DESCRIPTION

Rebind is a tool that implements the multiple A record DNS rebinding attack. Although this tool
was originally written to target home routers, it can be used to target any public (non RFC1918) 
IP address. 

Rebind provides an external attacker access to a target router's internal Web interface. This 
tool works on routers that implement the weak end system model in their IP stack, have specifically 
configured firewall rules, and who bind their Web service to the router's WAN interface. Note that 
remote administration does not need to be enabled for this attack to work. All that is required is 
that a user inside the target network surf to a Web site that is controlled, or has been compromised, 
by the attacker. See docs/whitepaper.pdf for a detailed description of the attack.

REQUIREMENTS

In order to use Rebind, you must have a registered domain name. You must also register your
attack machine as a nameserver for your domain; this can be done through your registrar. See 
the docs/FAQ file for more information.

Rebind is only supported on the Linux platform.

Rebind must be run as root, and you must have iptables installed and listed in $PATH.

USAGE

The only required command line options for Rebind are the -i and -d options. These specify the
local interface name and your registered domain name respectively. Example:

    # ./rebind -i eth0 -d attacker.com

Rebind provides a console shell for viewing and changing configuration settings. Type 'help'
inside the console for a list of commands. For help with a particular command, type '<command> ?'.
Most commands take no arguments and serve only to display status information. However, some commands 
do provide the ability to add/edit configuration settings on the fly:

        > config [key] [value]
            The config command can be used to display or edit the payload configuration, including the 
    default user name and password to use for basic authentication requests, the default path 
    to request during the rebinding process, the callback interval and a cookie value to be used 
    for the proxied requests. Note that because these are payload configuration values, they will 
    not take effect for existing active clients, as those clients have already recieved the payload.

        > headers [add|del] [header] [value]
            The headers command can be used to display or edit specific HTTP header values that will be 
    appended to all HTTP requests sent through the Rebind HTTP proxy server. Note that although the 
    client-side JavaScript will attempt to send any HTTP headers that are specified, the XmlHttpRequest 
    object restricts certian headers, such as the Host header, from being sent. If a restricted header 
    is encountered, it will be skipped by the JavaScript code and will not be sent with the final request.

        > save [file]
            The save command saves a copy of Rebind's current SQLite database. This database contains all 
    configuration information, logs, errors, requests and responses. By default it is saved to 'rebind.db' 
    in the current working directory. However, an alternate file name may be specified, such as 
    'save backup.db'. Note that Rebind's database is destroyed upon exit, so if you wish to save this 
    data, you must do so via the save command.

    > targets [add|del] [ip]
            The targets command can be used to display or edit explicit target IP addresses. If target IPs 
    are listed here, clients will be rebound to those IP addresses instead of the public IP address 
    of their gateway router. This is the same as the -t command line argument, except IP lists are 
    not supported; you must execute one 'targets' command for each IP address that you wish to add 
    to the list.

To use the Rebind proxy, configure your browser settings to use <rebind ip>:664 as your HTTP proxy.

To rebind client Web browsers, get them to browse to http://<your domain>/init.

KNOWN AFFECTED ROUTERS

ActionTec MI-424WR
ActionTec GT704-WG
ActionTec GT701-WG
Asus WL-520gU
Belkin F5D7230-4 v.2000
ClearAccess AG-10
D-Link DIR-300
D-Link DIR-320
DD-WRT
Dell TrueMobile 2300
Linksys BEFSR41
Linksys BEFW11S4
Linksys WRT-160N
Linksys WRT54G3G-ST
Linksys WRT54Gv3
Linksys WRT54GL
OpenWRT
PFSense
Thomson ST585v6

TESTED BROWSERS

Rebind has been successfully tested against the following browsers:

    IE6     Windows XP SP2
    IE7     Windows XP SP3
    IE8     Windows XP SP3
    IE8     Windows 7
    FF 3.0.15   Windows XP SP3
    FF 3.0.17   Ubuntu Linux 9.04
    FF 3.5.6    Ubuntu Linux 9.10
    FF 3.5.7    Windows XP SP3
    FF 3.6      Windows XP SP3
    FF 3.6      Windows 7
    FF 3.6      OSX 10.6.2
    Chrome 4.1  Windows XP SP3
    Opera 10.10 Windows XP SP3
    Opera 10.54 Windows XP SP3
    Safari 4.0.4    Windows XP SP3
    Safari 4.0.4    OSX 10.6.2

Note that the above browsers are client browsers, i.e., the browser used by the victim. Only Firefox has been
tested to work with Rebind's Web-based interface, and IE is known to not display the interface properly. So if 
you are using Rebind, be sure to use Firefox or a similar browser.

INSTALLATION

The ../bin/ directory contains statically compiled 32-bit and 64-bit Linux binaries. If you wish to compile 
from source, run:

    $ make
    $ make install

This will build Rebind and its dependencies and copy the resulting binary to the ../bin/ directory.

LICENSE

The MIT License

Copyright (c) 2010 Craig Heffner

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.