Configure our domain’s (deadbeef.fun) NS Records to point at our malicious DNS Server ().

To make the target Windows DNS Server parse responses from their machine, the researchers did the following: In a technical blog today, the researchers detail how they were able to exploit the flaw in a target DNS server by replying to one of its queries with a SIG response large enough to trigger the bug. “To summarize, by sending a DNS response that contains a large (bigger than 64KB) SIG record, we can cause a controlled heap-based buffer overflow of roughly 64KB over a small allocated buffer” - Check Point They found an integer overflow that leads to heap-based buffer overflow in “dns.exe!SigWireRead,” the function that parses response types for SIG queries. Researchers at Check Point discovered a flaw in Microsoft’s DNS implementation that can be exploited when the server parses an incoming query or a response for a forwarded request. At the top of the hierarchy are 13 root DNS servers that have all the information. The model is hierarchical and decentralized, so if a DNS server will forward up the ladder the queries to which it does not have an answer. It is a model that maps domain names to IP addresses to enable a connection to the correct server. The Domain Name System (DNS) is the internet’s phone book, enabling clients to connect to servers to access resources. This characteristic puts it in the same risk category as EternalBlue in Server Message Block (SMB) and BlueKeep in the Remote Desktop Protocol (RDP). It is wormable, meaning that an exploit can propagate automatically to vulnerable machines on the network with no user interaction. It is a remote code execution that affects Windows Server versions 2003 through 2019 and received the maximum severity rating, 10 out of 10. The vulnerability received the tracking identifier CVE-2020-1350 and the name SIGRed. A critical vulnerability that’s been sitting in Microsoft’s Windows DNS Server for almost two decades could be exploited to gain Domain Administrator privileges and compromise the entire corporate infrastructure behind it.

Dns worm virus