full-disclosure - Re: DNS Cache Dan Kamikaze (Actual Exploit Discussion)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 14 Jul 2008 01:01:16 -0400
From: Valdis.Kletnieks@...edu
To: "eugaaa@...il.com" <eugaaa@...il.com>
Cc: full-disclosure@...ts.grok.org.uk,
	Paul Schmehl <pschmehl_lists_nada@...rr.com>
Subject: Re: DNS Cache Dan Kamikaze (Actual Exploit
	Discussion)

On Sun, 13 Jul 2008 23:30:21 CDT, "eugaaa@...il.com" said:

> And in the case of recursion, assuming the nameservers are recursive
> it will hit the root and fly downward looking for the zone's

Note that the TLD nameservers in general won't recurse - so if you're
trying to look up www.example.com, all the .com server will return is
an SOA/NS set and *your* nameserver then gets to chase the NS down and
ask it, and so on.  For a "recursive" lookup, it's pretty damned iterative :)

(Hint - If you're looking up www.foo.bar.example.com, and example.com
sets its SOA's up right, the .com will give back a first NS saying where
to find example.com - and then you can make it hit the *same* server getting
an NS for bar.example.com, and then an NS foo.bar.example.com, and finally
an A/MX/whatever for www.foo.bar.example.com.  Now make it a contrived name
that has several hundred levels a.b.c.a.b.c.a.b.c and you have a nice way
to introspect the sending nameserver's internal state. ;)

> authoritative nameserver. The exploitation must happen here - a way to
> become the authoritative nameserver. Am I wrong?

You actually don't care if you become the authoritative nameserver. The actual
goal is to have the victim nameserver accept poisoned data as if it came
from the authoritative source.  The difference is subtle, but *very* important.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/