20CN网络安全小组论坛 - 菜鸟乐园 - BIND漏洞是什么？要怎样利用？请指教

论坛: 菜鸟乐园标题: BIND漏洞是什么？要怎样利用？请指教

复制本贴地址

作者: klkly [klkly]

论坛用户

地主发表时间: 1/6 17:54

回复: group [group]

论坛用户

IP地址不易记忆，因此，Internet采用了“标准名称”寻址方案，即每个机器都分配一个独有的“标准名称”，并由分布式命名体系自动翻译成IP地址。这种翻译称为“主机名/域名解析”或“名称解析”(DNS)。起这种作用的最常用的一个应用软件是 BIND(伯克利Internet域名服务)。任何一个BIND服务器都保存了它所管辖区域已注册登记的机器的IP地址及相应的标准名称，并可与远地的其他BIND服务器交换这种信息。

B1层发表时间: 1/6 19:22

回复: group [group]

论坛用户

请详细阅读
http://www.20cn.net/ns/wz/sys/data/20010521041723.htm

B2层发表时间: 1/6 19:24

回复: dodozf [dodozf]

论坛用户

一般就利用远程 buffer overflow 攻击旧版本，复杂点可以弄 DNS poisoning 来攻击 unix 的 trust，基本上就是更改 DNS 表，但我没玩过，好象非常难。

B3层发表时间: 1/6 20:21

回复: top [top]

论坛用户

有获得权限的可能没有？

B4层发表时间: 05/14 01:32

回复: davy [davy]

论坛用户

好象bind 8.2.2以下版本有拒绝服务的问题

B5层发表时间: 05/14 09:06

回复: davy [davy]

论坛用户

snort关于dns攻击的特征描述

# DNS RULES
#----------

alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named iquery attempt"; content: "|0980 0000 0001 0000 0000|"; offset: 2; depth: 16; reference:arachnids,277; reference:cve,CVE-1999-0009; reference:bugtraq,134; classtype:attempted-recon; sid:252; rev:2;)
alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"DNS SPOOF query response PTR with TTL\: 1 min. and no authority"; content:"|85800001000100000000|"; content:"|c00c000c00010000003c000f|"; classtype:bad-unknown; sid:253; rev:2;)
alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"DNS SPOOF query response with ttl\: 1 min. and no authority"; content:"|81 80 00 01 00 01 00 00 00 00|"; content:"|c0 0c 00 01 00 01 00 00 00 3c 00 04|"; classtype:bad-unknown; sid:254; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS zone transfer"; content: "|00 00 FC|"; flags: A+; offset: 13; reference:arachnids,212; classtype:attempted-recon; sid:255; rev:2;)
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named authors attempt"; content:"|07|authors"; offset:12; content:"|04|bind"; nocase; offset: 12; reference:arachnids,480; classtype:attempted-recon; sid:256; rev:1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named version attempt"; content:"|07|version"; offset:12; content:"|04|bind"; nocase; offset: 12; reference:arachnids,278; classtype:attempted-recon; sid:257; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named 8.2->8.2.1";flags: A+; content:"../../../../../../../../../"; reference:cve,CVE-1999-0833; classtype:attempted-admin; sid:258; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named overflow";flags: A+; content:"thisissometempspaceforthesockinaddrinyeahyeahiknowthisislamebutanywaywhocareshorizongotitworkingsoalliscool"; reference:cve,CVE-1999-0833; classtype:attempted-admin; sid:259; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named"; flags: A+; content:"ADMROCKS"; reference:cve,CVE-1999-0833; classtype:attempted-admin; sid:260; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named";flags: A+; content:"|CD80 E8D7 FFFF FF|/bin/sh"; classtype:attempted-admin; sid:261; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 linux";flags: A+; content:"|31c0 b03f 31db b3ff 31c9 cd80 31c0|"; classtype:attempted-admin; sid:262; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 linux";flags: A+; content:"|31 c0 b0 02 cd 80 85 c0 75 4c eb 4c 5e b0|"; classtype:attempted-admin; sid:264; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 linux ADMv2";flags: A+; content:"|89f7 29c7 89f3 89f9 89f2 ac3c fe|"; classtype:attempted-admin; sid:265; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 freebsd";flags: A+; content:"|eb6e 5ec6 069a 31c9 894e 01c6 4605|"; classtype:attempted-admin; sid:266; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT sparc";flags: A+; content:"|90 1a c0 0f 90 02 20 08 92 02 20 0f d0 23 bf f8|"; classtype:attempted-admin; sid:267; rev:1;)

B6层发表时间: 05/14 09:09

回复: top [top]

论坛用户

你做过DNS攻击？成功了没？

描述是查的？

有什么用？全晕！

B7层发表时间: 05/14 09:45

回复: davy [davy]

论坛用户

学吧，上面贴的包含CVE-1999-0009，可以到www.securityfocus.com上去查全部资料，包含攻击程序

B8层发表时间: 05/14 13:53

论坛: 菜鸟乐园