sqlmap/lib/request/dns.py

165 lines
5.1 KiB
Python
Raw Normal View History

2019-03-21 16:00:09 +03:00
#!/usr/bin/env python2
"""
2019-01-05 23:38:52 +03:00
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
2017-10-11 15:50:46 +03:00
See the file 'LICENSE' for copying permission
"""
2019-01-22 03:20:27 +03:00
from __future__ import print_function
2019-05-07 12:00:50 +03:00
import codecs
2012-03-28 17:46:31 +04:00
import os
import re
import socket
import threading
2012-03-28 17:46:31 +04:00
import time
class DNSQuery(object):
"""
Used for making fake DNS resolution responses based on received
raw request
Reference(s):
http://code.activestate.com/recipes/491264-mini-fake-dns-server/
https://code.google.com/p/marlon-tools/source/browse/tools/dnsproxy/dnsproxy.py
"""
def __init__(self, raw):
self._raw = raw
self._query = ""
type_ = (ord(raw[2]) >> 3) & 15 # Opcode bits
2012-04-04 16:33:16 +04:00
if type_ == 0: # Standard query
i = 12
j = ord(raw[i])
2012-04-04 16:33:16 +04:00
while j != 0:
2013-01-10 16:18:44 +04:00
self._query += raw[i + 1:i + j + 1] + '.'
i = i + j + 1
j = ord(raw[i])
def response(self, resolution):
2012-04-04 17:24:58 +04:00
"""
Crafts raw DNS resolution response packet
"""
2012-03-28 17:46:31 +04:00
retVal = ""
if self._query:
2012-05-27 14:03:02 +04:00
retVal += self._raw[:2] # Transaction ID
retVal += "\x85\x80" # Flags (Standard query response, No error)
2012-03-28 17:46:31 +04:00
retVal += self._raw[4:6] + self._raw[4:6] + "\x00\x00\x00\x00" # Questions and Answers Counts
2012-05-27 14:03:02 +04:00
retVal += self._raw[12:(12 + self._raw[12:].find("\x00") + 5)] # Original Domain Name Query
2012-03-28 17:46:31 +04:00
retVal += "\xc0\x0c" # Pointer to domain name
2012-05-27 14:03:02 +04:00
retVal += "\x00\x01" # Type A
retVal += "\x00\x01" # Class IN
2012-05-28 23:50:12 +04:00
retVal += "\x00\x00\x00\x20" # TTL (32 seconds)
2012-05-27 14:03:02 +04:00
retVal += "\x00\x04" # Data length
2012-03-28 17:46:31 +04:00
retVal += "".join(chr(int(_)) for _ in resolution.split('.')) # 4 bytes of IP
2012-03-28 17:46:31 +04:00
return retVal
class DNSServer(object):
def __init__(self):
self._check_localhost()
self._requests = []
2012-03-28 17:46:31 +04:00
self._lock = threading.Lock()
2016-10-22 23:07:29 +03:00
try:
self._socket = socket._orig_socket(socket.AF_INET, socket.SOCK_DGRAM)
except AttributeError:
self._socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
2012-07-27 12:02:47 +04:00
self._socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
2012-03-30 17:20:29 +04:00
self._socket.bind(("", 53))
self._running = False
self._initialized = False
2012-03-30 17:20:29 +04:00
def _check_localhost(self):
response = ""
try:
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect(("", 53))
2019-05-07 12:00:50 +03:00
s.send(codecs.decode("6509012000010000000000010377777706676f6f676c6503636f6d00000100010000291000000000000000", "hex")) # A www.google.com
response = s.recv(512)
except:
pass
finally:
if response and "google" in response:
raise socket.error("another DNS service already running on *:53")
2012-04-03 14:10:33 +04:00
def pop(self, prefix=None, suffix=None):
2012-04-04 17:24:58 +04:00
"""
Returns received DNS resolution request (if any) that has given
prefix/suffix combination (e.g. prefix.<query result>.suffix.domain)
"""
retVal = None
2012-04-04 16:33:16 +04:00
with self._lock:
for _ in self._requests:
2017-10-31 13:38:09 +03:00
if prefix is None and suffix is None or re.search(r"%s\..+\.%s" % (prefix, suffix), _, re.I):
retVal = _
self._requests.remove(_)
break
2012-04-04 16:33:16 +04:00
return retVal
def run(self):
2012-04-04 17:24:58 +04:00
"""
Runs a DNSServer instance as a daemon thread (killed by program exit)
"""
def _():
try:
2012-03-30 17:20:29 +04:00
self._running = True
self._initialized = True
2012-04-04 16:33:16 +04:00
while True:
2012-03-30 17:20:29 +04:00
data, addr = self._socket.recvfrom(1024)
_ = DNSQuery(data)
2012-05-28 23:13:50 +04:00
self._socket.sendto(_.response("127.0.0.1"), addr)
2012-04-04 16:33:16 +04:00
2012-03-30 17:20:29 +04:00
with self._lock:
self._requests.append(_._query)
2012-04-04 16:33:16 +04:00
2012-03-30 17:20:29 +04:00
except KeyboardInterrupt:
raise
2012-04-04 16:33:16 +04:00
finally:
2012-03-30 17:20:29 +04:00
self._running = False
thread = threading.Thread(target=_)
thread.daemon = True
thread.start()
2012-03-28 17:46:31 +04:00
if __name__ == "__main__":
2012-04-04 16:49:45 +04:00
server = None
2012-03-28 17:46:31 +04:00
try:
2012-03-30 17:20:29 +04:00
server = DNSServer()
2012-03-28 17:46:31 +04:00
server.run()
2012-04-04 16:27:24 +04:00
while not server._initialized:
time.sleep(0.1)
2012-03-30 17:20:29 +04:00
while server._running:
while True:
_ = server.pop()
2012-04-04 16:27:24 +04:00
2012-03-30 17:20:29 +04:00
if _ is None:
break
else:
2019-01-22 03:20:27 +03:00
print("[i] %s" % _)
2012-04-04 16:27:24 +04:00
2012-03-28 17:46:31 +04:00
time.sleep(1)
2012-04-04 16:27:24 +04:00
2019-01-22 02:40:48 +03:00
except socket.error as ex:
2012-03-30 17:20:29 +04:00
if 'Permission' in str(ex):
2019-01-22 03:20:27 +03:00
print("[x] Please run with sudo/Administrator privileges")
2012-03-30 17:20:29 +04:00
else:
raise
2012-03-28 17:46:31 +04:00
except KeyboardInterrupt:
os._exit(0)
2012-03-30 17:20:29 +04:00
finally:
2012-04-04 16:49:45 +04:00
if server:
server._running = False