Lucene search

K
nmapPatrik KarlssonNMAP:DNS-CHECK-ZONE.NSE
HistoryApr 21, 2012 - 10:28 p.m.

dns-check-zone NSE Script

2012-04-2122:28:30
Patrik Karlsson
nmap.org
81

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.8%

Checks DNS zone configuration against best practices, including RFC 1912. The configuration checks are divided into categories which each have a number of different tests.

Script Arguments

dns-check-zone.domain

the dns zone to check

Example Usage

nmap -sn -Pn ns1.example.com --script dns-check-zone --script-args='dns-check-zone.domain=example.com'

Script Output

| dns-check-zone:
| DNS check results for domain: example.com
|   SOA
|     PASS - SOA REFRESH
|       SOA REFRESH was within recommended range (7200s)
|     PASS - SOA RETRY
|       SOA RETRY was within recommended range (3600s)
|     PASS - SOA EXPIRE
|       SOA EXPIRE was within recommended range (1209600s)
|     FAIL - SOA MNAME entry check
|       SOA MNAME record is NOT listed as DNS server
|     PASS - Zone serial numbers
|       Zone serials match
|   MX
|     ERROR - Reverse MX A records
|       Failed to retrieve list of mail servers
|   NS
|     PASS - Recursive queries
|       None of the servers allow recursive queries.
|     PASS - Multiple name servers
|       Server has 2 name servers
|     PASS - DNS name server IPs are public
|       All DNS IPs were public
|     PASS - DNS server response
|       All servers respond to DNS queries
|     PASS - Missing nameservers reported by parent
|       All DNS servers match
|     PASS - Missing nameservers reported by your nameservers
|_      All DNS servers match

Requires


local dns = require "dns"
local stdnse = require "stdnse"
local table = require "table"
local ipOps = require "ipOps"

description = [[
Checks DNS zone configuration against best practices, including RFC 1912.
The configuration checks are divided into categories which each have a number
of different tests.
]]

---
-- @usage
-- nmap -sn -Pn ns1.example.com --script dns-check-zone --script-args='dns-check-zone.domain=example.com'
--
-- @output
-- | dns-check-zone:
-- | DNS check results for domain: example.com
-- |   SOA
-- |     PASS - SOA REFRESH
-- |       SOA REFRESH was within recommended range (7200s)
-- |     PASS - SOA RETRY
-- |       SOA RETRY was within recommended range (3600s)
-- |     PASS - SOA EXPIRE
-- |       SOA EXPIRE was within recommended range (1209600s)
-- |     FAIL - SOA MNAME entry check
-- |       SOA MNAME record is NOT listed as DNS server
-- |     PASS - Zone serial numbers
-- |       Zone serials match
-- |   MX
-- |     ERROR - Reverse MX A records
-- |       Failed to retrieve list of mail servers
-- |   NS
-- |     PASS - Recursive queries
-- |       None of the servers allow recursive queries.
-- |     PASS - Multiple name servers
-- |       Server has 2 name servers
-- |     PASS - DNS name server IPs are public
-- |       All DNS IPs were public
-- |     PASS - DNS server response
-- |       All servers respond to DNS queries
-- |     PASS - Missing nameservers reported by parent
-- |       All DNS servers match
-- |     PASS - Missing nameservers reported by your nameservers
-- |_      All DNS servers match
--
-- @args dns-check-zone.domain the dns zone to check
--

author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe", "external"}

local arg_domain = stdnse.get_script_args(SCRIPT_NAME .. '.domain')


hostrule = function(host) return ( arg_domain ~= nil ) end

local PROBE_HOST = "scanme.nmap.org"

local Status = {
  PASS = "PASS",
  FAIL = "FAIL",
}

local function isValidSOA(res)
  if ( not(res) or type(res.answers) ~= "table" or type(res.answers[1].SOA) ~= "table" ) then
    return false
  end
  return true
end

local dns_checks = {

  ["NS"] = {
    {
      desc = "Recursive queries",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='NS', retAll = true })
        local result = {}

        if ( not(status) ) then
          return false, "Failed to retrieve list of DNS servers"
        end
        for _, srv in ipairs(res or {}) do
          local status, res = dns.query(PROBE_HOST, { host = srv, dtype='A' })
          if ( status ) then
            table.insert(result, res)
          end
        end

        local output = "None of the servers allow recursive queries."
        if ( 0 < #result ) then
          output = ("The following servers allow recursive queries: %s"):format(table.concat(result, ", "))
          return true, { status = Status.FAIL, output = output }
        end
        return true, { status = Status.PASS, output = output }
      end
    },

    {
      desc = "Multiple name servers",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='NS', retAll = true })

        if ( not(status) ) then
          return false, "Failed to retrieve list of DNS servers"
        end

        local status = Status.FAIL
        if ( 1 < #res ) then
          status = Status.PASS
        end
        return true, { status = status, output = ("Server has %d name servers"):format(#res) }
      end
    },

