In this demonstration, we're going to show
how DNS exfiltration can be used
to exfiltrate sensitive data from a compromised server
to an attacker's machine using the DNS protocol.
Now, the idea here is to send sensitive information,
such as a password hash, as part of a DNS query.
Now, DNS is a protocol commonly used to
translate domain names into IP addresses.
We know that already. But due to its design,
it can also be abused to exfiltrate small pieces of data,
making it useful for attackers trying to avoid detection.
So, by sending data in a DNS query,
the server receiving the query
(in this case, it's going to be our Kali Linux machine)
will extract the data and log it for later use.
This method is stealthy because DNS traffic is often allowed
to bypass through firewalls and security controls,
which makes it an effective method
for exfiltration and pen testing.
Okay, so again, so what we're going to do here
is we're going to take a password hash.
So, we're going to assume that we're
on this compromised server here,
and we're going to assume that we're able to perform
a hash dump and we stored it in this file
called sensitive data.txt
on our present working directory.
And now, we're going to send this information back
to our Kali Linux machine.
All right, so let's break down what's going on in this
particular script for our DNS exfiltration.
So, we have the basic import statements
that we have on all Python scripts.
So, we import information, our DNS library, et cetera,
and then we're going to set the information for IP address
for the target server, target DNS server,
which is going to be 10.211.55.6 on port 53.
And then we're going to set the path
to the file that we want to exfiltrate.
Now, typically, in any type of programming languages,
you want to make sure that you have paths to files
and other things like that stored in variables,
because if you have a long script, it's easier
to update one variable,
and that's going to change the information
in all the subsequent portions of that script.
So, we have the variable called file_to_exfiltrate,
and then we're going to read the contents
and prepare for exfiltration.
We're going to use this "with open" function,
and then we're going to use the path to the file, right?
So, we're going to file_to_exfiltrate,
going to sensitive_data.text,
and then we're going to store it in this "f" variable.
And then we're going to use this data variable
to store the information from that file okay?
So, it's going to read the file,
strip out any unnecessary information
and store it into this data variable.
So then, we're going to send the data as part of a DNS query
by embedding it into a domain name.
So, we're going to use example.com here.
So, we're going to take this data variable,
input it into this string.
So, when you have this "f" character, that means
that you're going to be allowed
to store variables in this string.
Typically, strings read it literally,
but when you have this "f" character,
it identifies things in curly brackets as variables.
So, all the information which is going to be a hash
of a password going to be stored into this data.
And then this data is going to be stored into this
particular domain function.
It's going to be part of a DNS query, okay?
The first part of the DNS query is going to be our hash
that we're trying to exfiltrate.
So then, we have the DNS query function.
So pretty much, we're structuring properly the DNS query,
and that's going to be a type A,
so converting simple human readable names to IP addresses.
Then we'll create a UDP socket to send the DNS query.
So pretty much, this is just protocol things that we need
to do in order to send the information.
So remember, UDP does not send the confirmation
that the other end actually receive the information.
So, as soon as we send out this information,
we're just going to print out that the "Data
was exfiltrated via DNS query."
We're not waiting for a code or any type of confirmation
because again, UDP is a fire-and-forget type of protocol.
So, lets save this.
Now, I'm going to go back to our Kali Linux machine
and break down what's happening on our DNS server.
So, we're back to our Kali Linux machine
and we're going to go over the script designed
for our DNS server. All right.
So, just like the other one,
we have our basic import statements giving us
all the software libraries that we need
to accomplish this task.
Then we're going to have the statement
to start the DNS server.
So we're going to set up a UDP socket to listen on port 53,
which is for DNS.
Okay, so we have our IP address,
and then we're going to have port 53,
and then we're going to simply print out the statement
stating that the DNS server is listening.
So then, we're going to run this loop.
That's simply going to be awaiting information
from our DNS clients.
Typically, DNS data packets are pretty small, so 512 bytes.
So, we're going to be waiting
to receive that information here.
And then once we receive something, we're going to print out
that message, letting whoever's using that script know
that we received a DNS query from X, Y, and Z address.
So then, we're going to try to go through
and parse the information.
We're going to get the DNS record,
we're going to store it into this DNS request variable.
And then we're going to exfiltrate the data from the query.
Remember, it's going to be the first part of the DNS query.
So we're going to go through here, right?
Want to take out the information from our request from our
client server, store it in this variable called
exfiltrated data,
and then we're going to print out that information, right?
So, we're going to print out "Exfiltrated data"
and then we're going to store the exfiltrated data,
which should be a hash of a password
that we stole from the compromised server.
Okay? So remember, this "f" character allows us
to show variables within a string function, right?
So, let's move on to the next tab.
So, I went ahead and started this server, right?
So, I ran the sudo python3 dns_server.py,
that's the name of this script that we're running.
So, it's already listening on our particular IP address,
port 53, which is for DNS.
And another thing I did was I used TCP dump.
So TCP dump is going get us the raw information coming from
the external compromised device.
So we're going to give this information,
we're going to use this information to verify
that we're actually receiving the information on port 53
to confirm that was successful.
So now, I'm going to switch back over to the Ubuntu server
and then start the script over there.
Alright. So, back to our compromised server.
So, we're going to do sudo and python3
dns_client.py.
Alright, perfect.
So, the data was exfiltrated via DNS query.
So, this is the information we're going to be
stripping out of this, right?
This is a way for us to hide our information in a form
of a simple query, because remember,
DNS protocols are typically allowed through firewalls.
So now, I'm going to switch back to our Kali Linux machine
to ensure that we receive the information.
Alright, perfect.
So, we're on the tab
that has our TCP dump information.
So, we see we receive the exfiltrated data right here okay?
So again, this was a UDP request sent via port 53,
so for our DNS.
And so it shows that we got this information
and then again, we can go back to our DNS server, right?
And it shows that we received the DNS query from our
compromised server IP address.
And this is the information that we received, right?
So we wanted to send that hash
and we were able to send that hash, 'cause again,
we constructed these scripts to look
for that particular information.
That's why Python is so powerful because you can modify
and customize your tools to do whatever you want to do.
So again, we designed our scripts to take the first portion
of the DNS query so we can properly have this information
stored on our machine
that we exfiltrated from the compromised machine.
So again, to just sum things up, we simply created
two separate scripts on our compromised server
designed to send DNS information to our Kali Linux box here.
And this is designed to receive information
via the DNS protocol.
This is a stealthy way to send information
because again, DNS is commonly trusted
because we're always trying to use a DNS server
and it helps us blend into
that normal flow of network traffic.
I hope you enjoyed this demonstration
and I will see you in the next one.