一、背景：
在很多时候，应急会发现。卧槽，异常连接，只有一个域名或者IP。
怎么办？上防火墙看记录，查域名对应的记录累成狗，自己把之前的代码改了改，写了个小工具，一条命令查询DNS相关记录，也可以指定内网服务器查询。
二、分析思路：
1、首先排查一下流量通信情况，采集远端IP、域名、及其对应的解析记录。
2、国内推荐使用我们360，以及threatbook、还有老东家tianjipartner的的威胁情报源分析是否有关联威胁，如果有采取第一波止损措施，马上下策略隔绝断网。重要的机器可以直接先断了网或者会话。（大陆之外推荐使用passivetotal和virustotal）
3、如果没有，上主机查进程，可以写脚本监控。查看通信端口对应进程：
#sudo netstat -anop | grep a.b.c.d 查到pid
#sudo ps -ef | grep pid确定进程
4、疑似进程取样kill，正常进程先不要kill ，进一步可以做深层次的源代码分析等等。
三、使用的dnspythonlib库：
昨晚临时写的，把之前的代码改了改，其实可以好好重写一番，里面有部分实现逻辑其实挺垃圾的，求轻喷。
# -*- coding:utf-8 -*- #import lib files
import sys
import dns.resolver #global varites defines
checker = dns.resolver.Resolver()
nameserverlist = ["202.106.0.20","114.114.114.114","8.8.8.8","8.8.4.4"]
resultdict = {} #global functions defines
def set_nameserver(nameserver):
global nameserverlist
if isinstance(nameserver,list):
nameserverlist = nameserver
return 0
else:
return 0 def check_a_record(domain):
global checker
global nameseverlist
global resultdict
alist = []
for server in nameserverlist:
try:
checker.nameservers = [server]
record = checker.query(domain,"A")
except Exception,ex:
continue
for iprecord in record:
alist.append({"nameserver":server,"arecord":iprecord})
resultdict["A-RECORD"] = alist def check_cname_record(domain):
global checker
global nameserverlist
global resultdict
clist = []
for server in nameserverlist:
try:
record = checker.query(domain,"A")
except Exception,ex:
continue
for value in record.response.answer:
for item in value.items:
try:
if isinstance(item,dns.rdtypes.ANY.CNAME.CNAME):
clist.append({"nameserver":server,"cname":str(item)})
except Exception,ex:
continue
resultdict["CNAME"] = clist if __name__ == "__main__":
testdomain = sys.argv[1]
check_a_record(testdomain)
check_cname_record(testdomain)
print resultdict
# -*- coding:utf-8 -*- #import lib files
from optparse import OptionParser
from apilib import resultdict,set_nameserver,check_a_record,check_cname_record if __name__ == "__main__":
parser = OptionParser()
parser.add_option("-d", "--domain", dest="domain",help="domian to check")
parser.add_option("-s", "--server", dest="server",help="nameserver to check")
(options, args) = parser.parse_args()
try:
checkdomain = options.domain.lower()
except Exception,ex:
checkdomain = options.domain
if checkdomain in [""," ",None,"null"]:
exit(0)
dnsserver = options.server
if dnsserver not in [""," ",None,"null"]:
dnsserver = [dnsserver] if dnsserver.find(",") < 0 else dnsserver.split(",")
set_nameserver(dnsserver)
check_a_record(checkdomain)
check_cname_record(checkdomain)
print resultdict
要是在windows下使用觉得麻烦，直接打包
#pyinstaller -F dnscheck.py
使用简介：
#dnscheck.exe -d www.baidu.com
#dnscheck.exe -d www..com -s 202.106.0.20,114.114.114.114
百度网盘下载地址：https://pan.baidu.com/s/1jJr2mPo
下载口令：k4f8