DNS Server Dynamic Update Record Injection - Metasploit

This page contains detailed information about how to use the auxiliary/admin/dns/dyn_dns_update metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents

hide

Module Overview

Module Ranking and Traits
Basic Usage
Required Options

Msfconsole Usage

Module Options
Advanced Options
Auxiliary Actions
Evasion Options

Error Messages
Related Pull Requests
References
See Also
Authors
Version

Module Overview

Name: DNS Server Dynamic Update Record Injection
Module: auxiliary/admin/dns/dyn_dns_update
Source code: modules/auxiliary/admin/dns/dyn_dns_update.rb
Disclosure date: -
Last modification time: 2022-01-23 15:28:32 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): -
List of CVEs: -

This module allows adding and/or deleting a record to any remote DNS server that allows unrestricted dynamic updates.

Module Ranking and Traits

Module Ranking:

normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/admin/dns/dyn_dns_update
msf auxiliary(dyn_dns_update) > show targets
    ... a list of targets ...
msf auxiliary(dyn_dns_update) > set TARGET target-id
msf auxiliary(dyn_dns_update) > show options
    ... show and set options ...
msf auxiliary(dyn_dns_update) > exploit

Required Options

DOMAIN: The domain name
RHOST: The vulnerable DNS server IP address
HOSTNAME: The name record you want to add

Go back to menu.

Msfconsole Usage

Here is how the admin/dns/dyn_dns_update auxiliary module looks in the msfconsole:

msf6 > use auxiliary/admin/dns/dyn_dns_update

msf6 auxiliary(admin/dns/dyn_dns_update) > show info

       Name: DNS Server Dynamic Update Record Injection
     Module: auxiliary/admin/dns/dyn_dns_update
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  King Sabri <[email protected]>
  Brent Cook <[email protected]>

Available actions:
  Name    Description
  ----    -----------
  ADD     Add a new record. Fail if it already exists.
  DELETE  Delete an existing record.
  UPDATE  Add or update a record. (default)

Check supported:
  No

Basic options:
  Name      Current Setting  Required  Description
  ----      ---------------  --------  -----------
  CHOST                      no        The source address to use for queries and updates
  DOMAIN                     yes       The domain name
  HOSTNAME                   yes       The name record you want to add
  IP                         no        The IP you want to assign to the record
  RHOST                      yes       The vulnerable DNS server IP address
  TYPE      A                yes       The record type you want to add. (Accepted: A, AAAA, CNAME, TXT)
  VALUE                      no        The string to be added with TXT or CNAME record

Description:
  This module allows adding and/or deleting a record to any remote DNS 
  server that allows unrestricted dynamic updates.

References:
  http://www.tenable.com/plugins/index.php?view=single&id=35372
  https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/NONE-CVE/DNSInject
  https://www.christophertruncer.com/dns-modification-dnsinject-nessus-plugin-35372/
  https://github.com/ChrisTruncer/PenTestScripts/blob/master/DNSInject.py

Module Options

This is a complete list of options available in the admin/dns/dyn_dns_update auxiliary module:

msf6 auxiliary(admin/dns/dyn_dns_update) > show options

Module options (auxiliary/admin/dns/dyn_dns_update):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CHOST                      no        The source address to use for queries and updates
   DOMAIN                     yes       The domain name
   HOSTNAME                   yes       The name record you want to add
   IP                         no        The IP you want to assign to the record
   RHOST                      yes       The vulnerable DNS server IP address
   TYPE      A                yes       The record type you want to add. (Accepted: A, AAAA, CNAME, TXT)
   VALUE                      no        The string to be added with TXT or CNAME record

Auxiliary action:

   Name    Description
   ----    -----------
   UPDATE  Add or update a record. (default)

Advanced Options

Here is a complete list of advanced options supported by the admin/dns/dyn_dns_update auxiliary module:

msf6 auxiliary(admin/dns/dyn_dns_update) > show advanced

Module advanced options (auxiliary/admin/dns/dyn_dns_update):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   VERBOSE    false            no        Enable detailed status messages
   WORKSPACE                   no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the admin/dns/dyn_dns_update module can do:

msf6 auxiliary(admin/dns/dyn_dns_update) > show actions

Auxiliary actions:

   Name    Description
   ----    -----------
   ADD     Add a new record. Fail if it already exists.
   DELETE  Delete an existing record.
   UPDATE  Add or update a record. (default)

