mogwailabs/dnsrebinder

A python based minimal DNS server to test/verify DNS rebinding attacks

DNSrebinder

DNSrebinder is a minimal DNS server that can be used to test/verify DNS rebinding vulnerabilities. It is based on the Python DNS library dnslib. DNSrebinder allows you to define various settings on the command line, including the number of requests before the actual rebinding should occur.

Installation

The recommended way is to use a Python virtual environment

python3 -m venv venv
source venv/bin/activate
pip3 install -r requirements.txt

On systems that are using systemd, you need to temporary disable systemd-resolved as this service listen on port 53:

sudo systemctl stop systemd-resolved

To re-enable it

sudo systemctl start systemd-resolved

Please make sure that you have a DNS-NS record that points to the system that is running DNSrebinder.

Usage

Example usage:

$ python3 dnsrebinder.py --domain rebind.mydomain.eu. --rebind 127.0.0.1 --ip 8.8.8.8 --counter 2
...

This starts a DNS server on port 53 listening on UDP and TCP. The first two(--counter 2) requests will be answered with 8.8.8.8. Every request after that will be answered with the rebind address 127.0.0.1 (--rebind 127.0.0.1).

Options overview:

$ python3 dnsrebinder.py -h
usage: dnsrebinder.py [-h] [--port PORT] [--tcp] [--udp] [--domain DOMAIN]
                     [--ttl TTL] [--ip IP] [--rebind REBIND]
                     [--counter COUNTER]

Start a DNS implemented in Python. Usually DNSs use UDP on port 53.

optional arguments:
  -h, --help         show this help message and exit
  --port PORT        The port to listen on.
  --tcp              Listen to TCP connections.
  --udp              Listen to UDP datagrams.
  --domain DOMAIN    The domain to listen for
  --ttl TTL          TTL value of DNS responses
  --bind             IP Adress for server to listen on
  --ip IP            IP Adress used to respond
  --rebind REBIND    IP address for rebind
  --counter COUNTER  Number of requests before rebinding

Contributing

Feel free to contribute.

Authors

• Timo Müller - Original script - mtimo44
• Hans-Martin Münch - Re-Write with dnslib - h0ng10
• Karsten Zeides - Command line options, cleanup zeides

See also the list of contributors who participated in this project.

dnsrebinder's Issues

rebind server crashes on ubuntu 20.04.4 lts with python 3.8.10

On a fully updated ubuntu 20.4.4 lts with python 3.8.10 the server crashes with the following stack trace:

 ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45871
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;rebind.psaux.fun.              IN      A
;; ANSWER SECTION:
rebind.psaux.fun.       1       IN      A       127.0.0.1
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/dnslib/dns.py", line 683, in parse
    qname = buffer.decode_name()
  File "/usr/local/lib/python3.8/dist-packages/dnslib/label.py", line 255, in decode_name
    l = self.get(length)
  File "/usr/local/lib/python3.8/dist-packages/dnslib/buffer.py", line 63, in get
    raise BufferError("Not enough bytes [offset=%d,remaining=%d,requested=%d]" %
dnslib.buffer.BufferError: Not enough bytes [offset=13,remaining=35,requested=112]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "dnsrebinder.py", line 116, in handle
    self.send_data(dns_response(data, self.server.domain, self.server.ip, self.server.rebind, self.server.ttl, self.server.counterMax, self.server.hostCounter))
  File "dnsrebinder.py", line 50, in dns_response
    request = DNSRecord.parse(data)
  File "/usr/local/lib/python3.8/dist-packages/dnslib/dns.py", line 107, in parse
    questions.append(DNSQuestion.parse(buffer))
  File "/usr/local/lib/python3.8/dist-packages/dnslib/dns.py", line 687, in parse
    raise DNSError("Error unpacking DNSQuestion [offset=%d]: %s" % (
dnslib.dns.DNSError: Error unpacking DNSQuestion [offset=13]: Not enough bytes [offset=13,remaining=35,requested=112]
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/dnslib/dns.py", line 683, in parse
    qname = buffer.decode_name()
  File "/usr/local/lib/python3.8/dist-packages/dnslib/label.py", line 255, in decode_name
    l = self.get(length)
  File "/usr/local/lib/python3.8/dist-packages/dnslib/buffer.py", line 63, in get
    raise BufferError("Not enough bytes [offset=%d,remaining=%d,requested=%d]" %
dnslib.buffer.BufferError: Not enough bytes [offset=13,remaining=35,requested=112]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "dnsrebinder.py", line 116, in handle
    self.send_data(dns_response(data, self.server.domain, self.server.ip, self.server.rebind, self.server.ttl, self.server.counterMax, self.server.hostCounter))
  File "dnsrebinder.py", line 50, in dns_response
    request = DNSRecord.parse(data)
  File "/usr/local/lib/python3.8/dist-packages/dnslib/dns.py", line 107, in parse
    questions.append(DNSQuestion.parse(buffer))
  File "/usr/local/lib/python3.8/dist-packages/dnslib/dns.py", line 687, in parse
    raise DNSError("Error unpacking DNSQuestion [offset=%d]: %s" % (
dnslib.dns.DNSError: Error unpacking DNSQuestion [offset=13]: Not enough bytes [offset=13,remaining=35,requested=112]```

Add support if the client asks for IPv6

The DNS server currently does not answer correctly for AAAA requests

feature: add --bind flag for specifying the network interface

It would be good to to have a --bind flag so we can choose a network interface.
This means we can run DNSrebinder on a server with two or more IP-addresses, thereby allowing for running rebinder without first stopping the local resolver.