[ntlmrelayx] LDAP attack: Add DNS records through LDAP

[SAERXCIT]

Hi !

This PR adds the --add-dns-record as a ntlmrelayx LDAP attack, inspired by Kevin Robertson's ADIDNS research, and his own implementation in Inveigh.

The idea is being able to poison beyond the local subnet to get more authentications from hopefully higher-privileged users and machines. More info in the accompanying blog post.

Ntlmrelayx will add the provided name as an A record pointing to the provided IP, unless the name is wpad in which case it will bypass the GQBL using a NS record. Please note that adding a wildcard or wpad record could create disruptions in larger networks (using multiple DNS subdomains) or if workstations already use a proxy config. A warning was added to remind the user of that.

The output will be the following, in case of a wpad record:

[!] You are asking to add a `wpad` or a wildcard DNS name. This can cause disruption in larger networks (using multiple DNS subdomains) or if workstations already use a proxy config.
[*] HTTPD: Received connection from 10.72.72.101, attacking target ldap://dc1.domain.local
[*] Authenticating against ldap://dc1.domain.local as domain.local\BORDEAUX$ SUCCEED
[*] Assuming relayed user has privileges to escalate a user via ACL attack
[*] Checking if domain already has a `wpad` DNS record
[*] Domain does not have a `wpad` record!
[*] To add the `wpad` name, we need to bypass the GQBL: we'll first add a random `A` name and then add `wpad` as `NS` pointing to that name
[*] Adding `A` record `jwsgliwpffgv` pointing to `10.72.72.200` at `DC=jwsgliwpffgv,DC=DOMAIN.LOCAL,CN=MicrosoftDNS,DC=DomainDnsZones,DC=DOMAIN,DC=LOCAL`
[*] Added `A` record `jwsgliwpffgv`. DON'T FORGET TO CLEANUP (set `dNSTombstoned` to `TRUE`, set `dnsRecord` to a NULL byte)
[*] Adding `NS` record `wpad` pointing to `jwsgliwpffgv.DOMAIN.LOCAL` at `DC=wpad,DC=DOMAIN.LOCAL,CN=MicrosoftDNS,DC=DomainDnsZones,DC=DOMAIN,DC=LOCAL`
[*] Added `NS` record `wpad`. DON'T FORGET TO CLEANUP (set `dNSTombstoned` to `TRUE`, set `dnsRecord` to a NULL byte)

Credits for Kevin Robertson for the research in implementation in Powermad and Inveigh, and to Dirk-Jan Mollema for dnstool.py.

Cheers !

[0xdeaddood]

Thanks @SAERXCIT!