Evasion Options

Here is the full list of possible evasion options supported by the admin/dns/dyn_dns_update auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(admin/dns/dyn_dns_update) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Query failed: <E.MESSAGE>
Cannot add <FQDN>
The DNS server may not be vulnerable, or there may be a preexisting static record.
Update failed: <E.MESSAGE>
Cannot delete <FQDN>
The DNS server may not be vulnerable, or there may be a preexisting static record.
Update failed: <E.MESSAGE>
Record type <TYPE> requires the <VALUE_NAME> parameter to be specified
Record already exists, try DELETE or UPDATE
Record does not exist, not deleting
Invalid Record Type!
Connection Refused!
Invalid DNS reply, ensure you are connecting to a DNS server

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Query failed: <E.MESSAGE>

Here is a relevant code snippet related to the "Query failed: <E.MESSAGE>" error message:

69:	            return true
70:	          end
71:	          return false
72:	        rescue Dnsruby::ResolvError, IOError => e
73:	          print_good "Did not find an existing #{type} record for #{fqdn}"
74:	          vprint_error "Query failed: #{e.message}"
75:	          return false
76:	        end
77:	      when action == :add
78:	        print_status("Sending dynamic DNS add message...")
79:	        update.absent("#{fqdn}.", type)

Cannot add <FQDN>

Here is a relevant code snippet related to the "Cannot add <FQDN>" error message:

81:	        begin
82:	          resolver.send_message(update)
83:	          print_good "The record '#{fqdn} => #{value}' has been added!"
84:	          updated = true
85:	        rescue Dnsruby::ResolvError, IOError => e
86:	          print_error "Cannot add #{fqdn}"
87:	          vprint_error "The DNS server may not be vulnerable, or there may be a preexisting static record."
88:	          vprint_error "Update failed: #{e.message}"
89:	        end
90:	      when action == :delete
91:	        begin

The DNS server may not be vulnerable, or there may be a preexisting static record.

Here is a relevant code snippet related to the "The DNS server may not be vulnerable, or there may be a preexisting static record." error message:

82:	          resolver.send_message(update)
83:	          print_good "The record '#{fqdn} => #{value}' has been added!"
84:	          updated = true
85:	        rescue Dnsruby::ResolvError, IOError => e
86:	          print_error "Cannot add #{fqdn}"
87:	          vprint_error "The DNS server may not be vulnerable, or there may be a preexisting static record."
88:	          vprint_error "Update failed: #{e.message}"
89:	        end
90:	      when action == :delete
91:	        begin
92:	          print_status("Sending dynamic DNS delete message...")

Update failed: <E.MESSAGE>

Here is a relevant code snippet related to the "Update failed: <E.MESSAGE>" error message:

83:	          print_good "The record '#{fqdn} => #{value}' has been added!"
84:	          updated = true
85:	        rescue Dnsruby::ResolvError, IOError => e
86:	          print_error "Cannot add #{fqdn}"
87:	          vprint_error "The DNS server may not be vulnerable, or there may be a preexisting static record."
88:	          vprint_error "Update failed: #{e.message}"
89:	        end
90:	      when action == :delete
91:	        begin
92:	          print_status("Sending dynamic DNS delete message...")
93:	          update.present(fqdn, type)

Cannot delete <FQDN>

Here is a relevant code snippet related to the "Cannot delete <FQDN>" error message:

94:	          update.delete(fqdn, type)
95:	          resolver.send_message(update)
96:	          print_good("The record '#{fqdn} => #{value}' has been deleted!")
97:	          updated = true
98:	        rescue Dnsruby::ResolvError, IOError => e
99:	          print_error "Cannot delete #{fqdn}"
100:	          vprint_error "The DNS server may not be vulnerable, or there may be a preexisting static record."
101:	          vprint_error "Update failed: #{e.message}"
102:	        end
103:	    end
104:	    updated

The DNS server may not be vulnerable, or there may be a preexisting static record.

Here is a relevant code snippet related to the "The DNS server may not be vulnerable, or there may be a preexisting static record." error message:

95:	          resolver.send_message(update)
96:	          print_good("The record '#{fqdn} => #{value}' has been deleted!")
97:	          updated = true
98:	        rescue Dnsruby::ResolvError, IOError => e
99:	          print_error "Cannot delete #{fqdn}"
100:	          vprint_error "The DNS server may not be vulnerable, or there may be a preexisting static record."
101:	          vprint_error "Update failed: #{e.message}"
102:	        end
103:	    end
104:	    updated
105:	  end

Update failed: <E.MESSAGE>

Here is a relevant code snippet related to the "Update failed: <E.MESSAGE>" error message:

96:	          print_good("The record '#{fqdn} => #{value}' has been deleted!")
97:	          updated = true
98:	        rescue Dnsruby::ResolvError, IOError => e
99:	          print_error "Cannot delete #{fqdn}"
100:	          vprint_error "The DNS server may not be vulnerable, or there may be a preexisting static record."
101:	          vprint_error "Update failed: #{e.message}"
102:	        end
103:	    end
104:	    updated
105:	  end
106:

