133 lines
4.0 KiB
Ruby
133 lines
4.0 KiB
Ruby
##
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'msf/core'
|
|
require "net/dns/resolver"
|
|
require 'rex'
|
|
|
|
class Metasploit3 < Msf::Auxiliary
|
|
include Msf::Auxiliary::Report
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'DNS Brutefoce Enumeration',
|
|
'Description' => %q{
|
|
This module uses a dictionary to perform a bruteforce attack to enumerate
|
|
hostnames and subdomains available under a given domain.
|
|
},
|
|
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>' ],
|
|
'License' => BSD_LICENSE
|
|
))
|
|
|
|
register_options(
|
|
[
|
|
OptString.new('DOMAIN', [ true, "The target domain name"]),
|
|
OptAddress.new('NS', [ false, "Specify the name server to use for queries, otherwise use the system DNS" ]),
|
|
OptPath.new('WORDLIST', [ true, "Wordlist file for domain name brute force.",
|
|
File.join(Msf::Config.data_directory, "wordlists", "namelist.txt")])
|
|
], self.class)
|
|
|
|
register_advanced_options(
|
|
[
|
|
OptInt.new('RETRY', [ false, "Number of tries to resolve a record if no response is received.", 2]),
|
|
OptInt.new('RETRY_INTERVAL', [ false, "Number of seconds to wait before doing a retry.", 2]),
|
|
OptInt.new('THREADS', [ true, "Number of threads", 1])
|
|
], self.class)
|
|
end
|
|
|
|
def run
|
|
print_status("Enumerating #{datastore['DOMAIN']}")
|
|
@res = Net::DNS::Resolver.new()
|
|
@res.retry = datastore['RETRY'].to_i unless datastore['RETRY'].nil?
|
|
@res.retry_interval = datastore['RETRY_INTERVAL'].to_i unless datastore['RETRY_INTERVAL'].nil?
|
|
wildcard(datastore['DOMAIN'])
|
|
switchdns() unless datastore['NS'].nil?
|
|
dnsbrt(datastore['DOMAIN'])
|
|
end
|
|
|
|
def wildcard(target)
|
|
rendsub = rand(10000).to_s
|
|
query = @res.query("#{rendsub}.#{target}", "A")
|
|
if query.answer.length != 0
|
|
print_status("This Domain has wild-cards enabled!!")
|
|
query.answer.each do |rr|
|
|
print_warning("Wild-card IP for #{rendsub}.#{target} is: #{rr.address.to_s}") if rr.class != Net::DNS::RR::CNAME
|
|
end
|
|
return true
|
|
else
|
|
return false
|
|
end
|
|
end
|
|
|
|
def get_ip(host)
|
|
results = []
|
|
query = @res.search(host, "A")
|
|
if (query)
|
|
query.answer.each do |rr|
|
|
if rr.type == "CNAME"
|
|
results = results + get_ip(rr.cname)
|
|
else
|
|
record = {}
|
|
record[:host] = host
|
|
record[:type] = "AAAA"
|
|
record[:address] = rr.address.to_s
|
|
results << record
|
|
end
|
|
end
|
|
end
|
|
query1 = @res.search(host, "AAAA")
|
|
if (query1)
|
|
query1.answer.each do |rr|
|
|
if rr.type == "CNAME"
|
|
results = results + get_ip(rr.cname)
|
|
else
|
|
record = {}
|
|
record[:host] = host
|
|
record[:type] = "AAAA"
|
|
record[:address] = rr.address.to_s
|
|
results << record
|
|
end
|
|
end
|
|
end
|
|
return results
|
|
end
|
|
|
|
def switchdns()
|
|
print_status("Using DNS server: #{datastore['NS']}")
|
|
@res.nameserver=(datastore['NS'])
|
|
@nsinuse = datastore['NS']
|
|
end
|
|
|
|
def dnsbrt(domain)
|
|
print_status("Performing bruteforce against #{domain}")
|
|
queue = []
|
|
File.open(datastore['WORDLIST'], 'rb').each_line do |testd|
|
|
queue << testd.strip
|
|
end
|
|
while(not queue.empty?)
|
|
tl = []
|
|
1.upto(datastore['THREADS']) do
|
|
tl << framework.threads.spawn("Module(#{self.refname})-#{domain}", false, queue.shift) do |testf|
|
|
Thread.current.kill if not testf
|
|
vprint_status("Testing #{testf}.#{domain}")
|
|
get_ip("#{testf}.#{domain}").each do |i|
|
|
print_good("Host #{i[:host]} with address #{i[:address]} found")
|
|
report_host(
|
|
:host => i[:address].to_s,
|
|
:name => i[:host].gsub(/\.$/,'')
|
|
)
|
|
end
|
|
end
|
|
end
|
|
if(tl.length == 0)
|
|
break
|
|
end
|
|
tl.first.join
|
|
tl.delete_if { |t| not t.alive? }
|
|
end
|
|
end
|
|
end
|
|
|