Assignment 3.1 Powershell and DNS

We don't always have a Kali box handy when we are trying to get information on a target, we can also scan laterally using a system we have targeted and exploited.

Consider the following powershell one liner. We are asking the DNS Server on 192.168.4.4 to resolve the IP Address 192.168.3.100. It turns out this is the instructor's PC in FOSTER 202.

Extend the one liner by creating a powershell script that takes a network prefix, the dns server to use (one of the cyber.local dns servers).

Deliverable 1. Provide a screenshot similar to the one below showing the program run against the foster subnet. The simplistic run shown here, just increments the octet in the 192.168.3.0/24 from 1 to 254.

Enable scripts on the system

  • Open powershell as aministrator

  • run Set-ExecutionPolicy RemoteSigned

Write the powershell script

param(
   [Parameter(Mandatory = $true)]
   [string]$NetworkPrefix,
   [Parameter(Mandatory = $true)]
   [string]$DNSServer
)

for ($i = 1; $i -le 254; $i++) {
    $IPAddress = "$NetworkPrefix.$i"

try {
     $result = Resolve-DnsName -Name $IPAddress -Server $DNSServer -ErrorAction stop
     Write-Output "IP: $IPAddress - Hostname $($result.NameHost)"
} catch { 
     continue

}
}

Parameter definition

  • param Block: This allows the script to accept input parameters when run.

  • [Parameter(Mandatory = $true)]: Ensures that the user must provide these values when running the script.

  • [string]$NetworkPrefix: Defines the first parameter as a string for the network prefix (e.g., 192.168.1).

  • [string]$DNSServer: Defines the second parameter as a string for the DNS server (e.g., 8.8.8.8).

  • param Block: This allows the script to accept input parameters when run.

  • [Parameter(Mandatory = $true)]: Ensures that the user must provide these values when running the script.

  • [string]$NetworkPrefix: Defines the first parameter as a string for the network prefix (e.g., 192.168.1).

  • [string]$DNSServer: Defines the second parameter as a string for the DNS server (e.g., 8.8.8.8).

Loop to iterante through host IDS

  • for Loop: Iterates from 1 to 254, representing common host IDs in a /24 subnet.

  • $i Variable: Represents the current host ID in the iteration.

  • $IPAddress = "$NetworkPrefix.$i": Constructs the full IP address by appending the host ID to the network prefix (e.g., 192.168.1.1).

DNS Resolution with Error Handling

  • try Block: Attempts to run the DNS resolution and catches errors if they occur.

  • Resolve-DnsName: A PowerShell cmdlet that queries DNS records for a given name or IP address.

    • -Name $IPAddress: Specifies the IP address to resolve.

    • -Server $DNSServer: Uses the provided DNS server for the query.

    • -ErrorAction Stop: Forces the cmdlet to throw an error if the resolution fails, triggering the catch block.

Out the Result if DNS Record Exists

  • Write-Output: Displays the resolved IP address along with the corresponding hostname.

  • $result.NameHost: Extracts the hostname from the DNS resolution result.

Error Handling for Unresolved IPs

  • catch Block: Executes if the try block encounters an error (i.e., if the DNS resolution fails).

  • continue: Skips to the next iteration without printing any message, effectively suppressing output for IPs without DNS records.

(Deliverable 1) Successful run of DNS resolver script

Deliverable 2. Provide a screenshot similar to the one below that shows your directory structure and the source code of your powershell dns resolver. Alternatively, you can provide a link to your one liner in your github documentation.

Last updated