DNS and DNSSEC Fuzzer - Metasploit

This page contains detailed information about how to use the auxiliary/fuzzers/dns/dns_fuzzer metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents

hide

Module Overview

Module Ranking and Traits
Basic Usage
Required Options

Msfconsole Usage

Module Options
Advanced Options
Auxiliary Actions
Evasion Options

Error Messages
Related Pull Requests
See Also
Authors
Version

Module Overview

Name: DNS and DNSSEC Fuzzer
Module: auxiliary/fuzzers/dns/dns_fuzzer
Source code: modules/auxiliary/fuzzers/dns/dns_fuzzer.rb
Disclosure date: -
Last modification time: 2019-12-07 08:01:52 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 53
List of CVEs: -

This module will connect to a DNS server and perform DNS and DNSSEC protocol-level fuzzing. Note that this module may inadvertently crash the target server.

Module Ranking and Traits

Module Ranking:

normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/fuzzers/dns/dns_fuzzer
msf auxiliary(dns_fuzzer) > show options
    ... show and set options ...
msf auxiliary(dns_fuzzer) > set RHOSTS ip-range
msf auxiliary(dns_fuzzer) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(dns_fuzzer) > set RHOSTS 192.168.1.3-192.168.1.200

Example 2:

msf auxiliary(dns_fuzzer) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(dns_fuzzer) > set RHOSTS file:/tmp/ip_list.txt

Required Options

RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Go back to menu.

Msfconsole Usage

Here is how the fuzzers/dns/dns_fuzzer auxiliary module looks in the msfconsole:

msf6 > use auxiliary/fuzzers/dns/dns_fuzzer

msf6 auxiliary(fuzzers/dns/dns_fuzzer) > show info

       Name: DNS and DNSSEC Fuzzer
     Module: auxiliary/fuzzers/dns/dns_fuzzer
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  pello <[email protected]>

Check supported:
  No

Basic options:
  Name         Current Setting  Required  Description
  ----         ---------------  --------  -----------
  CLASS                         no        Comma separated list of classes to fuzz. Leave empty to fuzz all fields.
  CYCLIC       true             no        Use Cyclic pattern instead of A's (fuzzing payload).
  DNSSEC       false            no        Add DNSsec to each question (UDP payload size, EDNS0, ...)
  DOMAIN                        no        Force DNS zone domain name.
  ENDSIZE      500              no        Max Fuzzing string size. (L2 Frame size)
  ERRORHDR     0                no        Introduces byte error in the DNS header.
  IMPORTENUM                    no        Import dns_enum database output and automatically use existing RR.
  ITERATIONS   5                yes       Number of iterations to run by test case
  METHOD       UDP              no        Underlayer protocol to use (Accepted: UDP, TCP, AUTO)
  OPCODE                        no        Comma separated list of opcodes to fuzz. Leave empty to fuzz all fields.
  RAWPADDING   false            no        Generate totally random data from STARTSIZE to ENDSIZE
  RHOSTS                        yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT        53               yes       The target port (TCP)
  RR                            no        Comma separated list of requests to fuzz. Leave empty to fuzz all fields.
  STARTSIZE    0                no        Fuzzing string startsize.
  STEPSIZE     100              no        Increment fuzzing string each attempt.
  THREADS      1                yes       The number of concurrent threads (max one per host)
  TRAILINGNUL  true             no        NUL byte terminate DNS names

Description:
  This module will connect to a DNS server and perform DNS and DNSSEC 
  protocol-level fuzzing. Note that this module may inadvertently 
  crash the target server.

Module Options

This is a complete list of options available in the fuzzers/dns/dns_fuzzer auxiliary module:

msf6 auxiliary(fuzzers/dns/dns_fuzzer) > show options

Module options (auxiliary/fuzzers/dns/dns_fuzzer):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   CLASS                         no        Comma separated list of classes to fuzz. Leave empty to fuzz all fields.
   CYCLIC       true             no        Use Cyclic pattern instead of A's (fuzzing payload).
   DNSSEC       false            no        Add DNSsec to each question (UDP payload size, EDNS0, ...)
   DOMAIN                        no        Force DNS zone domain name.
   ENDSIZE      500              no        Max Fuzzing string size. (L2 Frame size)
   ERRORHDR     0                no        Introduces byte error in the DNS header.
   IMPORTENUM                    no        Import dns_enum database output and automatically use existing RR.
   ITERATIONS   5                yes       Number of iterations to run by test case
   METHOD       UDP              no        Underlayer protocol to use (Accepted: UDP, TCP, AUTO)
   OPCODE                        no        Comma separated list of opcodes to fuzz. Leave empty to fuzz all fields.
   RAWPADDING   false            no        Generate totally random data from STARTSIZE to ENDSIZE
   RHOSTS                        yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT        53               yes       The target port (TCP)
   RR                            no        Comma separated list of requests to fuzz. Leave empty to fuzz all fields.
   STARTSIZE    0                no        Fuzzing string startsize.
   STEPSIZE     100              no        Increment fuzzing string each attempt.
   THREADS      1                yes       The number of concurrent threads (max one per host)
   TRAILINGNUL  true             no        NUL byte terminate DNS names

