Dns threading (#4)

initstring · web-flow · commit 5a70daef53db · 2019-06-03T08:11:07.000+10:00
Added DNS threading and additional azure error checks.
diff --git a/cloud_enum.py b/cloud_enum.py
@@ -58,6 +58,10 @@ def parse_arguments():
                         default=5, help='Threads for HTTP brute-force.'
                         ' Default = 5')
 
+    parser.add_argument('-ns', '--nameserver', type=str, action='store',
+                        default='8.8.8.8',
+                        help='DNS server to use in brute-force.')
+
     # Allow the user to specify a custom AWS region (NOT YET IMPLEMENTED)
     #parser.add_argument('-ar', '--aws_region', type=str, action='append',
     #                    help='Limit to specific AWS region/s (see list in'
@@ -145,7 +149,7 @@ def main():
 
     # All the work is done in the individual modules
     aws_checks.run_all(names, args.threads)
-    azure_checks.run_all(names, args.brute, args.threads)
+    azure_checks.run_all(names, args.brute, args.threads, args.nameserver)
     gcp_checks.run_all(names, args.threads)
 
     # Best of luck to you!
diff --git a/cloud_enum/azure_checks.py b/cloud_enum/azure_checks.py
@@ -23,8 +23,12 @@ def print_account_response(reply):
     This function is passed into the class object so we can view results
     in real-time.
     """
+    # 
     if reply.status_code == 404:
         pass
+    elif 'The specified account is disabled' in reply.reason:
+        utils.printc("    Disabled Storage Account: {}\n"
+                     .format(reply.url), 'red')
     elif 'Value for one of the query' in reply.reason:
         utils.printc("    HTTP-OK Storage Account: {}\n"
                      .format(reply.url), 'orange')
@@ -35,7 +39,7 @@ def print_account_response(reply):
                 "       {}: {}"
                 .format(reply.status_code, reply.reason))
 
-def check_storage_accounts(names, threads):
+def check_storage_accounts(names, threads, nameserver):
     """
     Checks storage account names
     """
@@ -59,7 +63,7 @@ def check_storage_accounts(names, threads):
             candidates.append('{}.{}'.format(name, BLOB_URL))
 
     # Azure Storage Accounts use DNS sub-domains. First, see which are valid.
-    valid_names = utils.fast_dns_lookup(candidates)
+    valid_names = utils.fast_dns_lookup(candidates, nameserver)
 
     # Send the valid names to the batch HTTP processor
     utils.get_url_batch(valid_names, use_ssl=False,
@@ -78,11 +82,20 @@ def print_container_response(reply):
     This function is passed into the class object so we can view results
     in real-time.
     """
-    if reply.status_code == 200:
+    # Stop brute forcing disabled accounts
+    if 'The specified account is disabled' in reply.reason:
+        return 'breakout'
+
+    # Stop brute forcing accounts without permission
+    if 'not authorized to perform this operation' in reply.reason:
+        return 'breakout'
+
+    # Handle other responses
+    if reply.status_code == 404:
+        pass
+    elif reply.status_code == 200:
         utils.printc("    OPEN AZURE CONTAINER: {}\n"
                      .format(reply.url), 'green')
-    elif reply.status_code == 404:
-        pass
     elif 'One of the request inputs is out of range' in reply.reason:
         pass
     else: print("    Unknown status codes being received:\n"
@@ -131,7 +144,7 @@ def print_website_response(hostname):
     utils.printc("    Registered Azure Website DNS Name: {}\n"
                  .format(hostname), 'green')
 
-def check_azure_websites(names):
+def check_azure_websites(names, nameserver):
     """
     Checks for Azure Websites (PaaS)
     """
@@ -144,22 +157,20 @@ def check_azure_websites(names):
     candidates = [name + '.' + WEBAPP_URL for name in names]
 
     # Azure Websites use DNS sub-domains. If it resolves, it is registered.
-    valid_names = utils.fast_dns_lookup(candidates,
-                                        callback=print_website_response)
+    utils.fast_dns_lookup(candidates, nameserver,
+                          callback=print_website_response)
 
     # Stop the timer
     utils.stop_timer(start_time)
 
-    return valid_names
-
-def run_all(names, brute_list, threads):
+def run_all(names, brute_list, threads, nameserver):
     """
     Function is called by main program
     """
     print(BANNER)
 
