metasploit-framework/modules/auxiliary/vsploit/malware/dns/dns_zeus.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	def initialize
		super(
			'Name'         => 'VSploit Zeus DNS Query Module',
			'Version'      => '$Revision$',
			'Description'  => 'This module queries known Zeus Botnet DNS records.',
			'Author'       => 'MJC',
			'License'      => MSF_LICENSE,
			'References'   =>
				[
					[ 'URL', 'https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist']
				]
		)
		register_options(
			[
				OptString.new('DNS_SERVER',[false, "Specifies a DNS Server"]),
				OptInt.new('COUNT', [false, "Number of intervals to loop",1]),
				OptInt.new('DELAY', [false, "Delay in seconds between intervals",3])
		],self.class)
	end

	def run
		@res = Net::DNS::Resolver.new()

		domain = [
		"allspring.net","antifoher.biz","asdfasdgqghgsw.cx.cc",
		"ashnmjjpoljfnl.info","atlaz.net","b3l.org","back.boroborogold.ru",
		"bandwithcheckstart.com","batmanrobinho.com","bellicbridge.ru",
		"bestfihteerdr.com","bestprice2you.net","billyd.com.au",
		"bitschoonerop.com","blackskullbg.sytes.net","botikov.eu.tf",
		"botnetdown.gicp.net","boutique.vcm-mode.it","brandc.name",
		"bxkkuskgdjskdn.com","c0re.su","cdvqvnjqqtkqhsoo.info",
		"christmassuper.com","ciritas.ru","citi-spb.ru","clavn.ru",
		"client.trackups.org","client.upsclients.net","cnewsus.ru",
		"cnnus.ru","concapow.in","consoleencydd.com","cqoqgzqmkpkrmlo.com",
		"ctllutheran.org","currencytradechat.com","cyytmmlxsthywst.com",
		"damaka.com","datacricketuf.ru","deimingames.com",
		"dfhhdkdddqjda.start.tl","djerk.info","djpeterblue.com.br",
		"dlmsonisfzksioqq.org","domio.pwomega.ru","favdstgssdqdsfg.start.tl",
		"favoritopilodjd.com","favqnornkwvkwfxv.biz","fdhjkfhskas.com",
		"federalreserve-report.com","federetoktyt.net"
		]

		if datastore['DNS_SERVER']
			@res.nameservers = datastore['DNS_SERVER']
		end

		count = 0

		while count < datastore['COUNT']

			domain.each do |name|
				query = @res.query(name, "A")
				time = Time.new
				time = time.strftime("%Y-%m-%d %H:%M:%S")
				print_status("#{time} - DNS Query sent for => #{name}")
				if query.answer.length == 0
					print_error("#{time} - #{name} => No Record Found")
				else
					a = query.answer[0].to_s.split(/[\s,]+/)
					print_good("#{time} - #{name} => #{a[-1]}")
				end
			end
			unless count == (datastore['COUNT'] - 1)
				time = Time.new
				time = time.strftime("%Y-%m-%d %H:%M:%S")
				print_status("#{time} - Waiting #{datastore['DELAY']} seconds to query")
				select(nil, nil, nil, datastore['DELAY'])
			end
			count += 1
		end
	end
end