任务二 DHCP欺骗劫持与防御策略

任务二 DHCP欺骗劫持与防御策略

一、任务目的

掌握DHCP的欺骗原理与DHCP监听配置

二、任务设备、设施

Win10、华为ENSP、VMware、Win7、Typora

三、任务拓扑结构图

四、基本配置

1.接口IP与默认路由配置

（1）R1

<Huawei>system-view

[Huawei]sysname R1
[R1]undo info-center enable
[R1]interface GigabitEthernet 0/0/0
[R1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[R1-GigabitEthernet0/0/0]quit
[R1]interface GigabitEthernet 0/0/1
[R1-GigabitEthernet0/0/1]ip address 192.168.2.1 24
[R1-GigabitEthernet0/0/1]quit
[R1]rip 1
[R1-rip-1]version 2
[R1-rip-1]network 192.168.1.0
[R1-rip-1]network 192.168.2.0
[R1-rip-1]quit
[R1]ip route-static 0.0.0.0 0.0.0.0 192.168.2.2

（2）R2

<Huawei>system-view

[Huawei]sysname R2
[R2]undo info-center enable
[R2]interface GigabitEthernet 0/0/1
[R2-GigabitEthernet0/0/1]ip address 172.16.1.1 24
[R2-GigabitEthernet0/0/1]quit
[R2]interface GigabitEthernet 0/0/0
[R2-GigabitEthernet0/0/0]ip address 192.168.2.2 24
[R2-GigabitEthernet0/0/0]quit
[R2]interface Serial 2/0/0
[R2-Serial2/0/0]ip address 202.116.64.1 24
[R2-Serial2/0/0]quit
[R2]rip 1
[R2-rip-1]version 2
[R2-rip-1]network 192.168.2.0
[R2-rip-1]network 172.16.0.0
[R2-rip-1]quit
[R2]ip route-static 0.0.0.0 0.0.0.0 Serial 2/0/0

(3)R3

<Huawei>system-view
[Huawei]sysname R3
[R3]undo info-center enable
[R3]interface Serial 2/0/0
[R3-Serial2/0/0]ip address 202.116.64.2 24
[R3-Serial2/0/0]quit
[R3]interface GigabitEthernet 0/0/0
[R3-GigabitEthernet0/0/0]ip address 203.203.100.1 24
[R3-GigabitEthernet0/0/0]quit

2.路由器R2 Easy-IP设置

[R2]acl 2000
[R2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R2-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255
[R2-acl-basic-2000]rule permit source 172.16.1.0 0.0.0.255
[R2-acl-basic-2000]quit
[R2]interface Serial 2/0/0
[R2-Serial2/0/0]nat outbound 2000
[R2-Serial2/0/0]quit

3.配置R2路由器DHCP服务，给技术部和工程部主机分配IP地址

（1）R2

[R2]dhcp enable
[R2]ip pool jishu
[R2-ip-pool-jishu]network 192.168.1.0 mask 24
[R2-ip-pool-jishu]gateway-list 192.168.1.1
[R2-ip-pool-jishu]dns-list 192.168.2.254
[R2-ip-pool-jishu]excluded-ip-address 192.168.1.2 192.168.1.9
[R2-ip-pool-jishu]quit
[R2]ip pool gongcheng
[R2-ip-pool-gongcheng]network 172.16.1.0 mask 24
[R2-ip-pool-gongcheng]gateway-list 172.16.1.1
[R2-ip-pool-gongcheng]dns-list 192.168.2.254
[R2-ip-pool-gongcheng]excluded-ip-address 172.16.1.2 172.16.1.9
[R2-ip-pool-gongcheng]quit
[R2]interface GigabitEthernet 0/0/0
[R2-GigabitEthernet0/0/0]dhcp select global
[R2-GigabitEthernet0/0/0]quit
[R2]interface GigabitEthernet 0/0/1
[R2-GigabitEthernet0/0/1]dhcp select global
[R2-GigabitEthernet0/0/1]quit

（2）R1

[R1]dhcp enable [R1]interface GigabitEthernet 0/0/0 [R1-GigabitEthernet0/0/0]dhcp select relay [R1-GigabitEthernet0/0/0]dhcp relay server-ip 192.168.2.2 [R1-GigabitEthernet0/0/0]quit

4.配置百度服务器HttpServer

5.配置DNS Server

6.基本配置验证

（1）PC2

（2）PC1

五、入侵实战

1.网络拓扑结构图

2.伪造DHCP服务器R4配置

<Huawei>system-view 
[Huawei]sysname R4
[R4]interface GigabitEthernet 0/0/0
[R4-GigabitEthernet0/0/0]ip address 192.168.1.9 24
[R4-GigabitEthernet0/0/0]quit 
[R4]undo info-center enable 
[R4]dhcp enable 
[R4]ip pool forget
[R4-ip-pool-forget]network 192.168.1.0 mask 24
[R4-ip-pool-forget]gateway-list 192.168.1.1
[R4-ip-pool-forget]dns-list 192.168.1.8
[R4-ip-pool-forget]quit 
[R4]interface GigabitEthernet 0/0/0
[R4-GigabitEthernet0/0/0]dhcp select global 
[R4-GigabitEthernet0/0/0]quit 

3.伪造DNS服务器配置

4.验证入侵结果

六、防御策略

1、交换机SW1的配置

<Huawei>system-view 
[Huawei]sysname SW1
[SW1]undo info-center enable 
[SW1]dhcp enable 
[SW1]dhcp snooping enable 
[SW1]dhcp snooping enable vlan 1
[SW1]interface GigabitEthernet 0/0/3
[SW1-GigabitEthernet0/0/3]dhcp snooping trusted
[SW1-GigabitEthernet0/0/3]quit 

2.任务验证

(1)IP地址更新

(2)DNS服务器更新

七、任务总结

（1）启用DHCP监听功能的前提是开启DHCP服务

（2）在路由器上可以开启DHCP服务，但是无法启用DHCP监听功能，只有在交换机上才可以启用DHCP监听功能

（3）如果在DHCP监听区域含多个Vlan，命令如dhcp snooping enable vlan 10 20 30。如果Vlan连续，命令如dhcp snooping enable vlan 1 to 5。

（4）计算机DNS缓存不会立刻刷新，需等待一段时长，如需手动刷新，可运行命令为ipconfig/flushdns。

（5）DHCP欺骗劫持不属于病毒木马，不能通过安装防病毒软件达到防范效果。

n，命令如dhcp snooping enable vlan 10 20 30。如果Vlan连续，命令如dhcp snooping enable vlan 1 to 5。**

（4）计算机DNS缓存不会立刻刷新，需等待一段时长，如需手动刷新，可运行命令为ipconfig/flushdns。

（5）DHCP欺骗劫持不属于病毒木马，不能通过安装防病毒软件达到防范效果。