Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

Owner: User #14587667

BIND (DNS) Server

Description: This server will function as a DNSDomain Name System server to forward DNSDomain Name System queries to the appropriate 'upstream' DNSDomain Name System server (loki.lab, devlan.net, testrange.local). Currently, there is no way to resolve to multiple internal domains. By pointing at this server, it will forward the DNSDomain Name System request to the approriate DNSDomain Name System server. It is important to note that this service only FORWARDS requests for the mentioned domains (It is not a slave DNSDomain Name System server). There is one exception to this however - this server does have DNSDomain Name System entries for vcenter, esxi-1, esxi-2, esxi-3, and esxi-4 for the loki.lab domain. This is so that it can function as a backup (for these 4 hosts) if the Windows DNSDomain Name System server goes down.

IP Address: 10.9.9.12 /24

OS: Ubuntu Server 14.04 LTSLong Term Support x64

VM Name: BINDDNSDomain Name System server software DNSDomain Name System Server - 10.9.9.12

username: ubuntu

hostname: ns1.loki.lab

Steps to Setup Server

Clone Ubuntu Server 14.04 from VMVirtual Machine Template (ubuntu server x64 14.04 LTSLong Term Support)
Using vCenter, perform the following:
1. Tag VMVirtual Machine as 'Production Server'.
2. Edit VMVirtual Machine settings:
  1. Delete NIC2.
  2. Add NIC1 to vmcli-29
3. Power on VM
4. Open Console to VMVirtual Machine and change IP address settings:
  1. $ sudo vi /etc/network/interfaces
    1. address 10.9.9.12
    2. netmask 255.255.255.0
    3. network 10.9.9.0
    4. broadcast 10.9.9.255
    5. gateway 10.9.9.1
    6. dns-nameservers 10.9.9.12
  2. $ sudo reboot
Once rebooted, access the VMVirtual Machine via PuTTY.
1. Update hostname
  1. $ sudo /etc/hostname
  2. Change to 'ns1'
  3. $ sudo vi /etc/hosts
  4. Change the IP address line to the following:
    10.9.9.12 ns1.loki.lab ns1
2. Update apt repo
  1. $ sudo apt-get update
3. Install BIND9
  1. $ sudo apt-get install bind9 bind9utils bind9-doc
4. Edit BINDDNSDomain Name System server software config
  1. Edit named.conf.local and add the lines from the sample file 'etc-bind-named.conf.local.txt' attached.
  2. Edit named.conf.options and add thes from the sample file 'etc-bind-named.conf.options.txt' attached
  3. Check BINDDNSDomain Name System server software config
    1. $ named-checkconf
5. Create zone files
  1. $ cd /etc/bind
  2. $ sudo cp db.local db.loki.lab
  3. Edit the forward zone file (/etc/bind/db.loki.lab) like the attached file 'etc-bind-db.loki.lab.txt'
  4. Check the zone file by running the following command
  5. $ sudo named-checkzone loki.lab db.loki.lab
6. Reload BINDDNSDomain Name System server software config
  1. $ sudo service bind9 reload
7. Test that the DNSDomain Name System server is working by using another computer and pointing to 10.9.9.12 as your DNSDomain Name System server. Issue the following commands and make sure they resolve.
  1. $ nslookup tr-01.testrange.local
  2. $ nslookup golf.loki.lab
  3. $ nslookup repo.devlan.net

Sample Config Files

etc-bind-db.loki.lab.txt

etc-bind-named.conf.local.txt

etc-bind-named.conf.options.txt

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

BIND (DNS) Server

e-Highlighter