I hijack your dns
This article divides Dns into two types: host or embedded device dns, and website domain name dns, to describe the harm caused by the fall of dns.
I. vrodns dns hijacking
The dns of your local network connection is obtained through the vro. If one day your home route is hacked and the intruders modify the dns of your home router, then he can clearly view your access records, such as file and traffic records. Since dns is used for resolution, we can use self-built dns to launch attacks.
1. How does a vro fall?
Attack method: csrf router Vulnerability
CSRF
IE has a security patch that disables the Http Authentication Url. Using this method to attack IE is not compatible with FF chrome. Https://support.microsoft.com/zh-cn/kb/834489
Device Vulnerabilities
A vro of beacon communication has a vulnerability. You can modify DNS remotely.
Http://www.exploit-db.com/exploits/28450/
2. self-built dns (window)
Here I use Microsoft's own product (it can be replaced by other products, and my habits are problematic)
Configure domain hijacking
2cto.com
Forwarder Configuration
The forwarder resolves the dns query requests that the server does not respond to. For example, if this host only has 2cto.com or baidu.com, it will forward the baidu.com request to your configured dns for resolution. The dns configured for resolution is 8.8.8.8.
Configure the record of the hijacked Domain Name
Dns is just filled in with A domain. At this time, we need to parse the record, for example, I hijack www.bkjia.com to the local 127.0.0.1.
I have resolved the IP address of the vps and can write 127.0.0.1 for testing. But you need to use it to resolve and write the public IP address. Otherwise, the resolution is 127.0.0.1, and 127.0.0.1 is your local IP address, which cannot be found.
Test whether dns configuration is successful
You can use dnslookup ping to test
Dns has been configured successfully. Although it is now resolved locally, can I only mount a black page locally? Of course not. My goal is to replace the content of the page, such as inserting js and modifying a certain text.
Client Configuration
Because I do not have a vro in my company, I directly use the client for testing. The client's dns gets the source or vro.
At this time, the configuration is successful. You can open baidu.com to test whether it can be parsed and opened normally.
3. Reverse Proxy Construction
Here, the reverse proxy is used to proxy the request for dns resolution of the vps of www.bkjia.com to the real resolution.
What we need to do is insert a piece of js into the page.
Introduction to Openresty
Here we use Openresty, which is based on nginx. It packages the standard Nginx core. Many common third-party modules and nginx third-party modules need to be compiled, in the window, I found an Openresty_For_Windows file. I have packed it and want a third-party module http_sub_module.
:
Https://github.com/LomoX-Offical/nginx-openresty-windows
Use nginx-V to view supported third-party modules
Http_sub_module disadvantages
1. Only one rule can be used.
2. Chinese characters are not supported
Reverse proxy configuration
Port 80 of the Public IP address of the listener port vps. When the dns query request is resolved to the local port 80, 80 listens to the public ip address of the vps, and the reverse proxy is 2cto.com. In fact, the public ip address of vps is 2cto.com.
Open the/conf/nginx. conf file for configuration.
Http_sub_module is used.
In this case, I intentionally wrote an error as sec =
Test successful
Dns settings have been set before, and now you can ping it, then we can check whether the source code replaces the page content.
Configure other functions
Now that the dns and reverse proxy configurations have been completed, you can replace their pages.
Openresty configures reverse proxy. If you need other configurations, you can set many parameters, such as proxy_cache proxy_header proxy_send_timeout proxy_read_timeout. Depends on your own use.
Ii. Website domain name dns hijacking
When you get the permission for a domain name through a social worker, but your goal is getshell, You Can Do reverse proxy in two ways.
A record hijacking demonstration
Directly modify the domain name to hijack your malicious reverse proxy of the record. However, at this time, the reverse proxy must have the upstream configured to specify the IP address resolved by the original domain name in upstream, vro hijacking dns does not configure upstream because the upper-layer dns can also resolve the real ip address of the hijacked domain name. At this time, your opinion is to modify the record resolution to your malicious reverse proxy machine, instead of specifying the resolved address, the upper layer finds the resolved address or malicious reverse proxy, forming an endless loop and never opens the website.
Domain name A record hijacking
Www.sanr.org 192.168.182.128
Reverse Proxy 192.168.182.129
Why hijack A records?
For example, if you get the domain name control permission through social engineering, you want to get the background address or cookie, and you need to do so.
At present, I have taken control of the domain name resolution permissions of sanr.org. Now we want to resolve the record of www.sanr.org to 192.168.182.129. Let the reverse proxy access the real ip address (192.168.182.128). When the reverse proxy is used, We can insert a js Code.
Before modifying the record
Modify domain name A record
Modify domain name to reverse proxy server 192.168.182.129
Reverse Proxy Server construction (192.168.182.129)
The bound domain name is port 80 of www.sanr.org and the upstream (upstream) address is 192.168.182.128. The upstream address (upstream) must be specified. Only if proxy_pass does not have upstream, it will automatically request to parse the record.
The router dns hijacking does not use upstream because you can obtain the IP address of the record of the domain name through proxy_pass.
Currently, domain name A record resolution is A reverse proxy machine, that is, the Local Machine (192.168.182.129). If you do not use upstrema to specify the real IP address, proxy_pass directly resolves the local IP address, this will lead to an endless loop. All the parsing tasks are the local machine.
The following is the reverse proxy configuration file.
Hijacking successful
Successfully implanted safe. js code into sanr.org
Dns hijacking
Like vro hijacking dns, self-built dns resolves the record of the dns resolution configuration of the domain name to a malicious reverse proxy. The reverse proxy still needs to specify upstream, just like A record hijacking, otherwise, it will lead to an endless loop.
There are a lot of reverse proxy software for the Dns service, depending on your habits, use your favorite.
Dns win
WinMyDNS
Microsoft
Dns linux
Dnschef "msfconsole auxiliary/server/fakedns"
Too many linux open-source projects such as Powerdns bind
Reverse Proxy
Squid Varnish nginx or nginx derivative version (Tengine Openresty)
The attack method is not just to replace the webpage content and insert Javascript. For example, if you hijack the dns of your vro and connect to 3389, the entered domain name is also resolved through dns. I can hijack my local location with A record, connect to 3389 is my local machine, and then install WinlogonHack to record the password. You need to change WinlogonHack to a record even if it is an incorrect password, otherwise it cannot be recorded.
Resolve www.baidu.com to the ip address of my vps host
The Dns has taken effect. The ip address of the vps host is also returned after the Dns is resolved to baidu.com.
Connect to 3389 (in fact, this is my vps IP address)
As long as the dns of the local host local client that involves domain name resolution can be hijacked in this way, the attack methods vary, depending on what you do.
