Extract hosts in DNS Servers that disallow zone transfers.


INTRODUCTION:
-------------

Everybody know that the first step in a attack is recognize the target, in the following sequence:

- List machines that is part of the target.
- Identify services and versions in each of this machines.

It's essential, because if a attacker can't list what machines is part of the target, he doesn't have what to attack.

List machines that is part of the target is very useful to attackers when they intend to attack a network well protected, since the main servers would be hardened and constantly monitored, so if an attacker find machines less important probability he will:

- Find machines that aren't so protected as main servers.
- Find machines less monitored.
- As much more machines a attacker find, big is the chance of find a vulnerability.

In the old and good times attackers used DNS zone transfer to list all machines in a domain they plain to attack, however DNS zone transfers have been more rarely to work because the enhance of security.

Just to illustrate, let's try a DNS zone transfer from microsoft.com:


FatalFury:~/tmp# dig microsoft.com axfr

; <<>> DiG 9.2.3 <<>> microsoft.com axfr
;; global options: printcmd
; Transfer failed.


As we expected to see the DNS Zone transfer failed, however exist a way to extract this hosts, it's called DNS host brute force, which basically brute-force common names of hosts via DNS query and based on response from DNS server it identify if the host exist or not.

To explain in details how it work, let's suppose that an attacker want to list hosts in the domain microsoft.com, so the following steps will be followed:

1) The program open a wordlist of common hostname and read one by one.

2) Each hostname entry in this file will be concatenated with the domain, for example auth.microsoft.com, database.microsoft.com, ftp.microsoft.com, etc.

3) Each one of this FQDN (fully qualified domain name) generated will be requested to the DNS server.

4) DNS server will response to client saying "auth at microsoft.com is a non-existent host", so based in this response the program know that this host doesn't exist.

5) DNS server will response to client saying "database at microsoft.com is a non-existent host", so based in this response the program know that this host doesn't exist.

6) DNS server will response to client saying "ftp at microsoft.com point to IP adrress A.B.C.D", so based in this response the program know that the host exist and have the respective IP address A.B.C.D and save it in the list of found hosts.



THE TOOL OF THE TRADE:
----------------------


To illustrate the use of DNS host brute force we will use a tool called WS-DNS-BFX, that in my opinion is the best since it:

- Is very fast because use multi-threads.
- Support IPv4 and IPv6.
- Extract multiple IPs for unique domains (Domains with Network Load Balance).
- Runs on Linux or Windows with cygwin.

This tool can be downloaded from http://ws.hackaholic.org/tools/WS-DNS-BFX.tgz



INSTALLATION:
-------------


Install is very easy, just untar like this:

FatalFury:~/tmp# tar -xvzf WS-DNS-BFX.tgz
./
./README-pt.txt
./dict-file.txt
./Changelog.txt
./WS-DNS-BFX.c
./README-en.txt
./hosts-yahoo.com.txt
./WS-DNS-BFX-Static



Now, we just need to compile like this:

FatalFury:~/tmp# gcc -o WS-DNS-BFX WS-DNS-BFX.c -lpthread -D_REENTRANT -D_THREAD_SAFE



Let's run the compiled program to test if all worked:

FatalFury:~/tmp# ./WS-DNS-BFX


DNS Brute Force eXtract by: Clube Dos Mercenarios & Front The Scene

URLs: http://cdm.frontthescene.com.br
http://www.frontthescene.com.br

Contact: dum_dum@frontthescene.com.br


USAGE mode:
./WS-DNS-BFX <domain> <brute force file> <simultaneous conn>



USAGE:
------


Now that we have the tool compiled, we will use a syntax like this:

./WS-DNS-BFX microsoft.com dict-file.txt 14


WS-DNS-BFX - is the name of the tool.
microsoft.com - is the domain name we will extract hosts.
dict-file.txt - is a dictionary file contain common host names that is included in the tool.
14 - is the number of parallel threads that will be used.

NOTE: You should create and use a more robust dictionary file to have better results.

NOTE: The number of parallel threads should be choose based in your connection speed, see README-en.txt for more details.

