Skip to content

Conversation

@lodos2005
Copy link
Contributor

@lodos2005 lodos2005 commented Jun 27, 2025

Description

This pull request introduces a new module, dns, for managing DNS records within an Active Directory-integrated DNS environment directly via LDAP. It provides administrators and pentesters with a powerful command-line tool to perform various DNS operations, from creating and deleting records to querying existing zones, without leaving the NetExec console.
This module is inspired by the functionality of dnstool.py from krbrelayx by @dirkjanm and is designed to be a robust and user-friendly addition to NetExec's capabilities.

Key Features

  • Comprehensive Record Management: Full CRUD (Create, Read, Update, Delete) operations for 'A' records.
  • Multiple Actions: Supports add, modify, query, remove (tombstone), ldapdelete (direct deletion), and resurrect.
  • Zone Enumeration: Ability to list all DNS zones in DomainDnsZones, ForestDnsZones, or the legacy System partition.
  • Flexible Targeting: Allows specifying the target record, data, zone, and DNS partition.
  • Support for Multiple Records: The ALLOWMULTIPLE option permits adding multiple A records for a single hostname.
  • User-Friendly: Includes a comprehensive built-in help menu (-o HELP) and short aliases (A, R, D, etc.) for all options for faster use.

Help Usage
dns-help

Query Usage
dns-query

Forest Query Usage
dns-forestquery

Add Usage
dns-add

Forest Add Usage
dns-forestadd

Add AllowMultiple Usage
dns-allowmultiple

Modify Usage
dns-modify

Remove Usage
dns-remove

Ldap Remove Usage
dns-ldapremove

List
dns-list

List-DN
dns-listdn

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Setup guide for the review

Please provide guidance on what setup is needed to test the introduced changes, such as your locally running machine Python version & OS, as well as the target(s) you tested against, including software versions.
In particular:

  • Bug Fix: Please provide a short description on how to trigger the bug, to make the bug reproducable for the reviewer.
  • Added Feature/Enhancement: Please specify what setup is needed in order to test the changes. E.g. is additional software needed? GPO changes required? Specific registry settings that need to be changed?

Screenshots (if appropriate):

Screenshots are always nice to have and can give a visual representation of the change.
If appropriate include before and after screenshot(s) to show which results are to be expected.

Checklist:

  • I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary
  • New and existing e2e tests pass locally with my changes
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

Add dns Modüle

Signed-off-by: Hakan Yavuz <[email protected]>
Add DNS module

Signed-off-by: Hakan Yavuz <[email protected]>
self.module_options = module_options
self.show_usage = False

if "HELP" in module_options or "H" in module_options:
Copy link
Collaborator

@Marshall-Hallenbeck Marshall-Hallenbeck Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason for the help option when it defaults to showing the usage if the action is not a valid option anyway? Just seems redundant with the existing --options

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--options is provides a good explanation for the parameters, but I think a user manual like help would be more appropriate.
dns-help

if there's a different approach you suggest, we can do it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The --options menu should provide the basic explanation and maybe 2-3 examples. If that is not enough the wiki should be the place for detailed information and explanations imo.

@Marshall-Hallenbeck Marshall-Hallenbeck added enhancement New feature or request good first issue Good for newcomers new module labels Jun 27, 2025
@NeffIsBack NeffIsBack removed the enhancement New feature or request label Jun 29, 2025
@NeffIsBack
Copy link
Member

NeffIsBack commented Jun 29, 2025

Thanks for the PR!

Could you PR all of the structs to impacket? That is probably the better place instead of that NetExec builds its own lib. Also other people can use them if needed.
Don't worry about getting the changes merged, we currently use our forked version and can just merge what we need

@lodos2005
Copy link
Contributor Author

fortra/impacket#1994
I sent the PR. I'll refactor the code again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants