## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' require "net/dns/resolver" require 'rex' class MetasploitModule < Msf::Auxiliary include Msf::Module::Deprecated include Msf::Auxiliary::Report deprecated(Date.new(2016, 6, 12), 'auxiliary/gather/enum_dns') def initialize(info = {}) super(update_info(info, 'Name' => 'DNS Brutefoce Enumeration', 'Description' => %q{ This module uses a dictionary to perform a bruteforce attack to enumerate hostnames and subdomains available under a given domain. }, 'Author' => [ 'Carlos Perez ' ], 'License' => BSD_LICENSE )) register_options( [ OptString.new('DOMAIN', [ true, "The target domain name"]), OptAddress.new('NS', [ false, "Specify the name server to use for queries, otherwise use the system DNS" ]), OptPath.new('WORDLIST', [ true, "Wordlist file for domain name brute force.", File.join(Msf::Config.data_directory, "wordlists", "namelist.txt")]) ], self.class) register_advanced_options( [ OptInt.new('RETRY', [ false, "Number of tries to resolve a record if no response is received.", 2]), OptInt.new('RETRY_INTERVAL', [ false, "Number of seconds to wait before doing a retry.", 2]), OptInt.new('THREADS', [ true, "Number of threads", 1]) ], self.class) end def run print_status("Enumerating #{datastore['DOMAIN']}") @res = Net::DNS::Resolver.new() @res.retry = datastore['RETRY'].to_i unless datastore['RETRY'].nil? @res.retry_interval = datastore['RETRY_INTERVAL'].to_i unless datastore['RETRY_INTERVAL'].nil? wildcard(datastore['DOMAIN']) switchdns() unless datastore['NS'].nil? dnsbrt(datastore['DOMAIN']) end def wildcard(target) rendsub = rand(10000).to_s query = @res.query("#{rendsub}.#{target}", "A") if query.answer.length != 0 print_status("This Domain has wild-cards enabled!!") query.answer.each do |rr| print_warning("Wild-card IP for #{rendsub}.#{target} is: #{rr.address.to_s}") if rr.class != Net::DNS::RR::CNAME end return true else return false end end def get_ip(host) results = [] query = @res.search(host, "A") if (query) query.answer.each do |rr| if rr.type == "CNAME" results = results + get_ip(rr.cname) else record = {} record[:host] = host record[:type] = "AAAA" record[:address] = rr.address.to_s results << record end end end query1 = @res.search(host, "AAAA") if (query1) query1.answer.each do |rr| if rr.type == "CNAME" results = results + get_ip(rr.cname) else record = {} record[:host] = host record[:type] = "AAAA" record[:address] = rr.address.to_s results << record end end end return results end def switchdns() print_status("Using DNS server: #{datastore['NS']}") @res.nameserver=(datastore['NS']) @nsinuse = datastore['NS'] end def dnsbrt(domain) print_status("Performing bruteforce against #{domain}") queue = [] File.open(datastore['WORDLIST'], 'rb').each_line do |testd| queue << testd.strip end while(not queue.empty?) tl = [] 1.upto(datastore['THREADS']) do tl << framework.threads.spawn("Module(#{self.refname})-#{domain}", false, queue.shift) do |testf| Thread.current.kill if not testf vprint_status("Testing #{testf}.#{domain}") get_ip("#{testf}.#{domain}").each do |i| print_good("Host #{i[:host]} with address #{i[:address]} found") report_host( :host => i[:address].to_s, :name => i[:host].gsub(/\.$/,'') ) end end end if(tl.length == 0) break end tl.first.join tl.delete_if { |t| not t.alive? } end end end