Let's test the tool to see if it really works:

FatalFury:~/tmp# time ./WS-DNS-BFX microsoft.com dict-file.txt 14
Progress ...........


real 0m3.672s
user 0m0.580s
sys 0m1.380s

In my case with 14 parallel connections it probed 361 hosts in less than 4 seconds!

It generated a report file called hosts-microsoft.com.txt, let's check it:

FatalFury:~/tmp# cat hosts-microsoft.com.txt
-= DNS Brute Force eXtract by Clube Dos Mercenarios e Front The Scene =-

www.microsoft.com{
207.46.20.60
207.46.198.30
207.46.198.60
207.46.199.30
207.46.225.60
207.46.19.30
207.46.19.60
207.46.20.30}

mail.microsoft.com{
131.107.1.71
131.107.0.15}

ftp.microsoft.com{
207.46.236.102}

windows.microsoft.com{
207.46.250.115
207.46.130.104}

exec.microsoft.com{
207.46.248.35}

ircs.microsoft.com{
131.107.3.108}

support.microsoft.com{
207.46.248.248}

register.microsoft.com{
207.46.232.188}

download.microsoft.com{
208.172.65.62
4.78.212.30
206.24.233.62}

search.microsoft.com{
209.152.127.218
209.152.119.242}


As we can see, it extracted 10 different host names, and several distinct IPs to the some host name which indicate that they are over a Network Load Balance.



CONCLUSION:
----------

Even with the restrictions of DNS Zone Transfers, attackers with WS-DNS-BFX and a GOOD dictionary file can extract much hosts, that can be very useful for attackers.

The best method to detect this kind of attack is to monitor the requests to your DNS Server and check for a high amount of requests in sequence from a unique IP and with many replys that say "hosts non-existent".

"Stoned Bootkit is a new Windows bootkit which attacks all Windows versions from XP up to 7. It is loaded before Windows starts and is memory resident up to the Windows kernel. Thus Stoned gains access to the entire system. It has exciting features like integrated file system drivers, automatic Windows pwning, plugins, boot applications and much much more. The project is partly published as open source under the European Union Public License. Like in 1987, "Your PC is now Stoned! ..again".
Peter Kleissner, Software Dev. Guru in Vienna

"A bootkit is a rootkit that is able to load from a master boot record and persist in memory all the way through the transition to protected mode and the startup of the OS. It's a very interesting type of rootkit." - Robert Hensing about bootkits

Stoned..

■is a software in the Master Boot Record, with the target to be memory resident up to the Windows kernel
■attacks Windows XP, Server 2003, Vista, Server 2008, 7
■supporting architecture: IA32, AT Architecture (IBM-conforming)
■full featured, including own file system drivers for FAT and NTFS!
■supports different boot media, hard disk, removable-media, cd, dvd, flash drives, network..
■there will be new versions, plugins and updates!
It has been sucessfully tested and verified on following systems:

Windows 2000 SP4
Windows XP SP2
Windows XP SP3
Windows Server 2003
Windows Server 2003 R2 SP2
Windows Vista
Windows Vista SP1
Windows Server 2008
Windows 7 Build 6801
Windows 7 Beta
Windows 7 RC
Windows 7

DiskCryptor 0.7
DiskCryptor 0.8
TrueCrypt 6.1a
TrueCrypt 6.2
TrueCrypt 6.2a

Bochs 2.4.1
VMware Workstation 6.5.0

EeePC 901 Windows XP SP3
Dell Studio XPS 16 Windows Vista SP1

The success of all of these exploits (whether they are based on direct ret overwrite or exception handler structure overwrites) are based on the fact that a reliable return address or pop/pop/ret address must be found, making the application jump to your shellcode. In all of these cases, we were able to find a more or less reliable address in one of the OS dll’s or application dll’s. Even after a reboot, this address stays the same, making the exploit work reliably.

Fortunately for the zillions Windows end-users out there, a number of protection mechanisms have been built-in into the Windows Operating systems.

- Stack cookies (/GS Switch cookie)

- Safeseh (/Safeseh compiler switch)

- Data Execution Prevention (DEP) (software and hardware based)

- Address Space Layout Randomization (ASLR)