DNSForge: The Pentesting Tool That Automates Internal DNS Poisoning and Hash Capture
DNSForge is a network pentesting tool for responding to name resolution requests made to the authoritative DNS server in an internal network landscape, achieving interception and reuse of system credentials without user interaction. This tool is intended to be used alongside Responder. The original blog post for DNSForge can be found here
Attack Customization
One of 2 attack modes must be specified when using DNSForge:
Relay (Preferred)
In this mode, the tool expects the spoofing target (specified with -t or -tf) to be set to the victim client(s) (ex. employee/user workstation/laptop). This will cause the interception of packets on their way in from the authoritative nameserver to the victim clients and DNSForge will relay the server’s DNS response while forging/poisoning the attacker’s IP (specified with -p).
[pastacode lang=”bash” manual=”sudo%20dnsforge%20relay%20-i%20%3Cinterface%3E%20-p%20%3Cattacker%20IP%3E%20-t%20%3Cvictim%20client%3E%20-q%20wpad” message=”” highlight=”” provider=”manual”/]
Respond
In this mode, the tool expects the spoofing target (specified with -t or -tf) to be set to the authoritative nameserver (ex. DNS server/Domain Controller). This will cause interception of packets on their way out from the victim clients to the server and DNSForge will adequately respond to the client’s DNS request while forging/poisoning the attacker’s IP (specified with -p).
[pastacode lang=”bash” manual=”sudo%20dnsforge%20respond%20-i%20%3Cinterface%3E%20-p%20%3Cattacker%20IP%3E%20-t%20%3CDNS%20server%2Fdomain%20controller%3E%20-q%20wpad” message=”” highlight=”” provider=”manual”/]
Stealth (optional)
This option (-s) can be applied to both Relay and Respond attack modes. When applied, this option requests the SOA record from the authoritative DNS server and appends it to forged DNS responses for added stealth on networks with IDS/IPS devices. With this mode enabled, the tool produces DNS response messages that exactly match those generated from the authoritative DNS server.
[pastacode lang=”markup” manual=”sudo%20dnsforge%20relay%20-i%20%3Cinterface%3E%20-p%20%3Cattacker%20IP%3E%20-t%20%3Cvictim%20client%3E%20-q%20wpad%20-s%20-ds%20%3CDNS%20server%20IP%3E%20-d%20%3Cdomain%20name%3E” message=”” highlight=”” provider=”manual”/]
This tool lends itself in the context of an internal network that consists of Windows workstations and servers. DNSForge utilizes ARP spoofing to redirect DNS requests intended for the DNS server to the attacker’s host (when running in respond mode). Upon receiving DNS requests, DNSForge poisons the response with the attacker’s IP address and, if in stealth mode configuration, forges the DNS server’s SOA record. This induces victims to accept DNS responses from a seemingly legitimate source and performs an adversary-in-the-middle attack. Subsequently, Responder can be run to serve a malicious PAC file and capture hashes.
Sample scenario of poisoning DNS requests for WPAD issued by victim host:
- Setup DNS Forge to poison incoming requests:
sudo dnsforge relay -i <interface> -p <attacker IP> -t <victim client> -q wpad - Finally, run Responder to serve malicious WPAD file and capture hashes:
sudo responder -I <interface> -P
The tool can be supplied either a target IP with -t, a file with target IPs with -tf or the --no-arp-spoof flag that turns off ARP spoofing and lets the user decide the method of redirecting DNS packets to the attacker’s host. At least one of these options must be supplied.
In scenarios where the authoritative nameserver does not reside on the same subnet as the attacking host, DNSForge can be configured to perform ARP spoofing against the subnet gateway (either by explicitly supplying the gateway IP as a spoofing target or automatically when a target IP outside the selected interface’s subnet is supplied). Since this action can perform denial-of-service against victim clients on the same subnet, DNSForge performs additional checks to verify if IP forwarding is enabled on the attacking host. IP forwarding will ensure that the attacking host acts as the gateway itself and mantains network reliability by forwarding incoming packets to the subnet’s gateway IP.
The following command enables IP forwarding on Linux systems: sudo sysctl -w net.ipv4.ip_forward=1
Additionally, along with IP forwarding, the following iptables rule is recommended to ensure that only non-DNS traffic is forwarded: sudo iptables -A FORWARD -i <Interface> -p udp --dport 53 -j DROP
Alternatively, if the authoritative nameserver resides on a different subnet, consider utilizing the relay mode which intercepts DNS responses on their way from the legitimate server to the victim client.
Install
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
