metasploit-gs/lib/msf/core/exploit/dns/server.rb

# -*- coding: binary -*-
require 'msf/core'
require 'rex/proto/dns'
require 'msf/core/exploit/dns/common'

module Msf

###
#
# This module exposes methods for querying a remote DNS service
#
###
module Exploit::Remote::DNS
module Server
  include Exploit::Remote::DNS::Common
  include Exploit::Remote::SocketServer

  #
  # Initializes an exploit module that serves DNS requests
  #
  def initialize(info = {})
    super

    register_options(
      [
        OptPort.new('SRVPORT', [true, 'The local port to listen on.', 53]),
        OptString.new('STATIC_ENTRIES', [ false, "DNS domain search list (hosts file or space/semicolon separate entries)"]),
        OptBool.new('DISABLE_RESOLVER', [ false, "Disable DNS request forwarding", false]),
        OptBool.new('DISABLE_NS_CACHE', [ false, "Disable DNS response caching", false])
      ], Exploit::Remote::DNS::Server
    )

    register_advanced_options(
      [
        OptBool.new('DnsServerUdp', [true, "Serve UDP DNS requests", true]),
        OptBool.new('DnsServerTcp', [true, "Serve TCP DNS requests", false])
      ], Exploit::Remote::DNS::Server
    )
  end

  attr_accessor :service # :nodoc:

  #
  # Process static entries
  #
  # @param entries [String] Filename or String containing static entries
  # @param type [String] Type of record for which to add static entries
  #
  # @return [Array] List of static entries in the cache
  def add_static_hosts(entries = datastore['STATIC_ENTRIES'], type = 'A')
    return if entries.nil? or entries.empty?
    if File.file?(File.expand_path(entries))
      data = File.read(File.expand_path(entries)).split("\n")
    else
      data = entries.split(';')
    end
    data.each do |entry|
      next if entry.gsub(/\s/,'').empty?
      addr, names = entry.split(' ', 2)
      names.split.each do |name|
        name << '.' unless name[-1] == '.' or name == '*'
        service.cache.add_static(name, addr, type)
      end
    end
    service.cache.records.select {|r,e| e == 0}
  end

  #
  # Flush all static entries
  #
  def flush_static_hosts
    data.cache.records.select {|r,e| e == 0}.each do |flush|
      data.cache.delete(flush)
    end
  end

  #
  # Flush cache entries
  # @param static [TrueClass, FalseClass] flush static hosts
  def flush_cache(static = false)
    self.service.cache.stop(true)
    flush_static_hosts if static
    self.service.cache.start
  end

  #
  # Handle incoming requests
  # Override this method in modules to take flow control
  #
  def on_dispatch_request(cli, data)
    service.default_dispatch_request(cli,data)
  end

  #
  # Handle incoming requests
  # Override this method in modules to take flow control
  #
  def on_send_response(cli, data)
    cli.write(data)
  end

  #
  # Starts the server
  #
  def start_service
    begin

      comm = _determine_server_comm
      self.service = Rex::ServiceManager.start(
        Rex::Proto::DNS::Server,
        datastore['SRVHOST'],
        datastore['SRVPORT'],
        datastore['DnsServerUdp'],
        datastore['DnsServerTcp'],
        (use_resolver? ? setup_resolver : false),
        comm,
        {'Msf' => framework, 'MsfExploit' => self}
      )

      self.service.dispatch_request_proc = Proc.new do |cli, data|
        on_dispatch_request(cli,data)
      end
      self.service.send_response_proc = Proc.new do |cli, data|
        on_send_response(cli,data)
      end

      add_static_hosts
      self.service.start(!datastore['DISABLE_NS_CACHE'])

    rescue ::Errno::EACCES => e
      raise Rex::BindFailed.new(e.message)
    end
  end

  #
  # Stops the server
  # @param destroy [TrueClass,FalseClass] Dereference the server object
  def stop_service(destroy = false)
    Rex::ServiceManager.stop_service(self.service) if self.service
    if destroy
      @dns_resolver = nil if @dns_resolver
      self.service = nil if self.service
    end
  end

  #
  # Resets the DNS server
  #
  def reset_service
    stop_service(true)
    start_service
  end

  #
  # Determines if resolver is available and configured for use
  #
  def use_resolver?
    !datastore['DISABLE_RESOLVER'] and self.respond_to?(:setup_resolver)
  end

end
end
end