{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6611","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6611/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6611/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6611/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6611","id":136503932,"number":6611,"title":"Implement native DNS for Msf Namespace","user":{"login":"sempervictus","id":1331084,"avatar_url":"https://avatars.githubusercontent.com/u/1331084?v=3","gravatar_id":"","url":"https://api.github.com/users/sempervictus","html_url":"https://github.com/sempervictus","followers_url":"https://api.github.com/users/sempervictus/followers","following_url":"https://api.github.com/users/sempervictus/following{/other_user}","gists_url":"https://api.github.com/users/sempervictus/gists{/gist_id}","starred_url":"https://api.github.com/users/sempervictus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sempervictus/subscriptions","organizations_url":"https://api.github.com/users/sempervictus/orgs","repos_url":"https://api.github.com/users/sempervictus/repos","events_url":"https://api.github.com/users/sempervictus/events{/privacy}","received_events_url":"https://api.github.com/users/sempervictus/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/library","name":"library","color":"fad8c7"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-02-25T20:36:12Z","updated_at":"2016-03-21T08:05:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6611","html_url":"https://github.com/rapid7/metasploit-framework/pull/6611","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6611.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6611.patch"},"body":"Built atop the Rex::Proto::DNS work to implement mixins for client\r\nand server functionality, providing common interfaces for querying\r\ndomain name servers, and providing domain name services to clients\r\nacross Rex sockets. Fully functional native DNS server module is\r\nincluded to demonstrate functionality, serve as a spoofing DNS\r\nserver, a collecting proxy, or any other number of DNS functions.\r\n\r\n-----\r\n\r\nAt the core of this work is a Rex::Proto::DNS::Resolver object\r\ndescended from Net::DNS::Resolver with overrides and alterations\r\nfor using Rex sockets. The sockets implementation has been in use\r\ninternally for a number of years and is well tested. Changes have\r\nbeen made to provider better interface for higher level components.\r\n\r\nThe resolver provides forward lookup capability for the server\r\n(Rex::Proto::DNS::Server) which also implements a self-pruning\r\nCache subclass capable of holding static entries. The server can\r\noperate in TCP or UDP mode, and provides a common abstraction for\r\naddressing TCP and UDP clients by passing a Rex::Socket::Udp\r\nmock client around with the data object to higher level consumers.\r\nFinally, as is standard practice when building full service objects\r\nfrom Rex to Msf, the server allows consumers to efficiently take\r\nexecution control at the request and response handlers by passing\r\nProcs into the constructor (or manually assigning at runtime) for\r\nexecution instead of the default call chain.\r\n\r\nThe service, lookup, and caching functionality is encapsulated and\r\nstands on its own to be used by consumers other than the standard\r\nMsf::Exploit::Remote namespaces. It is intended to serve as the\r\ndriver and transport handler for pending DNS tunnel transports,\r\nand can be used by exploit and auxiliary modules directly.\r\n\r\n-----\r\n\r\nThe Msf::Exploit::Remote namespace receives DNS, DNS::Client, and\r\nDNS::Server mixins providing common interfaces for Rex::Proto::DNS\r\nobjects. These mixins create convenience methods for executing\r\nqueries, serving requests, and configuring the Rex providers.\r\n\r\nDNS::Client mixin attempts to \"intelligently\" configure the client\r\nresolver's name servers and options from the data store. Accessor,\r\nquery, and configuration methods are provided in this mixin. Of\r\nnote are the wildcard and switchdns methods which were adapted\r\nfrom prior work by others (likely Carlos Perez) which can be used\r\nby numerous consumer modules. Consumers should use setup_client\r\nduring their run call to ensure the resolver is appropriately\r\nconfigured.\r\n\r\nDNS::Server mixin creates common service wrappers for modules to\r\nutilize along with a configuration mechanism analagous to the\r\none used by the Client mixin, called setup_server, and calling\r\nthe setup_client method if present. Note that when setup_server\r\nis called, the consumer does not need to call setup_resolver.\r\n\r\n------\r\n\r\nAt the framework module level, a native dns server is provided\r\nto showcase the mixin functionality and provide everything from\r\nnormal DNS services, to tunneling proxies (with cache disabled),\r\nspoofing services, and MITM functionality via the handler Procs\r\nfor requests and responses.\r\n\r\nUse auxiliary/server/dns/native_server to get started.\r\n\r\n-----\r\n\r\nTesting:\r\n  Basic local testing completed.\r\n  Needs to be checked for info leaks - we used to leak a lot.\r\n  Needs to be checked for functionality under varying configs.\r\n\r\nNotes:\r\n  We have a serious problem with the datastore somewhere in the\r\nMsf namespace. Datastore options must be validated with\r\noptions.validate(datastore) or they are all Strings, which\r\ncompletely destroys any type-dependent logic consuming\r\ndatastore values. This must be addressed separately and all\r\ncalls to options.validate(datastore) should be removed (other\r\nwork has included such calls as well, this just proved that\r\nthe problem exists upstream).\r\n\r\nFuture work:\r\n  Implement sessions transports atop the DNS infrastructure in\r\norder to provide native DNS tunneling."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/199165229","html_url":"https://github.com/rapid7/metasploit-framework/pull/6611#issuecomment-199165229","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6611","id":199165229,"user":{"login":"sempervictus","id":1331084,"avatar_url":"https://avatars.githubusercontent.com/u/1331084?v=3","gravatar_id":"","url":"https://api.github.com/users/sempervictus","html_url":"https://github.com/sempervictus","followers_url":"https://api.github.com/users/sempervictus/followers","following_url":"https://api.github.com/users/sempervictus/following{/other_user}","gists_url":"https://api.github.com/users/sempervictus/gists{/gist_id}","starred_url":"https://api.github.com/users/sempervictus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sempervictus/subscriptions","organizations_url":"https://api.github.com/users/sempervictus/orgs","repos_url":"https://api.github.com/users/sempervictus/repos","events_url":"https://api.github.com/users/sempervictus/events{/privacy}","received_events_url":"https://api.github.com/users/sempervictus/received_events","type":"User","site_admin":false},"created_at":"2016-03-21T08:05:18Z","updated_at":"2016-03-21T08:05:18Z","body":"#6692 uncovered a problem with using a UDPSocket as the client abstraction. Will push a commit come morning to port the MockDnsClient code into this branch to complete this work."}}