dnschef – Backtrack – Privilege Escalation – Spoofing Attacks – Network Spoofing – dnschef

If you want to spoof some DNS requests then dnschef is the tool to do it. I can never get enough of redirecting innocent Internet surfers to random locations. The main key for dnschef to be extremely useful is the fact that you will have to somehow get the traffic to the Backtrack Linux server running dnschef which could be done by gaining access and modifying DNS entries on a single server or by poisoning the real DNS server on a network. Below we show a couple examples of dnschef in action but overall it is really easy to use and the hard part will be figuring out the method you use to get the DNS (Domain Name Server) traffic to the Backtrack server running dnschef.

A couple notes before posting some examples before. When you are testing your dnschef example do not be surprised if the domains you specify using –fakedomains do not redirect where you specify right away as if these are domains or web sites that you visit frequently your local computer will have a cached DNS entry pointing to the correct IP until that cached entry times out. If you are on a Mac running OSX and want to clear your cache during testing then just run “sudo dscacheutil -flushcache” from a terminal window right before you begin. Also if you have a large amount of domains you want to redirect to different IP’s then use the –file switch to point to a list of domains and the IP’s you want those domains to translate too. The dnschef application is written in python and can be launched from the Backtrack command line by running /pentest/sniffers/dnschef/dnschef.py.

dnschef: Proxy DNS Traffic

In simple proxy mode dnschef will proxy all legitimate DNS requests through to Google’s public DNS server at 8.8.8.8 unless you specify DNS servers using the –nameservers command. Also it should be noted that dnschef will only listen on localhost or 127.0.0.1 unless the –interface switch is used to specify a specific interface IP address or 0.0.0.0 to listen on all interfaces. We have also set the Name Server to be the default NS server on the network using –nameservers however dnschef will still function properly if you do not set –nameservers as it defaults to Google’s public DNS server at 8.8.8.8. The above example could be useful if you wanted to analyze network traffic and where traffic on the network is going. Last but not least notice how you not only see A record traffic but you will also see any other type of DNS request such as PTR (Pointer) requests, AAAA (IPv6 A) requests, MX (Mail Exchange) records, etc. Below we show an example using more switches and specifically targeting a single domain to redirect to our own IP address. You could do this for say Gmail and have a spoofed website configured using SET (Social Engineering Toolkit) to obtain Gmail credentials.

dnschef: Spoof DNS Requests For Specific Domain

Again notice how we also set the DNS server to 192.168.1.1 for requests that we are not spoofing which is the internal DNS server on the network. This is done so everything seems normal to the end user as they may have specific DNS entries for local or external resources on the internal DNS server. In the above example we are only spoofing the DNS for a single domain which we would then setup a web server on 192.168.1.88 to either gain credentials or attempt to gain access to the remote client computer, etc. That pretty much covers the dnschef capabilities except for the –tcp switch which will use TCP DNS proxy instead of UDP DNS proxy and the -q switch to quiet down the output by not displaying all of the headers. I really like this tool as it is one of those types of tools you can have a lot of fun with at the coffee shop!

APPIP ERROR: amazonproducts[
AccessDeniedAwsUsers|The Access Key Id 1ZNGM52M8EWAXJFFRR82 is not enabled for accessing this version of Product Advertising API. Please migrate your credentials as referred here https://webservices.amazon.com/paapi5/documentation/migrating-your-product-advertising-api-account-from-your-aws-account.html.
]

APPIP ERROR: amazonproducts[
AccessDeniedAwsUsers|The Access Key Id 1ZNGM52M8EWAXJFFRR82 is not enabled for accessing this version of Product Advertising API. Please migrate your credentials as referred here https://webservices.amazon.com/paapi5/documentation/migrating-your-product-advertising-api-account-from-your-aws-account.html.
]