infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

More fixes to enum_dns.rb 

* Should use 'and', not & (bitwise AND)
  * Made capitalization sane for Anglophones. See: http://owl.english.purdue.edu/owl/resource/592/1/
unstable
Tod Beardsley 2012-03-26 16:14:04 -05:00
parent dc6f76eb20
commit 14b45f9fb1
1 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
modules/auxiliary/gather/enum_dns.rb
View File

@ -83,7 +83,7 @@ class Metasploit3 < Msf::Auxiliary
rendsub = rand(10000).to_s rendsub = rand(10000).to_s
query = @res.query("#{rendsub}.#{target}", "A") query = @res.query("#{rendsub}.#{target}", "A")
if query.answer.length != 0 if query.answer.length != 0
print_status("This Domain has Wildcards Enabled!!") print_status("This domain has wildcards enabled!!")
query.answer.each do |rr| query.answer.each do |rr|
print_status("Wildcard IP for #{rendsub}.#{target} is: #{rr.address.to_s}") if rr.class != Net::DNS::RR::CNAME print_status("Wildcard IP for #{rendsub}.#{target} is: #{rr.address.to_s}") if rr.class != Net::DNS::RR::CNAME
end end
@ -94,12 +94,12 @@ class Metasploit3 < Msf::Auxiliary
end end
#--------------------------------------------------------------------------------- #---------------------------------------------------------------------------------
def genrcd(target) def genrcd(target)
print_status("Retrieving General DNS Records") print_status("Retrieving general DNS records")
query = @res.search(target) query = @res.search(target)
if (query) if (query)
query.answer.each do |rr| query.answer.each do |rr|
next unless rr.class == Net::DNS::RR::A next unless rr.class == Net::DNS::RR::A
print_status("Domain: #{target} IP Address: #{rr.address} Record: A ") print_status("Domain: #{target} IP address: #{rr.address} Record: A ")
report_note(:host => rr.address.to_s, report_note(:host => rr.address.to_s,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
@ -114,7 +114,7 @@ class Metasploit3 < Msf::Auxiliary
query1 = @res.search(rr.mname) query1 = @res.search(rr.mname)
if (query1) if (query1)
query1.answer.each do |ip| query1.answer.each do |ip|
print_status("Start of Authority: #{rr.mname} IP Address: #{ip.address} Record: SOA") print_status("Start of Authority: #{rr.mname} IP address: #{ip.address} Record: SOA")
report_note(:host => ip.address.to_s, report_note(:host => ip.address.to_s,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
@ -132,7 +132,7 @@ class Metasploit3 < Msf::Auxiliary
if (query1) if (query1)
query1.answer.each do |ip| query1.answer.each do |ip|
next unless ip.class == Net::DNS::RR::A next unless ip.class == Net::DNS::RR::A
print_status("Name Server: #{rr.nsdname} IP Address: #{ip.address} Record: NS") print_status("Name Server: #{rr.nsdname} IP address: #{ip.address} Record: NS")
report_note(:host => ip.address.to_s, report_note(:host => ip.address.to_s,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
@ -207,7 +207,7 @@ class Metasploit3 < Msf::Auxiliary
query1 = @res.search("#{target}.#{tld}") query1 = @res.search("#{target}.#{tld}")
if (query1) if (query1)
query1.answer.each do |rr| query1.answer.each do |rr|
print_status("Domain: #{target}.#{tld} Name: #{rr.name} IP Address: #{rr.address} Record: A ") if rr.class == Net::DNS::RR::A print_status("Domain: #{target}.#{tld} Name: #{rr.name} IP address: #{rr.address} Record: A ") if rr.class == Net::DNS::RR::A
report_note(:host => rr.address.to_s, report_note(:host => rr.address.to_s,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
@ -222,7 +222,7 @@ class Metasploit3 < Msf::Auxiliary
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
def dnsbrute(target, wordlist, nssrv) def dnsbrute(target, wordlist, nssrv)
print_status("Running Brute Force against Domain #{target}") print_status("Running bruteforce against domain #{target}")
arr = [] arr = []
i, a = 0, [] i, a = 0, []
::File.open(wordlist, "rb").each_line do |line| ::File.open(wordlist, "rb").each_line do |line|
@ -233,7 +233,7 @@ class Metasploit3 < Msf::Auxiliary
if (query1) if (query1)
query1.answer.each do |rr| query1.answer.each do |rr|
if rr.class == Net::DNS::RR::A if rr.class == Net::DNS::RR::A
print_status("Host Name: #{line.chomp}.#{target} IP Address: #{rr.address.to_s}") print_status("Hostname: #{line.chomp}.#{target} IP address: #{rr.address.to_s}")
report_note(:host => rr.address.to_s, report_note(:host => rr.address.to_s,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
@ -249,7 +249,7 @@ class Metasploit3 < Msf::Auxiliary
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
def bruteipv6(target, wordlist, nssrv) def bruteipv6(target, wordlist, nssrv)
print_status("Brute Forcing IPv6 addresses against Domain #{target}") print_status("Bruteforcing IPv6 addresses against domain #{target}")
arr = [] arr = []
i, a = 0, [] i, a = 0, []
arr = IO.readlines(wordlist) arr = IO.readlines(wordlist)
@ -261,7 +261,7 @@ class Metasploit3 < Msf::Auxiliary
if (query1) if (query1)
query1.answer.each do |rr| query1.answer.each do |rr|
if rr.class == Net::DNS::RR::AAAA if rr.class == Net::DNS::RR::AAAA
print_status("Host Name: #{line.chomp}.#{target} IPv6 Address: #{rr.address.to_s}") print_status("Hostname: #{line.chomp}.#{target} IPv6 Address: #{rr.address.to_s}")
report_note(:host => rr.address.to_s, report_note(:host => rr.address.to_s,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
@ -280,7 +280,7 @@ class Metasploit3 < Msf::Auxiliary
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
def reverselkp(iprange,nssrv) def reverselkp(iprange,nssrv)
print_status("Running Reverse Lookup against ip range #{iprange}") print_status("Running reverse lookup against IP range #{iprange}")
if not nssrv.nil? if not nssrv.nil?
@res.nameserver = (nssrv) @res.nameserver = (nssrv)
end end
@ -295,7 +295,7 @@ class Metasploit3 < Msf::Auxiliary
begin begin
query = @res.query(tip) query = @res.query(tip)
query.each_ptr do |addresstp| query.each_ptr do |addresstp|
print_status("Host Name: #{addresstp} IP Address: #{tip.to_s}") print_status("Hostname: #{addresstp} IP address: #{tip.to_s}")
report_note(:host => tip, report_note(:host => tip,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
@ -323,7 +323,7 @@ class Metasploit3 < Msf::Auxiliary
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
#SRV Record Enumeration #SRV Record Enumeration
def srvqry(dom,nssrv) def srvqry(dom,nssrv)
print_status("Enumerating SRV Records for #{dom}") print_status("Enumerating SRV records for #{dom}")
i, a = 0, [] i, a = 0, []
#Most common SRV Records #Most common SRV Records
srvrcd = [ srvrcd = [
@ -350,7 +350,7 @@ class Metasploit3 < Msf::Auxiliary
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
#For Performing Zone Transfers #For Performing Zone Transfers
def axfr(target, nssrv) def axfr(target, nssrv)
print_status("Performing Zone Transfer against all nameservers in #{target}") print_status("Performing zone transfer against all nameservers in #{target}")
if not nssrv.nil? if not nssrv.nil?
@res.nameserver=(nssrv) @res.nameserver=(nssrv)
end end
@ -358,7 +358,7 @@ class Metasploit3 < Msf::Auxiliary
query = @res.query(target, "NS") query = @res.query(target, "NS")
if (query.answer.length != 0) if (query.answer.length != 0)
(query.answer.select { |i| i.class == Net::DNS::RR::NS}).each do |nsrcd| (query.answer.select { |i| i.class == Net::DNS::RR::NS}).each do |nsrcd|
print_status("Testing Nameserver: #{nsrcd.nsdname}") print_status("Testing nameserver: #{nsrcd.nsdname}")
nssrvquery = @res.query(nsrcd.nsdname, "A") nssrvquery = @res.query(nsrcd.nsdname, "A")
begin begin
nssrvip = nssrvquery.answer[0].address.to_s nssrvip = nssrvquery.answer[0].address.to_s
@ -368,18 +368,18 @@ class Metasploit3 < Msf::Auxiliary
if zone.answer.length != 0 if zone.answer.length != 0
namesrvips = @res.query(nsrcd.nsdname,"A") namesrvips = @res.query(nsrcd.nsdname,"A")
nsip = namesrvips.answer[0] nsip = namesrvips.answer[0]
print_status("Zone Transfer Successful") print_status("Zone transfer successful")
report_note(:host => nsip.address.to_s, report_note(:host => nsip.address.to_s,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
:port => 53 , :port => 53 ,
:type => 'dns.enum', :type => 'dns.enum',
:data => "Zone Transfer Successful") :data => "Zone transfer successful")
#Prints each record according to its type #Prints each record according to its type
zone.answer.each do |rr| zone.answer.each do |rr|
case rr.type case rr.type
when "A" when "A"
print_status("Name: #{rr.name} IP Address: #{rr.address} Record: A ") print_status("Name: #{rr.name} IP address: #{rr.address} Record: A ")
report_note(:host => rr.address.to_s, report_note(:host => rr.address.to_s,
:proto => 'udp', :proto => 'udp',
:sname => 'dns', :sname => 'dns',
@ -453,10 +453,10 @@ class Metasploit3 < Msf::Auxiliary
end end
end end
else else
print_error("Zone Transfer Failed") print_error("Zone transfer failed")
end end
rescue rescue
print_error("Zone Transfer Failed") print_error("Zone transfer failed")
end end
end end
@ -482,15 +482,15 @@ class Metasploit3 < Msf::Auxiliary
end end
if(datastore['ENUM_BRT']) if(datastore['ENUM_BRT'])
if wldcrd & datastore['STOP_WLDCRD'] if wldcrd and datastore['STOP_WLDCRD']
print_status("Wildcard Record Found!") print_error("Wildcard record found!")
else else
dnsbrute(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS']) dnsbrute(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])
end end
end end
if(datastore['ENUM_IP6']) if(datastore['ENUM_IP6'])
if wldcrd & datastore['STOP_WLDCRD'] if wldcrd and datastore['STOP_WLDCRD']
print_status("Wildcard Record Found!") print_status("Wildcard Record Found!")
else else
bruteipv6(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS']) bruteipv6(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])