TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow server and management VLANs to query the DNS

Browse Source 
Broaden ALLOWED_CLIENTS from the console VLAN alone to also include the server
VLAN (192.168.20.0/24) and the trusted management VLAN (192.168.10.0/27) so the
resolver can be tested and administered from those networks. The consoles still
only require the 192.168.40.0/28 range.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
kadinho
2026-10-11 13:27:52 +01:00
co-authored by Claude Opus 4.8
parent 7292a500eb
commit 9f28b8e2a1
4 changed files with 28 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+11 -8
View File
@@ -194,12 +194,14 @@ sends DNS only to `net-utils01`; that host must be allowed to reach the configur
upstream resolver on UDP/TCP 53.
The gateway additionally restricts which source clients it answers. `ALLOWED_CLIENTS`
defaults to the console VLAN `192.168.40.0/28`; queries from any other source address
are dropped and logged as `denied`, on both UDP and TCP. The value accepts a
comma-separated mix of individual addresses and CIDR ranges, and an empty value
disables the filter. This keeps the service dedicated to the two authorized consoles
and prevents other LAN hosts from using it as an open resolver for the allowlisted
names.
defaults to the console VLAN `192.168.40.0/28`, the server VLAN `192.168.20.0/24`,
and the trusted management VLAN `192.168.10.0/27`; queries from any other source
address are dropped and logged as `denied`, on both UDP and TCP. The server and
trusted VLANs are included so operators can test and administer the resolver; the
consoles themselves only need the `/28`. The value accepts a comma-separated mix of
individual addresses and CIDR ranges, and an empty value disables the filter. This
keeps the service off the rest of the LAN and prevents arbitrary hosts from using it
as an open resolver for the allowlisted names.
The Payload Manager review used upstream commit
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
@@ -230,8 +232,9 @@ not required for catalog browsing or BlackBox updates.
The PS5 was previously identified as `192.168.10.26`; requests from
`192.168.10.6` seen at that time were from the operator's own workstation, not a
console, before the consoles were moved onto VLAN 40. All `192.168.10.0/24`
addresses are historical and must not be used as the current payload destination;
with `ALLOWED_CLIENTS` set to `192.168.40.0/28` they can no longer query the gateway.
addresses are historical and must not be used as the current payload destination,
though `192.168.10.0/27` remains allowed as the trusted management range for
operator testing.
The PS5 ELF loader listens on TCP port `9021` after a successful exploit run. On
2026-10-01, a connection-only probe from `net-utils01` to
docs/PS5_SETUP.md
+8 -6
View File
@@ -147,9 +147,9 @@ O Compose inclui um DNS controlado no `net-utils01` que:
Manager, Spectrum Library e BlackBox;
- devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
telemetria bloqueados por DNS;
- responda apenas a clientes na VLAN das consolas (`192.168.40.0/28` por
defeito, via `ALLOWED_CLIENTS`), descartando consultas de qualquer outra
origem;
- responda apenas a clientes nas redes permitidas (por defeito, via
`ALLOWED_CLIENTS`: consolas `192.168.40.0/28`, servers `192.168.20.0/24` e
gestão `192.168.10.0/27`), descartando consultas de qualquer outra origem;
- registe as consultas nos logs do container;
- apresente um gateway HTTPS local e redirecione o browser para o exploit em
`http://192.168.20.30:8000/`.
@@ -177,9 +177,11 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para
resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
`192.168.20.30`; não deve consultar diretamente um DNS público.
O gateway só responde a consultas DNS vindas das redes listadas em `ALLOWED_CLIENTS`
(por defeito `192.168.40.0/28`, a VLAN das consolas). O valor aceita uma lista
separada por vírgulas de endereços individuais e/ou intervalos CIDR — por exemplo,
O gateway só responde a consultas DNS vindas das redes listadas em `ALLOWED_CLIENTS`.
Por defeito inclui a VLAN das consolas `192.168.40.0/28`, a VLAN de servers
`192.168.20.0/24` e a VLAN de gestão/confiança `192.168.10.0/27` (estas duas últimas
para o operador poder testar e administrar). O valor aceita uma lista separada por
vírgulas de endereços individuais e/ou intervalos CIDR — por exemplo,
`192.168.40.13,192.168.40.14` para trancar apenas às duas PS5 autorizadas (PS5FAT e
PS5PRO). Um valor vazio desativa o filtro e serve todos os clientes. Consultas de
origens não permitidas são descartadas e registadas como `denied`.