国外网站曾报告发现很多知名互联网企业的DNS记录泄露了部分私网IP地址。存在这个问题的公司有live.com, facebook.com, yahoo.com, nokia.com, paypal.com, baidu.com等等。
存在的问题就是一些*.COMPANY.com域名指向的地址是10/8,172.16/12,192.168/16和127.0.0.1的内网地址。比如：
./facebook.com:10.60.0.195 sb.facebook.com ./facebook.com:10.170.0.4 time.facebook.com ./facebook.com:10.78.0.10 time.facebook.com ./facebook.com:10.56.0.7 xmail.facebook.com ./live.com:10.245.6.27 monitoring.live.com ./yahoo.com:10.72.164.31 i.yahoo.com ./yahoo.com:10.80.80.184 na.yahoo.com ./baidu.com:10.11.252.74 accounts.baidu.com ./baidu.com:10.81.7.51 ba.baidu.com ./baidu.com:172.18.100.200 bd.baidu.com ./baidu.com:10.36.155.42 bh.baidu.com ./baidu.com:10.36.160.22 bh.baidu.com ./baidu.com:10.38.19.40 bh.baidu.com ./baidu.com:10.42.7.24 bi.baidu.com ./baidu.com:10.44.64.20 bugs.baidu.com ./baidu.com:10.81.11.67 cd.baidu.com ./baidu.com:10.38.157.31 cdn.baidu.com ./baidu.com:10.26.7.93 cms.baidu.com ./baidu.com:10.26.137.29 com.baidu.com
目前已经存在一些利用方式来访问和入侵内网服务。比如cors和ssrf。不过国外的小伙伴提出了一种很有想象力的攻击的方式。
假设如下一个场景，很多工程师在参加一个技术会议。笔记本连到wifi上。通过泄露的信息得知某著名公司存在一个
secbugs.company.com的域名，指向的是192.168.1.199。攻击者只要将自己的电脑搭建成ip为192.168.1.199的
服务器。然后就像传统的csrf和反射xss一样，制作一个页面。想办法让company的工程师点击。一旦点击恶意页面，就会发起一个对secbugs.company.com的请求。而这个请求会发送到攻击者的服务器上。从而获得用户的cookie。
Insecure DNS records in top web projects
Last month ONsec_lab had discovered and reported about the same DNS issue in top web projects: live.com, facebook.com, yahoo.com, nokia.com, paypal.com, baidu.com, att.com and many others.
DNS linked few *.COMPANY.com domains to IP which doesn’t belong to
COMPANY.
These addressed from Private Address Space 10/8, 172.16/12, 192.168/16 (look at http://tools.ietf.org/html/rfc1918, https://en.wikipedia.org/wiki/IPv4) and localhost 127.0.0.1.
Basically, this may be interpreted as information leakage from intranet of COMPANY. But it’s obvious :)This server-side issue can be exploited as a client-side vulnerability when attacker and victim are in the same private network:
I.e. local.COMPANY.com have A-record to 10.0.0.123
1. Attacker connects to any public network with address space from 10.0.0.0/8 or other which linked to any local.COMPANY.com domain.
2. Attacker adds to network interface on his computer address from A-record which linked to private address 10.0.0.123.
3. Attacker publishes on any resource link to local.COMPANY.com (for example – banner on any news-site). Like as classic CSRF/reflected XSS attack.
4. All users, who connected to the same network (1) and see banner (3) will make request to http://local.COMPANY.com, which actually will be made to computer of attacker. Browser will send cookies for *.COMPAMY.com in this request, because user make request to local.live.com.
In this case malicious user steal cookies.
What about protection?
Simple way is protect session cookies by Secure flag. This is facebook way. But anyway attacker can steal others non-Secure cookies. Also attacker in this case can do logout attack, because browsers have only 4Kb memory for all cookies which stored at all *.COMPANY.com domains. For this reason attacker can set many new cookies from local.COMPANY.com to delete all cookies from *.COMPANY.com and COMPANY.com scope.
