更新
七、任务总结
(1)启用DHCP监听功能的前提是开启DHCP服务
(2)在路由器上可以开启DHCP服务,但是无法启用DHCP监听功能,只有在交换机上才可以启用DHCP监听功能
(3)如果在DHCP监听区域含多个Vlan,命令如dhcp snooping enable vlan 10 20 30。如果Vlan连续,命令如dhcp snooping enable vlan 1 to 5。
(4)计算机DNS缓存不会立刻刷新,需等待一段时长,如需手动刷新,可运行命令为ipconfig/flushdns。
(5)DHCP欺骗劫持不属于病毒木马,不能通过安装防病毒软件达到防范效果。
n,命令如dhcp snooping enable vlan 10 20 30。如果Vlan连续,命令如dhcp snooping enable vlan 1 to 5。**
(4)计算机DNS缓存不会立刻刷新,需等待一段时长,如需手动刷新,可运行命令为ipconfig/flushdns。
(5)DHCP欺骗劫持不属于病毒木马,不能通过安装防病毒软件达到防范效果。