-    valid_accounts = check_storage_accounts(names, threads)
+    valid_accounts = check_storage_accounts(names, threads, nameserver)
     if valid_accounts:
         brute_force_containers(valid_accounts, brute_list, threads)
 
-    check_azure_websites(names)
+    check_azure_websites(names, nameserver)
diff --git a/cloud_enum/utils.py b/cloud_enum/utils.py
@@ -4,7 +4,7 @@
 
 import time
 import sys
-import socket
+import subprocess
 try:
     from concurrent.futures import ThreadPoolExecutor
     from requests_futures.sessions import FuturesSession
@@ -50,10 +50,14 @@ def get_url_batch(url_list, use_ssl=False, callback='', threads=5):
         # Then, grab all the results from the queue
         for url in batch_pending:
             batch_results[url] = batch_pending[url].result()
-        
+
         # Now, send all the results to the callback function for analysis
+        # We need a way to stop processing unnecessary brute-forces, so the
+        # callback may tell us to bail out.
         for url in batch_results:
-            callback(batch_results[url])
+            check = callback(batch_results[url])
+            if check == 'breakout':
+                return
 
         # Refresh a status message
         tick['current'] += threads
@@ -65,7 +69,7 @@ def get_url_batch(url_list, use_ssl=False, callback='', threads=5):
     # Clear the status message
     sys.stdout.write('                            \r')
 
-def fast_dns_lookup(names, callback=''):
+def fast_dns_lookup(names, nameserver, callback='', threads=5):
     """
     Helper function to resolve DNS names.
 
@@ -78,25 +82,50 @@ def fast_dns_lookup(names, callback=''):
 
     print("[*] Brute-forcing a list of {} possible DNS names".format(total))
 
-    for name in names:
+    # Break the url list into smaller lists based on thread size
+    queue = [names[x:x+threads] for x in range(0, len(names), threads)]
+
+    # Work through the smaller lists in batches. Using Python's subprocess
+    # module, those host OS will execute the `host` command. Python will
+    # move on to the next and then check the output of the OS command when
+    # finished queueing the batch. A status code of 0 means the host lookup
+    # succeeded.
+    for batch in queue:
+        batch_pending = {}
+        batch_results = {}
+
+        # First, grab the pending async request and store it in a dict
+        for name in batch:
+            # Build the OS command to lookup a DNS name
+            cmd = ['host', '{}'.format(name), '{}'.format(nameserver)]
+
+            # Run the command and store the pending output
+            batch_pending[name] = subprocess.Popen(cmd,
+                                                   stdout=subprocess.DEVNULL,
+                                                   stderr=subprocess.DEVNULL)
+
+        # Then, grab all the results from the queue
+        for name in batch_pending:
+            batch_pending[name].wait()
+            batch_results[name] = batch_pending[name].poll()
+
+            # If we get a 0, save it as a valid DNS name and send to callback
+            # if defined.
+            if batch_results[name] == 0:
+                valid_names.append(name)
+                if callback:
+                    callback(name)
+
         # Refresh a status message
-        current += 1
+        current += threads
         sys.stdout.flush()
         sys.stdout.write("    {}/{} complete...".format(current, total))
         sys.stdout.write('\r')
 
-        # Try to resolve the DNS name, continue on failure
-        try:
-            socket.gethostbyname(name)
-            valid_names.append(name)
-            if callback:
-                callback(name)
-        except socket.gaierror:
-            continue
-
     # Clear the status message
     sys.stdout.write('                            \r')
 
+    # Return the list of valid dns names
     return valid_names
 
 def printc(text, color):
@@ -105,14 +134,17 @@ def printc(text, color):
     """
     # ANSI escape sequences
     green = '\033[92m'
-    orange = '\033[93m'
+    orange = '\033[33m'
+    red = '\033[31m'
     bold = '\033[1m'
     end = '\033[0m'
 
     if color == 'orange':
         sys.stdout.write(bold + orange + text + end)
     if color == 'green':
         sys.stdout.write(bold + green + text + end)
+    if color == 'red':
+        sys.stdout.write(bold + red + text + end)
     if color == 'black':
         sys.stdout.write(bold + text + end)
 