Some examples:
./ccbill.com:192.168.169.170 backend.ccbill.com
./ccbill.com:192.168.13.127 internal.ccbill.com
./facebook.com:10.56.0.51 atlas.facebook.com
./facebook.com:10.56.0.69 hr.facebook.com
./facebook.com:10.60.0.29 lists.facebook.com
./facebook.com:10.170.0.4 ntp.facebook.com
./facebook.com:10.78.0.10 ntp.facebook.com
./facebook.com:10.60.0.195 sb.facebook.com
./facebook.com:10.170.0.4 time.facebook.com
./facebook.com:10.78.0.10 time.facebook.com
./facebook.com:10.56.0.7 xmail.facebook.com
./live.com:10.245.6.27 monitoring.live.com
./nokia.txt:10.113.1.11 guest.nokia.com
./nokia.txt:172.21.214.214 linux.nokia.com
./paypal.com:10.190.3.55 mx.paypal.com
./yahoo.com:10.72.164.31 i.yahoo.com
./yahoo.com:10.80.80.184 na.yahoo.com
./baidu.com:10.11.252.74 accounts.baidu.com
./baidu.com:10.81.7.51 ba.baidu.com
./baidu.com:172.18.100.200 bd.baidu.com
./baidu.com:10.36.155.42 bh.baidu.com
./baidu.com:10.36.160.22 bh.baidu.com
./baidu.com:10.38.19.40 bh.baidu.com
./baidu.com:10.42.7.24 bi.baidu.com
./baidu.com:10.44.64.20 bugs.baidu.com
./baidu.com:10.81.11.67 cd.baidu.com
./baidu.com:10.38.157.31 cdn.baidu.com
./baidu.com:10.26.7.93 cms.baidu.com
./baidu.com:10.26.137.29 com.baidu.com
./baidu.com:10.36.7.99 crm.baidu.com
./baidu.com:10.26.7.125 crm.baidu.com
./baidu.com:10.23.248.28 ct.baidu.com
./baidu.com:10.42.243.12 dc.baidu.com
./baidu.com:10.237.2.83 def.baidu.com
./baidu.com:10.65.211.94 dt.baidu.com
./baidu.com:172.18.0.180 ecom.baidu.com
./baidu.com:10.42.7.18 erp.baidu.com
./baidu.com:10.42.224.22 flow.baidu.com
./baidu.com:172.22.1.88 fw.baidu.com
./baidu.com:172.22.31.92 ga.baidu.com
./baidu.com:10.46.52.12 global.baidu.com
./baidu.com:10.42.58.42 global.baidu.com
./baidu.com:172.16.1.2 gw1.baidu.com
./baidu.com:10.240.31.12 h.baidu.com
./baidu.com:10.81.12.102 iq.baidu.com
./baidu.com:10.42.7.203 it.baidu.com
./baidu.com:10.42.7.54 km.baidu.com
./baidu.com:10.23.249.173 kr.baidu.com
./baidu.com:10.65.18.107 launch.baidu.com
./baidu.com:10.36.23.62 live.baidu.com
./baidu.com:10.26.40.19 live.baidu.com
./baidu.com:10.81.45.245 log.baidu.com
./baidu.com:10.26.39.14 log.baidu.com
./baidu.com:10.23.65.13 log02.baidu.com
./baidu.com:10.11.250.228 mirror.baidu.com
./baidu.com:10.26.140.39 ml.baidu.com
./baidu.com:10.81.15.138 monitor.baidu.com
./baidu.com:10.42.7.232 nl.baidu.com
./baidu.com:10.240.31.12 o.baidu.com
./baidu.com:10.26.3.48 ocean.baidu.com
./baidu.com:10.23.240.246 openview.baidu.com
./baidu.com:10.23.65.19 pe.baidu.com
./baidu.com:172.22.1.82 portal.baidu.com
./baidu.com:10.11.0.12 r2.baidu.com
./baidu.com:10.32.10.74 ra.baidu.com
./baidu.com:10.44.31.17 se.baidu.com
./baidu.com:10.42.7.217 security.baidu.com
./baidu.com:10.65.25.83 serv.baidu.com
./baidu.com:10.26.52.14 sms.baidu.com
./baidu.com:10.65.18.22 speed.baidu.com
./baidu.com:10.42.7.217 ssl.baidu.com
./baidu.com:10.46.28.36 tiger.baidu.com
./baidu.com:10.44.66.5 tn.baidu.com
./baidu.com:10.81.11.241 tool.baidu.com
./baidu.com:10.81.11.241 tools.baidu.com
./baidu.com:10.23.1.162 training.baidu.com
./baidu.com:10.23.248.87 ut.baidu.com
./baidu.com:10.48.40.58 va.baidu.com
./baidu.com:10.48.30.87 web.baidu.com
./baidu.com:10.65.19.212 win.baidu.com
./baidu.com:10.42.8.38 work.baidu.com
./baidu.com:10.81.211.74 ws.baidu.com
ps:当被攻击者与攻击者处在同一局域网时，可以利用作者提供的思路来进行攻击。
转载请注明：jinglingshu的博客 » DNS记录引起的内网ip泄露