BIND 9 Recursive Resolver Cache Poisoning

Repository is a small proof-of-concept for BIND 9 DNS cache poisoning (CVE-2025-40778) based on injecting unrelated records via the DNS ADDITIONAL section. Structure: - README.md: Detailed lab setup and reproduction steps (compile/install BIND 9.21.12, configure recursion/forwarding, set a forward zone for poc.lab to the attacker at 192.168.174.130, victim resolver settings, and demonstration dig commands). Mentions affected version ranges. - attacker.py: Core PoC. Implements a UDP DNS server (dnslib) that answers only queries for www.poc.lab. with an A record (192.168.174.99) and simultaneously injects an unsolicited ADDITIONAL A record for www.hacker.com. -> 192.168.174.130. For other names it returns NXDOMAIN. This models a malicious authoritative server response intended to be cached by a vulnerable BIND resolver. - server.py: Optional Flask web server bound to 0.0.0.0:443 serving a static HTML page, intended to demonstrate the impact after poisoning (victims redirected to attacker-controlled web content). Exploit capabilities: - Network-based cache poisoning against a recursive BIND resolver by leveraging improper caching/processing of unsolicited ADDITIONAL-section data. - Redirects subsequent DNS lookups for the poisoned hostname to an attacker-chosen IP (traffic redirection / potential phishing / MITM staging). No reverse shell or code execution payload is included; impact is DNS integrity compromise.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-40778, a critical DNS cache poisoning vulnerability in BIND 9 recursive resolvers that do not enforce strict bailiwick checking. The main exploit code is in 'auth_poison.py', which implements a malicious authoritative DNS server. When queried for a legitimate domain (e.g., www.test.local), it responds with both the correct answer and a forged answer for an unrelated domain (e.g., www.bank.com), mapping it to an attacker-controlled IP. This response is intended to poison the cache of a vulnerable recursive resolver, causing future queries for the poisoned domain to resolve to the attacker's IP. The repository also includes 'validate_poc_forwarder.py', a utility to verify the test environment and detect possible poisoning, and documentation files (CVE-2025-40778.md, README.md, readme.txt) that explain the vulnerability, attack scenarios, and setup instructions. The exploit is educational and requires a controlled lab environment with a BIND9 resolver and the malicious DNS server. No real-world targets or hardcoded external endpoints are present; all domains and IPs are configurable for testing. The exploit demonstrates the risk of improper DNS bailiwick checking and the potential for transparent phishing, credential theft, and large-scale redirection attacks.