Record type <TYPE> requires the <VALUE_NAME> parameter to be specified

Here is a relevant code snippet related to the "Record type <TYPE> requires the <VALUE_NAME> parameter to be specified" error message:

104:	    updated
105:	  end
106:	
107:	  def update_record(type:, type_enum:, value:, value_name:)
108:	    if value.nil? || value == ""
109:	      print_error "Record type #{type} requires the #{value_name} parameter to be specified"
110:	      return
111:	    end
112:	    force = datastore['CHOST'] && datastore['CHOST'] != ""
113:	    case
114:	      when action.name == 'UPDATE'

Record already exists, try DELETE or UPDATE

Here is a relevant code snippet related to the "Record already exists, try DELETE or UPDATE" error message:

129:	          record_action(type, type_enum, value, :add)
130:	        else
131:	          if record_action(type, type_enum, value, :resolve) == false
132:	            record_action(type, type_enum, value, :add)
133:	          else
134:	            print_error "Record already exists, try DELETE or UPDATE"
135:	          end
136:	        end
137:	      when action.name == 'DELETE'
138:	        if force
139:	          record_action(type, type_enum, value, :delete)

Record does not exist, not deleting

Here is a relevant code snippet related to the "Record does not exist, not deleting" error message:

139:	          record_action(type, type_enum, value, :delete)
140:	        else
141:	          if record_action(type, type_enum, value, :resolve)
142:	            record_action(type, type_enum, value, :delete)
143:	          else
144:	            print_error "Record does not exist, not deleting"
145:	          end
146:	        end
147:	    end
148:	  end
149:

Invalid Record Type!

Here is a relevant code snippet related to the "Invalid Record Type!" error message:

159:	      when datastore['TYPE'] == 'CNAME'
160:	        update_record(type: 'CNAME', type_enum: Dnsruby::Types.CNAME, value: value, value_name: 'VALUE')
161:	      when datastore['TYPE'] == 'TXT'
162:	        update_record(type: 'TXT', type_enum: Dnsruby::Types.TXT, value: value, value_name: 'VALUE')
163:	      else
164:	        print_error "Invalid Record Type!"
165:	      end
166:	    rescue ArgumentError => e
167:	      print_error(e.message)
168:	    rescue Dnsruby::OtherResolvError
169:	      print_error("Connection Refused!")

Connection Refused!

Here is a relevant code snippet related to the "Connection Refused!" error message:

164:	        print_error "Invalid Record Type!"
165:	      end
166:	    rescue ArgumentError => e
167:	      print_error(e.message)
168:	    rescue Dnsruby::OtherResolvError
169:	      print_error("Connection Refused!")
170:	    rescue Dnsruby::DecodeError
171:	      print_error("Invalid DNS reply, ensure you are connecting to a DNS server")
172:	    end
173:	  end
174:	end

Invalid DNS reply, ensure you are connecting to a DNS server

Here is a relevant code snippet related to the "Invalid DNS reply, ensure you are connecting to a DNS server" error message:

164:	        print_error "Invalid Record Type!"
165:	      end
166:	    rescue ArgumentError => e
167:	      print_error(e.message)
168:	    rescue Dnsruby::OtherResolvError
169:	      print_error("Connection Refused!")
170:	    rescue Dnsruby::DecodeError
171:	      print_error("Invalid DNS reply, ensure you are connecting to a DNS server")
172:	    end
173:	  end
174:	end

Go back to menu.

References

Authors

King Sabri <king.sabri[at]gmail.com>
Brent Cook <brent_cook[at]rapid7.com>

Version

This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.

DNS Server Dynamic Update Record Injection - Metasploit

Module Overview

Module Ranking and Traits

Basic Usage

Required Options

Msfconsole Usage

Module Options

Advanced Options

Auxiliary Actions

Evasion Options

Error Messages

Query failed: <E.MESSAGE>

Cannot add <FQDN>

The DNS server may not be vulnerable, or there may be a preexisting static record.

Update failed: <E.MESSAGE>

Cannot delete <FQDN>

The DNS server may not be vulnerable, or there may be a preexisting static record.

Update failed: <E.MESSAGE>

Record type <TYPE> requires the <VALUE_NAME> parameter to be specified

Record already exists, try DELETE or UPDATE

Record does not exist, not deleting

Invalid Record Type!

Connection Refused!

Invalid DNS reply, ensure you are connecting to a DNS server

Related Pull Requests

References

See Also

Authors

Version