TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow server and management VLANs to query the DNS

Browse Source 
Broaden ALLOWED_CLIENTS from the console VLAN alone to also include the server
VLAN (192.168.20.0/24) and the trusted management VLAN (192.168.10.0/27) so the
resolver can be tested and administered from those networks. The consoles still
only require the 192.168.40.0/28 range.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
kadinho
2026-10-11 13:27:52 +01:00
co-authored by Claude Opus 4.8
parent 7292a500eb
commit 9f28b8e2a1
4 changed files with 28 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+11 -8
View File
@@ -194,12 +194,14 @@ sends DNS only to `net-utils01`; that host must be allowed to reach the configur
upstream resolver on UDP/TCP 53.
The gateway additionally restricts which source clients it answers. `ALLOWED_CLIENTS`
defaults to the console VLAN `192.168.40.0/28`; queries from any other source address
are dropped and logged as `denied`, on both UDP and TCP. The value accepts a
comma-separated mix of individual addresses and CIDR ranges, and an empty value
disables the filter. This keeps the service dedicated to the two authorized consoles
and prevents other LAN hosts from using it as an open resolver for the allowlisted
names.
defaults to the console VLAN `192.168.40.0/28`, the server VLAN `192.168.20.0/24`,
and the trusted management VLAN `192.168.10.0/27`; queries from any other source
address are dropped and logged as `denied`, on both UDP and TCP. The server and
trusted VLANs are included so operators can test and administer the resolver; the
consoles themselves only need the `/28`. The value accepts a comma-separated mix of
individual addresses and CIDR ranges, and an empty value disables the filter. This
keeps the service off the rest of the LAN and prevents arbitrary hosts from using it
as an open resolver for the allowlisted names.
The Payload Manager review used upstream commit
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
@@ -230,8 +232,9 @@ not required for catalog browsing or BlackBox updates.
The PS5 was previously identified as `192.168.10.26`; requests from
`192.168.10.6` seen at that time were from the operator's own workstation, not a
console, before the consoles were moved onto VLAN 40. All `192.168.10.0/24`
addresses are historical and must not be used as the current payload destination;
with `ALLOWED_CLIENTS` set to `192.168.40.0/28` they can no longer query the gateway.
addresses are historical and must not be used as the current payload destination,
though `192.168.10.0/27` remains allowed as the trusted management range for
operator testing.
The PS5 ELF loader listens on TCP port `9021` after a successful exploit run. On
2026-10-01, a connection-only probe from `net-utils01` to