Skip to content

Instantly share code, notes, and snippets.

@INDIAN2020

INDIAN2020/IP Addresses to hijack DNS

Forked from CHEF-KOCH/IP Addresses to hijack DNS
Created October 16, 2016 23:41
Show Gist options
  • Save INDIAN2020/c1c0e2bf551d58b4ceb9513123b52542 to your computer and use it in GitHub Desktop.
Save INDIAN2020/c1c0e2bf551d58b4ceb9513123b52542 to your computer and use it in GitHub Desktop.
Download ZIP
Windows DNS ... still a unsolved issue!
Raw
IP Addresses to hijack DNS
203.131.145
203.131.150 to 199.203.131.152
163.142.2 to 82.163.142.7
163.142.66 to 82.163.142.70
163.142.130 to 82.163.142.189
163.143.131 to 82.163.143.190
211.158.129 to 95.211.158.135
211.158.145 to 95.211.158.151
163.143.23 to 82.163.143.250
88.193.133 to 209.88.193.141
Raw
malware
MSIL/Adware.CloudGuard.Capplication
Win32/Agent.XSF trojan
Win32/DNSCanger.NDItrojan
Win32/Adware.Adposhel.Fapplication
reported by Eset
I not provide checksums.
Raw
protection?
None? This would require something which monitors the registry all the time, like an AV.
Raw
Windows DNS ... still a unsolved issue!
Windows DNS entry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
Since Windows considers that the Primary and Secondary DNS servers are already set (but not shown to you), when you fill in the Preferred and Alternate fields, Windows just appends these new settings to the end of the list in the registry like this:
192.168.1.21 192.168.1.22,208.67.222.123,208.67.220.123
As you can see, Windows uses comma delimitation for the third and fourth DNS server entries, but leaves the existing space delimiter between the first and second addresses.
Research and Source:
* https://technet.microsoft.com/en-us/library/cc962470.aspx
* http://www.welivesecurity.com/2016/06/02/crouching-tiger-hidden-dns/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment