cleanup for dns_info
jvazquez-r7
parent
8a1874b4d1
commit
57e1d1baa5
|
|
@ -14,14 +14,16 @@ class Metasploit3 < Msf::Auxiliary
|
|||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'DNS Basic Information',
|
||||
'Description' => %q{
|
||||
This module enumerates basic DNS information for a given domain. Information
|
||||
enumerated is A, AAAA, NS and MX records for the given domain.
|
||||
'Name' => 'DNS Basic Information Enumeration',
|
||||
'Description' => %q{
|
||||
This module enumerates basic DNS information for a given domain. The module
|
||||
gets information regarding to A (addresses), AAAA (IPv6 addresses), NS (name
|
||||
servers), SOA (start of authority) and MX (mail servers) records for a given
|
||||
domain. In addition, this module retrieves information stored in TXT records.
|
||||
},
|
||||
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>' ],
|
||||
'License' => BSD_LICENSE
|
||||
))
|
||||
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>' ],
|
||||
'License' => BSD_LICENSE
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
|
|
@ -50,15 +52,15 @@ class Metasploit3 < Msf::Auxiliary
|
|||
end
|
||||
|
||||
wildcard(datastore['DOMAIN'])
|
||||
switchdns() if not datastore['NS'].nil?
|
||||
switchdns() unless datastore['NS'].nil? or datastore['NS'].empty?
|
||||
|
||||
get_ip(datastore['DOMAIN']).each do |r|
|
||||
print_good("#{r[:host]} #{r[:address]} #{r[:type]}")
|
||||
print_good("#{r[:host]} - Address #{r[:address]} found. Record type: #{r[:type]}")
|
||||
report_host(:host => r[:address])
|
||||
end
|
||||
|
||||
get_ns(datastore['DOMAIN']).each do |r|
|
||||
print_good("#{r[:host]} #{r[:address]} #{r[:type]}")
|
||||
print_good("#{datastore['DOMAIN']} - Name server #{r[:host]} (#{r[:address]}) found. Record type: #{r[:type]}")
|
||||
report_host(:host => r[:address], :name => r[:host])
|
||||
report_service(
|
||||
:host => r[:address],
|
||||
|
|
@ -69,12 +71,12 @@ class Metasploit3 < Msf::Auxiliary
|
|||
end
|
||||
|
||||
get_soa(datastore['DOMAIN']).each do |r|
|
||||
print_good("#{r[:host]} #{r[:address]} #{r[:type]}")
|
||||
print_good("#{datastore['DOMAIN']} - #{r[:host]} (#{r[:address]}) found. Record type: #{r[:type]}")
|
||||
report_host(:host => r[:address], :name => r[:host])
|
||||
end
|
||||
|
||||
get_mx(datastore['DOMAIN']).each do |r|
|
||||
print_good("#{r[:host]} #{r[:address]} #{r[:type]}")
|
||||
print_good("#{datastore['DOMAIN']} - Mail server #{r[:host]} (#{r[:address]}) found. Record type: #{r[:type]}")
|
||||
report_host(:host => r[:address], :name => r[:host])
|
||||
report_service(
|
||||
:host => r[:address],
|
||||
|
|
@ -85,15 +87,17 @@ class Metasploit3 < Msf::Auxiliary
|
|||
end
|
||||
|
||||
get_txt(datastore['DOMAIN']).each do |r|
|
||||
report_note(:host => datastore['DOMAIN'],
|
||||
:proto => 'UDP',
|
||||
:port => 53,
|
||||
:type => 'dns.info',
|
||||
:data => {:text => r[:text]})
|
||||
print_good("#{datastore['DOMAIN']} - Text info found: #{r[:text]}. Record type: #{r[:type]}")
|
||||
report_note(
|
||||
:host => datastore['DOMAIN'],
|
||||
:proto => 'udp',
|
||||
:port => 53,
|
||||
:type => 'dns.info',
|
||||
:data => {:text => r[:text]}
|
||||
)
|
||||
end
|
||||
end
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
def wildcard(target)
|
||||
rendsub = rand(10000).to_s
|
||||
query = @res.query("#{rendsub}.#{target}", "A")
|
||||
|
|
@ -101,11 +105,13 @@ class Metasploit3 < Msf::Auxiliary
|
|||
print_status("This Domain has Wild-cards Enabled!!")
|
||||
query.answer.each do |rr|
|
||||
print_status("Wild-card IP for #{rendsub}.#{target} is: #{rr.address.to_s}") if rr.class != Net::DNS::RR::CNAME
|
||||
report_note(:host => datastore['DOMAIN'],
|
||||
:proto => 'UDP',
|
||||
:port => 53,
|
||||
:type => 'dns.wildcard',
|
||||
:data => "Wildcard IP for #{rendsub}.#{target} is: #{rr.address.to_s}")
|
||||
report_note(
|
||||
:host => datastore['DOMAIN'],
|
||||
:proto => 'UDP',
|
||||
:port => 53,
|
||||
:type => 'dns.wildcard',
|
||||
:data => "Wildcard IP for #{rendsub}.#{target} is: #{rr.address.to_s}"
|
||||
)
|
||||
end
|
||||
return true
|
||||
else
|
||||
|
|
@ -113,11 +119,10 @@ class Metasploit3 < Msf::Auxiliary
|
|||
end
|
||||
end
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
def get_ip(host)
|
||||
results = []
|
||||
query = @res.search(host, "A")
|
||||
if (query)
|
||||
if query
|
||||
query.answer.each do |rr|
|
||||
record = {}
|
||||
record[:host] = host
|
||||
|
|
@ -127,7 +132,7 @@ class Metasploit3 < Msf::Auxiliary
|
|||
end
|
||||
end
|
||||
query1 = @res.search(host, "AAAA")
|
||||
if (query1)
|
||||
if query1
|
||||
query1.answer.each do |rr|
|
||||
record = {}
|
||||
record[:host] = host
|
||||
|
|
@ -139,94 +144,84 @@ class Metasploit3 < Msf::Auxiliary
|
|||
return results
|
||||
end
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
def get_ns(target)
|
||||
results = []
|
||||
query = @res.query(target, "NS")
|
||||
if (query)
|
||||
(query.answer.select { |i| i.class == Net::DNS::RR::NS}).each do |rr|
|
||||
get_ip(rr.nsdname).each do |r|
|
||||
record = {}
|
||||
record[:host] = rr.nsdname.gsub(/\.$/,'')
|
||||
record[:type] = "NS"
|
||||
record[:address] = r[:address].to_s
|
||||
results << record
|
||||
end
|
||||
end
|
||||
end
|
||||
return results
|
||||
end
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
def get_soa(target)
|
||||
results = []
|
||||
query = @res.query(target, "SOA")
|
||||
if (query)
|
||||
(query.answer.select { |i| i.class == Net::DNS::RR::SOA}).each do |rr|
|
||||
if Rex::Socket.dotted_ip?(rr.mname)
|
||||
record = {}
|
||||
record[:host] = rr.mname
|
||||
record[:type] = "SOA"
|
||||
record[:address] = rr.mname
|
||||
results << record
|
||||
else
|
||||
get_ip(rr.mname).each do |ip|
|
||||
record = {}
|
||||
record[:host] = rr.mname.gsub(/\.$/,'')
|
||||
record[:type] = "SOA"
|
||||
record[:address] = ip[:address].to_s
|
||||
results << record
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
return results
|
||||
end
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
def get_txt(target)
|
||||
results = []
|
||||
query = @res.query(target, "TXT")
|
||||
if (query)
|
||||
query.answer.each do |rr|
|
||||
return results if not query
|
||||
(query.answer.select { |i| i.class == Net::DNS::RR::NS}).each do |rr|
|
||||
get_ip(rr.nsdname).each do |r|
|
||||
record = {}
|
||||
print_good("Text: #{rr.txt}, TXT")
|
||||
record[:host] = target
|
||||
record[:text] = rr.txt
|
||||
record[:type] = "TXT"
|
||||
record[:host] = rr.nsdname.gsub(/\.$/,'')
|
||||
record[:type] = "NS"
|
||||
record[:address] = r[:address].to_s
|
||||
results << record
|
||||
end
|
||||
end
|
||||
return results
|
||||
end
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
def get_mx(target)
|
||||
def get_soa(target)
|
||||
results = []
|
||||
query = @res.query(target, "MX")
|
||||
if (query)
|
||||
(query.answer.select { |i| i.class == Net::DNS::RR::MX}).each do |rr|
|
||||
if Rex::Socket.dotted_ip?(rr.exchange)
|
||||
query = @res.query(target, "SOA")
|
||||
return results if not query
|
||||
(query.answer.select { |i| i.class == Net::DNS::RR::SOA}).each do |rr|
|
||||
if Rex::Socket.dotted_ip?(rr.mname)
|
||||
record = {}
|
||||
record[:host] = rr.mname
|
||||
record[:type] = "SOA"
|
||||
record[:address] = rr.mname
|
||||
results << record
|
||||
else
|
||||
get_ip(rr.mname).each do |ip|
|
||||
record = {}
|
||||
record[:host] = rr.exchange
|
||||
record[:type] = "MX"
|
||||
record[:address] = rr.exchange
|
||||
record[:host] = rr.mname.gsub(/\.$/,'')
|
||||
record[:type] = "SOA"
|
||||
record[:address] = ip[:address].to_s
|
||||
results << record
|
||||
end
|
||||
end
|
||||
end
|
||||
return results
|
||||
end
|
||||
|
||||
def get_txt(target)
|
||||
results = []
|
||||
query = @res.query(target, "TXT")
|
||||
return results if not query
|
||||
query.answer.each do |rr|
|
||||
record = {}
|
||||
record[:host] = target
|
||||
record[:text] = rr.txt
|
||||
record[:type] = "TXT"
|
||||
results << record
|
||||
end
|
||||
return results
|
||||
end
|
||||
|
||||
def get_mx(target)
|
||||
results = []
|
||||
query = @res.query(target, "MX")
|
||||
return results if not query
|
||||
(query.answer.select { |i| i.class == Net::DNS::RR::MX}).each do |rr|
|
||||
if Rex::Socket.dotted_ip?(rr.exchange)
|
||||
record = {}
|
||||
record[:host] = rr.exchange
|
||||
record[:type] = "MX"
|
||||
record[:address] = rr.exchange
|
||||
results << record
|
||||
else
|
||||
get_ip(rr.exchange).each do |ip|
|
||||
record = {}
|
||||
record[:host] = rr.exchange.gsub(/\.$/,'')
|
||||
record[:type] = "MX"
|
||||
record[:address] = ip[:address].to_s
|
||||
results << record
|
||||
else
|
||||
get_ip(rr.exchange).each do |ip|
|
||||
record = {}
|
||||
record[:host] = rr.exchange.gsub(/\.$/,'')
|
||||
record[:type] = "MX"
|
||||
record[:address] = ip[:address].to_s
|
||||
results << record
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
return results
|
||||
end
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
def switchdns()
|
||||
print_status("Using DNS server: #{datastore['NS']}")
|
||||
@res.nameserver=(datastore['NS'])
|
||||
|
|
|
|||
Loading…
Reference in New Issue