Advanced Options

Here is a complete list of advanced options supported by the fuzzers/dns/dns_fuzzer auxiliary module:

msf6 auxiliary(fuzzers/dns/dns_fuzzer) > show advanced

Module advanced options (auxiliary/fuzzers/dns/dns_fuzzer):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   CHOST                                 no        The local client address
   CPORT                                 no        The local client port
   ConnectTimeout       10               yes       Maximum number of seconds to establish a TCP connection
   FuzzChar             X                yes       Sets the character to use for generating long strings
   FuzzTracer           MSFROCKS         yes       Sets the magic string to embed into fuzzer string inputs
   Proxies                               no        A proxy chain of format type:host:port[,type:host:port][...]
   SSL                  false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                             no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLVerifyMode        PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion           Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   ShowProgress         true             yes       Display progress messages during a scan
   ShowProgressPercent  10               yes       The interval in percent that progress should be shown
   VERBOSE              false            no        Enable detailed status messages
   WORKSPACE                             no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the fuzzers/dns/dns_fuzzer module can do:

msf6 auxiliary(fuzzers/dns/dns_fuzzer) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the fuzzers/dns/dns_fuzzer auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(fuzzers/dns/dns_fuzzer) > show evasion

Module evasion options:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   TCP::max_send_size  0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay     0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

ERRORHDR
<MSG> Server replied incorrectly to the following request:n<VALUE>
<MSG> The remote server is not responding to DNS requests.
<MSG> DNS is DOWN since the request
<MSG> DNS is DOWN
ERRORHDR
DNS Fuzzer: DOMAIN could be set for health check but not mandatory.
DNS Fuzzer: Domain variable must be set.
Invalid CLASS: <NSCLASS.INSPECT>
Invalid OPCODE: <OPCODE.INSPECT>
Invalid RR: <NSREQ.INSPECT>
DNS Fuzzer error, aborting: <E>

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

ERRORHDR

Here is a relevant code snippet related to the "ERRORHDR" error message:

26:	    register_options([
27:	      Opt::RPORT(53),
28:	      OptInt.new('STARTSIZE', [ false, "Fuzzing string startsize.",0]),
29:	      OptInt.new('ENDSIZE', [ false, "Max Fuzzing string size. (L2 Frame size)",500]),
30:	      OptInt.new('STEPSIZE', [ false, "Increment fuzzing string each attempt.",100]),
31:	      OptInt.new('ERRORHDR', [ false, "Introduces byte error in the DNS header.", 0]),
32:	      OptBool.new('CYCLIC', [ false, "Use Cyclic pattern instead of A's (fuzzing payload).",true]),
33:	      OptInt.new("ITERATIONS", [true, "Number of iterations to run by test case", 5]),
34:	      OptString.new('DOMAIN', [ false, "Force DNS zone domain name."]),
35:	      OptString.new('IMPORTENUM', [ false, "Import dns_enum database output and automatically use existing RR."]),
36:	      OptEnum.new('METHOD', [false, 'Underlayer protocol to use', 'UDP', ['UDP', 'TCP', 'AUTO']]),

<MSG> Server replied incorrectly to the following request:n<VALUE>

Here is a relevant code snippet related to the "<MSG> Server replied incorrectly to the following request:n<VALUE>" error message:

85:	  end
86:	
87:	  def check_response_construction(pkt)
88:	    # check if RCODE is not in the unassigned/reserved range
89:	    if pkt[4].to_i >= 0x17 || (pkt[4].to_i >= 0x0b && pkt[4].to_i <= 0x0f)
90:	      print_error("#{msg} Server replied incorrectly to the following request:\n#{@lastdata.unpack('H*')}")
91:	      return false
92:	    else
93:	      return true
94:	    end
95:	  end

<MSG> The remote server is not responding to DNS requests.

Here is a relevant code snippet related to the "<MSG> The remote server is not responding to DNS requests." error message:

129:	      res, addr = sock.get_once(-1, 20)
130:	      disconnect
131:	    end
132:	
133:	    if res && res.empty?
134:	      print_error("#{msg} The remote server is not responding to DNS requests.")
135:	      return false
136:	    else
137:	      return true
138:	    end
139:	  end

<MSG> DNS is DOWN since the request

Here is a relevant code snippet related to the "<MSG> DNS is DOWN since the request" error message:

291:	        @probablyVuln = @lastdata if @lastdata != nil
292:	        return true
293:	      elsif @failCount >= 3
294:	        if dns_alive(method) == false
295:	          if @lastdata
296:	            print_error("#{msg} DNS is DOWN since the request:")
297:	            print_error(lastdata.unpack('H*'))
298:	          else
299:	            print_error("#{msg} DNS is DOWN")
300:	          end
301:	          return false

<MSG> DNS is DOWN

Here is a relevant code snippet related to the "<MSG> DNS is DOWN" error message:

