Downloaded 469 times
Uploaded byLeonardo Nve Egea
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
This document discusses exploiting changes to DNS server configurations to intercept network traffic. It begins by introducing the speaker and their background in security research. Then it outlines normal exploitation procedures like CSRF, default passwords, and rogue DSLAMs. The document explores using tools like Metasploit, Dnsmasq and Bind to hijack DNS servers and redirect traffic. It discusses obstacles like SSL certificates and ways to improve attacks using features like DNS load balancing. The document demonstrates a proof of concept tool called dns2proxy that can spoof and redirect DNS responses. It also discusses defeating protections like HSTS and exploring attacks using protocols like UDP. In conclusion, the document advocates that improved DNS hijacking using multiple tools can capture more information than
More Related Content
Similar to OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
OFFENSIVE: Exploiting DNS servers changes BlackHat Asia 2014
- 1. OFFENSIVE: Exploiting changes onDNS server configuration Leonardo Nve Egea lnve@s21sec.com @leonardonve
- 2. • Security researchersince… (a lot of time) in SPAIN. • Pentester, Incident investigator & security researcher. • At the Offensive side (more funny). • I love protocol level. About me
- 3.
- 4.
- 5.
- 6.
- 7. • CSRF/XSS. • Insufficientauthorization. • SNMP/TFTP. • Default password + external administration. • Cracking wifi passwords + default password. • Command line DNS change. • Rogue DSLAM. • Malware. How.
- 8.
- 9. • Metasploit. • Dnsmasq. •Bind server. Tools.
- 10. • Invisible proxy. –Burp suite, mitmproxy • SSLstrip. • HTML injection. – BeEF – Exploit kits • Bouncing to known servers. – SSLsplit • Fake web servers. – defacing. – Phishing • Sniffing data. Then.
- 11.
- 12. • SSL certificates(Critical). Obstacles.
- 13. • SSL certificatepinning / EMET (Critical). Obstacles.
- 14. • HSTS +Preloaded HSTS sites (Non critical). Obstacles.
- 15. • SSH signaturesfailure (Critical). Obstacles.
- 16. • POP3/SMTP Banner(Non critical problem). • FTP Banner (This can be critical). • Limited host interception. • Limited protocol interception. Obstacles.
- 17. • Limited ofhosts interception. • Time to study IP communication manners. • Limited cleartext protocols interception. • HTTPS. • Accept the loose a lot of information. Limitations.
- 18. EXPLOITATION (II) IMPROVE THEATTACK PROCEDURE
- 19. • Discretion. • Improvedata acquisitions from time 0. Objectives.
- 20. • A DNSfeature for high availability and Load Balancing: Improve the attack.
- 21. Improve the attack. DHCPREQ DHCP RESP with Fake DNS Server DNS A Request DNS A Request DNS Response DNS Response = IP attacker server1 + IP attacker server2 + DNS Resp Short TTL SYN port=xxx RST ACK port =xxx SYN port=xxx SYN port=xxx SYN ACK port=xxx SYN ACK port=xxx DATA DATA
- 22. • On port80 the attacker can put a invisible proxy. • The attacker can reject SSL ports always because the client will later connect to the real server. • Other connections data will be forward through the evil server since the first moment. • And there is a tool. Improve the attack.
- 23. • dns2proxy (stillin beta). • Full in python (PyDNS). • Permit spoof, direct forwarding and add IPs to the response. • Interact directly with iptables to forward connections. https://github.com/LeonardoNve/dns2proxy Tool.
- 24.
- 25. DEMO (or video ifdemo effect ;)
- 26. • Limited ofhosts interception. • Time to study IP communication manners. • Limited cleartext protocol interception. • HTTPS. • Accept the loose a lot of information. Previous limitations.
- 27.
- 28.
- 29. • HSTS +Preloaded HSTS sites (Non critical). Obstacles.
- 30. • Strict TransportSecurity based in domain names predefined or not. • Change HTTPS to HTTP. • Also change domain names to connect based on predefined rules. • DNS Server can resolve based on these predefined rules. • HSTS. https://github.com/LeonardoNve/sslstrip2.git SSLStrip+ to defeat HSTS.
- 31. DEMO (or video ifdemo effect…)
- 32. SSL in general •You must take advantage with other factors/vulnerabilities
- 33. • Downgrade attacks. •JavaScript infections. http://media.blackhat.com/bh-us- 12/Briefings/Alonso/BH_US_12_Alonso_Owning_Bad_Guys_Slides.pdf • For decoding ciphered protocols, go there: More posibilities.
- 34. • With UDPthe application have the control over the communication not the OS. • If this application resend a lost UDP packet, we have it! If not… • Dns2proxy is a PoC and only control TCP but it is really easy extend it too UDP. UDP?
- 35.
- 36. • Improve DNSserver configurations hijacks with two tools. • Much information capture than typical attacks. • Old protocols – Old security. • New protocols + Old protocols – Old security+ • Solutions… DNSSEC. Conclusions.
- 37. THANKs. Miguel Hernandez The manwho first thought `Let’s put a default password. Then they can change it `