DHCP DISCOVERY

# 1. 定义伪造的 MAC 地址
my_mac = "00:11:22:33:44:55"
my_mac_bytes = b'\x00\x11\x22\x33\x44\x55'

# 2. 构造 BOOTP 必须的 16字节 chaddr (MAC 6字节 + 填充 10字节)
chaddr_pad = my_mac_bytes + b'\x00' * 10

# 3. 生成一个随机事务 ID (XID)
import random
my_xid = random.randint(1, 900000000)
print(f"我的事务ID: {hex(my_xid)}")

#==========================================================

discover = Ether(src=my_mac, dst="ff:ff:ff:ff:ff:ff") / \
           IP(src="0.0.0.0", dst="255.255.255.255") / \
           UDP(sport=68, dport=67) / \
           BOOTP(chaddr=chaddr_pad, xid=my_xid) / \
           DHCP(options=[("message-type", "discover"), "end"])

# 发送 Discover
sendp(discover, iface="eth0", verbose=0)
print("Discover 已发送")

# 捕获 Offer
print("等待 Offer...")
offer = sniff(iface="eth0", filter="udp port 67", count=1, timeout=5)
p_offer = offer[0]
my_ip = p_offer[BOOTP].yiaddr
server_id = p_offer[IP].src
    
print(f"Offer 收到: IP={my_ip}, Server={server_id}")

#==========================================================
 
# 发送 Request
request = Ether(src=my_mac, dst="ff:ff:ff:ff:ff:ff") / \
IP(src="0.0.0.0", dst="255.255.255.255") / \
UDP(sport=68, dport=67) / \
BOOTP(chaddr=chaddr_pad, xid=my_xid) / \
DHCP(options=[("message-type", "request"), 
("server_id", server_id), 
("requested_addr", my_ip), 
"end"])
    
sendp(request, iface="eth0", verbose=0)
print("Request 已发送")
  
# 捕获 Ack
print("等待 Ack...")
ack = sniff(iface="eth0", filter="udp port 67", count=1, timeout=5)
print(f"✅ 成功获得 IP: {my_ip}")