TunnelVision DHCP Option 121 VPN Traffic Bypass

This repository provides a comprehensive exploit toolkit for CVE-2024-3661, targeting DHCP clients in a local network environment. The main exploit (dhcp_middle_attack.py) is a Python script that intercepts DHCP traffic using NetfilterQueue and Scapy, injecting malicious DHCP Option 121 (classless static routes) to force the victim to route traffic through the attacker's machine. The script requires ARP spoofing and specific iptables rules to be set up, and is designed for use in a MITM (Man-in-the-Middle) scenario. The dhcp_rogue.sh script automates the setup of a rogue DHCP server using isc-dhcp-server, configuring it to assign the attacker's IP as the default gateway and inject custom routes (including to 192.168.56.104/32 and 0.0.0.0/0) via DHCP options 121 and 249. This enables the attacker to control the victim's network routing and intercept or manipulate their traffic. Additional scripts (setup_forward.sh, setup_vpn_client.sh, setup_vpn_http_server.sh) facilitate the attack by configuring IP forwarding, NAT, VPN client/server, and an HTTP server with a CGI login endpoint. These components allow the attacker to further exploit the victim by redirecting their traffic through a VPN or capturing credentials via a fake HTTP login page. The repository is structured as a set of operational scripts (Python and Bash) that together enable a full MITM attack chain: from rogue DHCP server setup, to network traffic interception, to further exploitation via VPN and HTTP services. The exploit is operational and requires significant attacker control over the local network, but provides a powerful method for redirecting and capturing victim traffic.