    {
      desc = "DNS name server IPs are public",
      func = function(domain, server)

        local status, res = dns.query(domain, { host = server, dtype='NS', retAll = true })
        if ( not(status) ) then
          return false, "Failed to retrieve list of DNS servers"
        end

        local result = {}
        for _, srv in ipairs(res or {}) do
          local status, res = dns.query(srv, { dtype='A', retAll = true })
          if ( not(status) ) then
            return false, ("Failed to retrieve IP for DNS: %s"):format(srv)
          end
          for _, ip in ipairs(res) do
            if ( ipOps.isPrivate(ip) ) then
              table.insert(result, ip)
            end
          end
        end

        local output = "All DNS IPs were public"
        if ( 0 < #result ) then
          output = ("The following private IPs were detected: %s"):format(table.concat(result, ", "))
          status = Status.FAIL
        else
          status = Status.PASS
        end

        return true, { status = status, output = output }
      end
    },

    {
      desc = "DNS server response",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='NS', retAll = true })
        if ( not(status) ) then
          return false, "Failed to retrieve list of DNS servers"
        end

        local result = {}
        for _, srv in ipairs(res or {}) do
          local status, res = dns.query(domain, { host = srv, dtype='SOA', retPkt = true })
          if ( not(status) ) then
            table.insert(result, res)
          end
        end

        local output = "All servers respond to DNS queries"
        if ( 0 < #result ) then
          output = ("The following servers did not respond to DNS queries: %s"):format(table.concat(result, ", "))
          return true, { status = Status.FAIL, output = output }
        end
        return true, { status = Status.PASS, output = output }
      end
    },

    {
      desc = "Missing nameservers reported by parent",
      func = function(domain, server)
        local tld = domain:match("%.(.*)$")
        local status, res = dns.query(tld, { dtype = "NS", retAll = true })
        if ( not(status) ) then
          return false, "Failed to retrieve list of TLD DNS servers"
        end

        local status, parent_res = dns.query(domain, { host = res, dtype = "NS", retAll = true, retPkt = true, noauth = true } )
        if ( not(status) ) then
          return false, "Failed to retrieve a list of parent DNS servers"
        end

        if ( not(status) or not(parent_res) or type(parent_res.auth) ~= "table"  ) then
          return false, "Failed to retrieve a list of parent DNS servers"
        end

        local parent_dns = {}
        for _, auth in ipairs(parent_res.auth) do
          parent_dns[auth.domain] = true
        end

        status, res = dns.query(domain, { host = server, dtype = "NS", retAll = true } )
        if ( not(status) ) then
          return false, "Failed to retrieve a list of DNS servers"
        end

        local domain_dns = {}
        for _,srv in ipairs(res) do domain_dns[srv] = true end

        local result = {}
        for srv in pairs(domain_dns) do
          if ( not(parent_dns[srv]) ) then
            table.insert(result, srv)
          end
        end

        if ( 0 < #result ) then
          local output = ("The following servers were found in the zone, but not in the parent: %s"):format(table.concat(result, ", "))
          return true, { status = Status.FAIL, output = output }
        end

        return true, { status = Status.PASS, output = "All DNS servers match" }
      end,
    },


    {
      desc = "Missing nameservers reported by your nameservers",
      func = function(domain, server)
        local tld = domain:match("%.(.*)$")
        local status, res = dns.query(tld, { dtype = "NS", retAll = true })
        if ( not(status) ) then
          return false, "Failed to retrieve list of TLD DNS servers"
        end

        local status, parent_res = dns.query(domain, { host = res, dtype = "NS", retAll = true, retPkt = true, noauth = true } )
        if ( not(status) ) then
          return false, "Failed to retrieve a list of parent DNS servers"
        end

        if ( not(status) or not(parent_res) or type(parent_res.auth) ~= "table"  ) then
          return false, "Failed to retrieve a list of parent DNS servers"
        end

        local parent_dns = {}
        for _, auth in ipairs(parent_res.auth) do
          parent_dns[auth.domain] = true
        end

        status, res = dns.query(domain, { host = server, dtype = "NS", retAll = true } )
        if ( not(status) ) then
          return false, "Failed to retrieve a list of DNS servers"
        end

        local domain_dns = {}
        for _,srv in ipairs(res) do  domain_dns[srv] = true end

        local result = {}
        for srv in pairs(parent_dns) do
          if ( not(domain_dns[srv]) ) then
            table.insert(result, srv)
          end
        end

        if ( 0 < #result ) then
          local output = ("The following servers were found in the parent, but not in the zone: %s"):format(table.concat(result, ", "))
          return true, { status = Status.FAIL, output = output }
        end

        return true, { status = Status.PASS, output = "All DNS servers match" }
      end,
    },

  },

  ["SOA"] =
  {
    {
      desc = "SOA REFRESH",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='SOA', retPkt=true })
        if ( not(status) or not(isValidSOA(res)) ) then
          return false, "Failed to retrieve SOA record"
        end

        local refresh = tonumber(res.answers[1].SOA.refresh)
        if ( not(refresh) ) then
          return false, "Failed to retrieve SOA REFRESH"
        end

        if ( refresh < 1200 or refresh > 43200 ) then
          return true, { status = Status.FAIL, output = ("SOA REFRESH was NOT within recommended range (%ss)"):format(refresh) }
        else
          return true, { status = Status.PASS, output = ("SOA REFRESH was within recommended range (%ss)"):format(refresh) }
        end
      end
    },

