rapid7/metasploit-framework — pull request #2185 by bmerinofe (2013-08-02 12:09:57+00:00)
Title: Post-exploitation module to dump the dns cache entries.

The module dump the dns cache (domain and type) by using the DnsGetCacheDataTable API (dnsapi.dll).
One interesting thing I noticed in Windows 7 is that even if the TTL of the entry has expired you can still see the domain by using this API (which would not be shown by running: ipconfig /displaydns).
To completely erase the cache you need to run ipconfig / flushdns

Example:

msf post(dnscache_dump) > run

[*] DNS Cached Entries
==================

TYPE DOMAIN
---- ------
0001 localhost
0001 www.rapid7.com
0001 www.metasploit.com
0001 client.openvpn.net
0005 www.shelliscoming.com
000c 2.0.94.127.in-addr.arpa
000c 1.0.94.127.in-addr.arpa
000c 1.0.0.127.in-addr.arpa