DHCP

In this challenge, I hosted a second DHCP server on the network.

This really wasn't that fancy and could've been done better, the challenge description just read "Repeatedly inform yourself about vendor information of DHCP servers running on this network."

All the server did was listen for DHCPINFORM broadcast-messages which asked for VendorSpecificInformation

The server then replied with a DHCP message containing fragments of the flag inside the option for vendor specific information.

Forging your message like this suffices:

msg->op = dhcp::BOOTREPLY;
msg->htype = dhcp::HardwareType::Ethernet10Mb;
msg->hlen = 0;
msg->hops = 0;
msg->xid = (rand() << 16) + rand();
msg->secs = 0;
msg->flags = FLAG_BROADCAST;
msg->magic = MAGIC_COOKIE;
msg->ciaddr.s_addr = 0;
msg->yiaddr.s_addr = 0;
msg->siaddr.s_addr = 0;
msg->giaddr.s_addr = 0;
memset(msg->chaddr, 0, sizeof(msg->chaddr));
memset(msg->sname, 0, sizeof(msg->sname));
memset(msg->file, 0, sizeof(msg->file));

*msg.append_option(dhcp::Option::DhcpMsgType, 1) = (uint8_t)dhcp::MsgType::DHCPINFORM;

*msg.append_option(dhcp::Option::ParameterList, 1) = (uint8_t)dhcp::Option::ViVendorSpecificInformation;