Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow static DNS hostnames ending in a . to be queried #19015

Merged
merged 1 commit into from
Mar 27, 2024
Merged

Allow static DNS hostnames ending in a . to be queried #19015

merged 1 commit into from
Mar 27, 2024
+1 −1

Conversation

zeroSteiner
Copy link
Contributor

Since #19012 was landed, static hostnames that end in a . can be defined which fixed an issue that could prevent Metasploit from starting. Since the query mechanism that static hostnames uses operates on a packet object though, the name will never end in a dot meaning these hostnames can't be queried. This fixes that by deleting any . suffix that could be in place as part of the normalization (downcasing).

Testing

  • Add a static hostname ending in a . (e.g. dns add-static test. 127.1.1.1)
  • See that it can be queried now, run dns query test.
  • See that it can also be queried without the ending ., run dns query test

@zeroSteiner
Remove any trailing dots from static names
8bb690f 
This allows them to be queried
@dwelch-r7 dwelch-r7 self-assigned this Mar 26, 2024
@dwelch-r7
Copy link
Contributor

dwelch-r7 commented Mar 26, 2024 •
edited
Loading

this isn't working for me, I'm not sure if I've done something wrong

msf6 auxiliary(scanner/smb/smb_login) > dns
Default search domain: N/A
Default search list:   N/A
Current cache size:    0

[-] No DNS nameserver entries configured

Static hostnames
================

   Hostname                         IPv4 Address     IPv6 Address
   --------                         ------------     ------------
   broadcasthost                    255.255.255.255
   dc.windomain.local               192.168.176.3
   dc2008.windomain.local           192.168.176.3
   dc2019.windomain.local           192.168.176.3
   localhost                        127.0.0.1        ::1
   test                             127.1.1.1
   windomain.local                  192.168.176.3


msf6 auxiliary(scanner/smb/smb_login) > dns query test.

Host resolutions
================

   Hostname  IP Address           Rule #  Rule  Resolver  Comm channel
   --------  ----------           ------  ----  --------  ------------
   test.     [Failed To Resolve]

msf6 auxiliary(scanner/smb/smb_login) > dns query test

Host resolutions
================

   Hostname  IP Address           Rule #  Rule  Resolver  Comm channel
   --------  ----------           ------  ----  --------  ------------
   test      [Failed To Resolve]

Edit: I actually can't resolve anything might be an env issue

@zeroSteiner
Copy link
Contributor Author

Oh I forgot to mention you need the static resolver to be at the top of the list so it's looked up there first. I can see in your output you have no resolvers set. Try running dns add -i 1 static 4.2.2.2. Feel free to sub 4.2.2.2 with your DNS provider of choice.

@dwelch-r7
Copy link
Contributor

dns add -i 1 static

oh yep that's working now, totally user error but some message saying why it's not resolving might be worth adding in the future 😓

@dwelch-r7
Copy link
Contributor

Totally working now

msf6 exploit(windows/smb/psexec) > dns add-static test. 127.1.1.1
[*] Added static hostname mapping test. to 127.1.1.1
msf6 exploit(windows/smb/psexec) > dns query test.

Host resolutions
================

   Hostname  IP Address  Rule #  Rule  Resolver  Comm channel
   --------  ----------  ------  ----  --------  ------------
   test.     127.1.1.1   1       *
   .         .           .       \_    static    N/A
   .         .           .       \_    8.8.8.8

msf6 exploit(windows/smb/psexec) > dns query test

Host resolutions
================

   Hostname  IP Address  Rule #  Rule  Resolver  Comm channel
   --------  ----------  ------  ----  --------  ------------
   test      127.1.1.1   1       *
   .         .           .       \_    static    N/A
   .         .           .       \_    8.8.8.8

I think it's unrelated to this pr but when I add 127.0.0.1 hostname. to my /etc/hosts similar to how WSL seems to be handling it #19011 it doesn't appear in the static list which feels weird if we support adding entries ending with a .

msf6 auxiliary(scanner/smb/smb_login) > cat /etc/hosts
[*] exec: cat /etc/hosts

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1	localhost
255.255.255.255	broadcasthost
::1             localhost
192.168.176.3 windomain.local dc.windomain.local dc2019.windomain.local dc2008.windomain.local
127.0.0.1 hostname.
msf6 auxiliary(scanner/smb/smb_login) > dns
Default search domain: N/A
Default search list:   N/A
Current cache size:    0

[-] No DNS nameserver entries configured

Static hostnames
================

  Hostname                         IPv4 Address     IPv6 Address
  --------                         ------------     ------------
  broadcasthost                    255.255.255.255
  dc.windomain.local               192.168.176.3
  dc2008.windomain.local           192.168.176.3
  dc2019.windomain.local           192.168.176.3
  localhost                        127.0.0.1        ::1
  windomain.local                  192.168.176.3

@zeroSteiner
Copy link
Contributor Author

I think it's unrelated to this pr but when I add 127.0.0.1 hostname. to my /etc/hosts similar to how WSL seems to be handling it #19011 it doesn't appear in the static list which feels weird if we support adding entries ending with a .

Does it show up if you do a reset-config? If you have an existing configuration, then the hosts file isn't read so adding it won't propagate the change into Metasploit unless you reset the configuration.

@dwelch-r7
Copy link
Contributor

I think it's unrelated to this pr but when I add 127.0.0.1 hostname. to my /etc/hosts similar to how WSL seems to be handling it #19011 it doesn't appear in the static list which feels weird if we support adding entries ending with a .

Does it show up if you do a reset-config? If you have an existing configuration, then the hosts file isn't read so adding it won't propagate the change into Metasploit unless you reset the configuration.

yup that did it, didn't realise it only reads that in once, happy to land this now

@dwelch-r7 dwelch-r7 merged commit 47fc61f into rapid7:master Mar 27, 2024
34 checks passed
@bwatters-r7 bwatters-r7 added the rn-fix release notes fix label Mar 28, 2024
@bwatters-r7
Copy link
Contributor

Release Notes

Previously, we fixed an issue where Metasploit would crash while parsing the hosts file if it ended in unexpected values like . or _. This fixes the same kind of issue in DNS names that enter the hostnames data through a different path by removing any trailing . so they can be used for DNS resolution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@dwelch-r7 dwelch-r7

Labels
rn-fix release notes fix
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@zeroSteiner @dwelch-r7 @bwatters-r7