Retry in progress
You have 1 previous attempt for this scenario. Submitting again will create a new attempt and show a comparison against your most recent response.
Rogue DHCP MITMDifficulty · easyHigh asset
Three contractors on the guest VLAN reported they were redirected to what looked like our M365 SSO page when opening a browser. Two of them entered credentials before the page redirected them to office.com.
NOC noticed an extra DHCP server on the guest VLAN. The legitimate DHCP server (10.50.0.10) is still running, but a second OFFER is also being seen from an unknown MAC behind ACCESS-SW-21 port Gi1/0/14 — which is a public-area conference room jack.
Please coordinate with NOC on this. The capture window is still active.
— Helpdesk + NOC
Evidence
DHCP server log + switch MAC table + sign-in log
# Legitimate DHCP server (10.50.0.10) — guest VLAN scope
... 4 OFFERS in last 5 min from this server ...
# tcpdump on guest VLAN trunk (mirror)
14:11:03 DHCP OFFER src=10.30.99.250 (mac=aabb.cc11.2233) yiaddr=10.30.99.114 router=10.30.99.250
14:11:04 DHCP OFFER src=10.30.99.1 (mac=001e.bc55.aaaa) yiaddr=10.30.99.114 router=10.30.99.1
^^ rogue gateway pointing clients at attacker host
ACCESS-SW-21#show mac address-table | include aabb.cc11.2233
aabb.cc11.2233 DYNAMIC Gi1/0/14 VLAN 99
# Web proxy (one of the two contractors)
14:11:18 GET https://acme-sso-login[.]net/auth?u=jdoe-c 200 (TLS, cert: Let's Encrypt, 4d old)
14:11:42 POST https://acme-sso-login[.]net/auth/submit 302
14:11:43 GET https://office.com/ 200
# Entra sign-in
14:12:02 SUCCESS user=jdoe-c@acme-corp.com IP=185.244.25.17 (NL, hosting) UA="python-requests/2.31"Affected asset
- Name
- Guest VLAN 99 + 2 contractor accounts
- Type
- Layer-2 segment + user credentials likely captured
- Owner
- Network Operations · Facilities
- Level
- High