    {
      desc = "SOA RETRY",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='SOA', retPkt=true })
        if ( not(status) or not(isValidSOA(res)) ) then
          return false, "Failed to retrieve SOA record"
        end

        local retry = tonumber(res.answers[1].SOA.retry)
        if ( not(retry) ) then
          return false, "Failed to retrieve SOA RETRY"
        end

        if ( retry < 180 ) then
          return true, { status = Status.FAIL, output = ("SOA RETRY was NOT within recommended range (%ss)"):format(retry) }
        else
          return true, { status = Status.PASS, output = ("SOA RETRY was within recommended range (%ss)"):format(retry) }
        end
      end
    },

    {
      desc = "SOA EXPIRE",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='SOA', retPkt=true })
        if ( not(status) or not(isValidSOA(res)) ) then
          return false, "Failed to retrieve SOA record"
        end

        local expire = tonumber(res.answers[1].SOA.expire)
        if ( not(expire) ) then
          return false, "Failed to retrieve SOA EXPIRE"
        end

        if ( expire < 1209600 or expire > 2419200 ) then
          return true, { status = Status.FAIL, output = ("SOA EXPIRE was NOT within recommended range (%ss)"):format(expire) }
        else
          return true, { status = Status.PASS, output = ("SOA EXPIRE was within recommended range (%ss)"):format(expire) }
        end
      end
    },

    {
      desc = "SOA MNAME entry check",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='SOA', retPkt=true })
        if ( not(status) or not(isValidSOA(res)) ) then
          return false, "Failed to retrieve SOA record"
        end
        local mname = res.answers[1].SOA.mname

        status, res = dns.query(domain, { host = server, dtype='NS', retAll = true })
        if ( not(status) ) then
          return false, "Failed to retrieve list of DNS servers"
        end

        for _, srv in ipairs(res or {}) do
          if ( srv == mname ) then
            return true, { status = Status.PASS, output = "SOA MNAME record is listed as DNS server" }
          end
        end
        return true, { status = Status.FAIL, output = "SOA MNAME record is NOT listed as DNS server" }
      end
    },

    {
      desc = "Zone serial numbers",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='NS', retAll = true })
        if ( not(status) ) then
          return false, "Failed to retrieve list of DNS servers"
        end

        local result = {}
        local serial

        for _, srv in ipairs(res or {}) do
          local status, res = dns.query(domain, { host = srv, dtype='SOA', retPkt = true })
          if ( not(status) or not(isValidSOA(res)) ) then
            return false, "Failed to retrieve SOA record"
          end

          local s = res.answers[1].SOA.serial
          if ( not(serial) ) then
            serial = s
          elseif( serial ~= s ) then
            return true, { status = Status.FAIL, output = "Different zone serials were detected" }
          end
        end

        return true, { status = Status.PASS, output = "Zone serials match" }
      end,
    },
  },

  ["MX"] = {

    {
      desc = "Reverse MX A records",
      func = function(domain, server)
        local status, res = dns.query(domain, { host = server, dtype='MX', retAll = true })
        if ( not(status) ) then
          return false, "Failed to retrieve list of mail servers"
        end

        local result = {}
        for _, record in ipairs(res or {}) do
          local prio, mx = record:match("^(%d*):([^:]*)")
          local ips
          status, ips = dns.query(mx, { dtype='A', retAll=true })
          if ( not(status) ) then
            return false, "Failed to retrieve A records for MX"
          end

          for _, ip in ipairs(ips) do
            local status, res = dns.query(dns.reverse(ip), { dtype='PTR' })
            if ( not(status) ) then
              table.insert(result, ip)
            end
          end
        end

        local output = "All MX records have PTR records"
        if ( 0 < #result ) then
          output = ("The following IPs do not have PTR records: %s"):format(table.concat(result, ", "))
          return true, { status = Status.FAIL, output = output }
        end
        return true, { status = Status.PASS, output = output }
      end
    },

  }
}

action = function(host, port)
  local server = host.ip
  local output = { name = ("DNS check results for domain: %s"):format(arg_domain) }

  for group in pairs(dns_checks) do
    local group_output = { name = group }
    for _, check in ipairs(dns_checks[group]) do
      local status, res = check.func(arg_domain, server)
      if ( status ) then
        local test_res = ("%s - %s"):format(res.status, check.desc)
        table.insert(group_output, { name = test_res, res.output })
      else
        local test_res = ("ERROR - %s"):format(check.desc)
        table.insert(group_output, { name = test_res, res })
      end
    end
    table.insert(output, group_output)
  end
  return stdnse.format_output(true, output)
end

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.8%

Related for NMAP:DNS-CHECK-ZONE.NSE