Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

Owner: User #14587667

BIND (DNS) Server

Description: This server will function as a DNSDomain Name System server to forward DNSDomain Name System queries to the appropriate 'upstream' DNSDomain Name System server (loki.lab, devlan.net, testrange.local). Currently, there is no way to resolve to multiple internal domains. By pointing at this server, it will forward the DNSDomain Name System request to the approriate DNSDomain Name System server.

IP Address: 10.9.9.12 /24

OS: Ubuntu Server 14.04 LTSLong Term Support x64

VM Name: BINDDNSDomain Name System server software DNSDomain Name System Server - 10.9.9.12

username: ubuntu

hostname: ns1.loki.lab

Steps to Setup Server

Clone Ubuntu Server 14.04 from VMVirtual Machine Template (ubuntu server x64 1`4.04 LTSLong Term Support)
Using vCenter, perform the following:
1. Tag VMVirtual Machine as 'Production Server'.
2. Edit VMVirtual Machine settings:
  1. Delete NIC2.
  2. Add NIC1 to vmcli-29
3. Power on VM
4. Open Console to VMVirtual Machine and change IP address settings:
  1. $ sudo vi /etc/network/interfaces
    1. address 10.9.9.12
    2. dns-nameservers 10.3.1.12
    3. dns-search devlan.net
  2. $ sudo reboot
Once rebooted, access the VMVirtual Machine via PuTTY.
1. Update hostname
  1. $ sudo /etc/hostname
  2. Change to 'bindserver'
  3. $ sudo vi /etc/hosts
  4. Change the IP address line to the following:
    10.9.9.12 bindserver.loki.lab bindserver
2. Update apt repo
  1. $ sudo apt-get update
3. Install BIND9
  1. $ sudo apt-get install bind9 bind9utils bind9-doc
4. Edit BINDDNSDomain Name System server software config
  1. Edit named.conf.local and add the lines from the sample named.conf.local config below
  2. Edit named.conf.options and add the following:
    1. forwarders {
      10.0.0.12;
      };
    2. forward only;
    3. dnssec-enable yes;
    4. dnssec-validation yes;
  3. Check BINDDNSDomain Name System server software config
    1. $ named-checkconf
5. Create zone files
  1. $ cd /etc/bind
  2. $ sudo cp db.local db.loki.lab
  3. Edit the forward zone file (/etc/bind/zones/db.loki.lab) with the sample db.loki.lab zone file below
6. Reload BINDDNSDomain Name System server software config
  1. $ sudo service bind9 reload
7. Test that the DNSDomain Name System server is working by using another computer and pointing to 10.9.9.12 as your DNSDomain Name System server. Issue the following commands and make sure they resolve.
  1. $ nslookup tr-01.testrange.local
  2. $ nslookup golf.loki.lab
  3. $ nslookup repo.devlan.net

Sample /etc/bind/named.conf.local

zone "devlan.net" {
type forward;
forward only;
forwarders { 10.3.1.12; };
};

// Reverse DNSDomain Name System for Devlan (10.3.0.0)
zone "3.10.in-addr.arpa." {
type forward;
forward only;
forwarders { 10.3.1.12; };
};

// Reverse DNSDomain Name System for Devlan (10.2.0.0)
zone "2.10.in-addr.arpa." {
type forward;
forward only;
forwarders { 10.3.1.12; };
};

zone "testrange.local" {
type forward;
forward only;
forwarders { 10.9.8.21; };
};

// Reverse DNSDomain Name System for TestRange (10.9.8.0)
zone "8.9.10.in-addr.arpa." {
type forward;
forward only;
forwarders { 10.9.8.21; };
};

//zone "loki.lab" {
// type forward;
// forward only;
// forwarders { 10.0.0.12; };
//};

// Reverse DNSDomain Name System for Loki.lab (10.9.9.0)
zone "9.9.10-addr.arpa." {
type forward;
forward only;
forwarders { 10.0.0.12; };
};

// Reverse DNSDomain Name System for Loki.lab (10.0.0.0)
zone "0.10-addr.arpa." {
type forward;
forward only;
forwarders { 10.0.0.12; };
};

Sample /etc/bind/named.conf.options

Sample /etc/bind/zones/db.loki.lab

$TTL 604800
@ IN SOA ns1.loki.lab. admin.loki.lab. (
3 ; Serial Increment every time file is edited
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;

; Name Server - NS Reecords
IN NS ns1.loki.lab.

; Name Servers - A records
vcenter.loki.lab. IN A 10.9.9.30
esxi-1.loki.lab. IN A 10.9.9.31
esxi-2.loki.lab. IN A 10.9.9.32

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

BIND (DNS) Server

e-Highlighter