1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7

8
  def initialize
9
    super(
10
      'Name' => 'VSploit DNS Beaconing Emulation',
11
      'Description' => 'This module takes a list of domains and emulates malicious DNS beaconing.',
12
      'Author' => 'MJC',
13
      'License' => MSF_LICENSE,
14
      'Notes' => {
15
        'Stability' => [CRASH_SAFE],
16
        'SideEffects' => [IOC_IN_LOGS],
17
        'Reliability' => []
18
      }
19
    )
20
    register_options(
21
      [
22
        OptString.new('DOMAINS', [ true, 'Separate domains by whitespace']),
23
        OptString.new('DNS_SERVER', [false, 'Specifies a DNS Server']),
24
        OptInt.new('COUNT', [false, 'Number of intervals to loop', 2]),
25
        OptInt.new('DELAY', [false, 'Delay in seconds between intervals', 3])
26
      ]
27
    )
28
  end
29

30
  def run
31
    @res = Net::DNS::Resolver.new
32
    # @res.retry = 2
33

34
    if datastore['DNS_SERVER']
35
      @res.nameservers = datastore['DNS_SERVER']
36
    end
37

38
    count = 0
39

40
    while count < datastore['COUNT']
41

42
      domain = datastore['DOMAINS'].split(/[\s,]+/)
43
      domain.each do |name|
44
        query = @res.query(name, 'A')
45
        time = Time.new
46
        time = time.strftime('%Y-%m-%d %H:%M:%S')
47
        print_status("#{time} - DNS Query sent for => #{name}")
48
        if query.answer.empty?
49
          print_error("#{time} - #{name} => No Record Found")
50
        else
51
          a = query.answer[0].to_s.split(/[\s,]+/)
52
          print_status("#{time} - #{name} => #{a[-1]}")
53
        end
54
      end
55
      unless count == (datastore['COUNT'] - 1)
56
        time = Time.new
57
        time = time.strftime('%Y-%m-%d %H:%M:%S')
58
        print_status("#{time} - Waiting #{datastore['DELAY']} seconds to beacon")
59
        select(nil, nil, nil, datastore['DELAY'])
60
      end
61
      count += 1
62
    end
63
  end
64
end
65

66