294:	        if dns_alive(method) == false
295:	          if @lastdata
296:	            print_error("#{msg} DNS is DOWN since the request:")
297:	            print_error(lastdata.unpack('H*'))
298:	          else
299:	            print_error("#{msg} DNS is DOWN")
300:	          end
301:	          return false
302:	        else
303:	          return true
304:	        end

ERRORHDR

Here is a relevant code snippet related to the "ERRORHDR" error message:

351:	      @domain = datastore['DOMAIN']
352:	      @dnsfile = datastore['IMPORTENUM']
353:	      @rawpadding = datastore['RAWPADDING']
354:	      iter = datastore['ITERATIONS']
355:	      dnssec = datastore['DNSSEC']
356:	      errorhdr = datastore['ERRORHDR']
357:	      trailingnul = datastore['TRAILINGNUL']
358:	
359:	      fix_variables
360:	
361:	      if !dns_alive(@underlayerProtocol) then return false end

DNS Fuzzer: DOMAIN could be set for health check but not mandatory.

Here is a relevant code snippet related to the "DNS Fuzzer: DOMAIN could be set for health check but not mandatory." error message:

367:	        @startsize = 12
368:	      end
369:	
370:	      if @rawpadding
371:	        if @domain == nil
372:	          print_status("DNS Fuzzer: DOMAIN could be set for health check but not mandatory.")
373:	        end
374:	        nsopcode=@fuzz_opcode.split(",")
375:	        opcode = setup_opcode(nsopcode)
376:	        opcode.unpack("n*").each do |dnsOpcode|
377:	          1.upto(iter) do

DNS Fuzzer: Domain variable must be set.

Here is a relevant code snippet related to the "DNS Fuzzer: Domain variable must be set." error message:

389:	        return
390:	      end
391:	
392:	      if @dnsfile
393:	        if @domain == nil
394:	          print_error("DNS Fuzzer: Domain variable must be set.")
395:	          return
396:	        end
397:	
398:	        dnsenumdata = import_enum_data(@dnsfile)
399:	        nsreq = []

Invalid CLASS: <NSCLASS.INSPECT>

Here is a relevant code snippet related to the "Invalid CLASS: <NSCLASS.INSPECT>" error message:

409:	        nsreq=@fuzz_rr.split(",")
410:	        nsopcode=@fuzz_opcode.split(",")
411:	        nsclass=@fuzz_class.split(",")
412:	        begin
413:	          classns = setup_nsclass(nsclass)
414:	          raise ArgumentError, "Invalid CLASS: #{nsclass.inspect}" unless classns
415:	          opcode = setup_opcode(nsopcode)
416:	          raise ArgumentError, "Invalid OPCODE: #{opcode.inspect}" unless nsopcode
417:	          reqns = setup_reqns(nsreq)
418:	          raise ArgumentError, "Invalid RR: #{nsreq.inspect}" unless nsreq
419:	        rescue ::Exception => e

Invalid OPCODE: <OPCODE.INSPECT>

Here is a relevant code snippet related to the "Invalid OPCODE: <OPCODE.INSPECT>" error message:

411:	        nsclass=@fuzz_class.split(",")
412:	        begin
413:	          classns = setup_nsclass(nsclass)
414:	          raise ArgumentError, "Invalid CLASS: #{nsclass.inspect}" unless classns
415:	          opcode = setup_opcode(nsopcode)
416:	          raise ArgumentError, "Invalid OPCODE: #{opcode.inspect}" unless nsopcode
417:	          reqns = setup_reqns(nsreq)
418:	          raise ArgumentError, "Invalid RR: #{nsreq.inspect}" unless nsreq
419:	        rescue ::Exception => e
420:	          print_error("DNS Fuzzer error, aborting: #{e}")
421:	          return

Invalid RR: <NSREQ.INSPECT>

Here is a relevant code snippet related to the "Invalid RR: <NSREQ.INSPECT>" error message:

413:	          classns = setup_nsclass(nsclass)
414:	          raise ArgumentError, "Invalid CLASS: #{nsclass.inspect}" unless classns
415:	          opcode = setup_opcode(nsopcode)
416:	          raise ArgumentError, "Invalid OPCODE: #{opcode.inspect}" unless nsopcode
417:	          reqns = setup_reqns(nsreq)
418:	          raise ArgumentError, "Invalid RR: #{nsreq.inspect}" unless nsreq
419:	        rescue ::Exception => e
420:	          print_error("DNS Fuzzer error, aborting: #{e}")
421:	          return
422:	        end
423:	      end

DNS Fuzzer error, aborting: <E>

Here is a relevant code snippet related to the "DNS Fuzzer error, aborting: <E>" error message:

415:	          opcode = setup_opcode(nsopcode)
416:	          raise ArgumentError, "Invalid OPCODE: #{opcode.inspect}" unless nsopcode
417:	          reqns = setup_reqns(nsreq)
418:	          raise ArgumentError, "Invalid RR: #{nsreq.inspect}" unless nsreq
419:	        rescue ::Exception => e
420:	          print_error("DNS Fuzzer error, aborting: #{e}")
421:	          return
422:	        end
423:	      end
424:	
425:	      for question in nsreq

Go back to menu.