DOCSEARCHbyAlgolia
Submit Docs

dnscat2

repository·master·Indexed 26 days ago

https://github.com/iagox86/dnscat2

A command-and-control (C&C) tool that creates an encrypted tunnel over the DNS protocol to bypass network restrictions. It consists of a C-based client for compromised machines and a Ruby-based server for authoritative DNS servers. The tool features ECDH key negotiation, Salsa20 encryption, and SHA3 signatures, supporting interactive shells, file transfers, and TCP tunneling.

Tokens
12.8K
Snippets
18
Records
74
Agent score
81%

What's inside dnscat2

  1. Overview of dnscat2 Architecture

    master

    dnscat2 is a tool designed to create an encrypted command-and-control (C&C) channel over the DNS protocol. It consists of two main components:

    1. Client: Written in C with minimal dependencies, intended to run on a compromised machine. It can use an authoritative DNS server for requests or connect directly to a server via UDP/53.
    2. Server: Written in Ruby, intended to run on an authoritative DNS server. It listens for specific domains or direct UDP connections and establishes logical connections for data tunneling (files, shells, etc.).

    Unlike general-purpose tunnels, dnscat2 is optimized for C&C and encrypts all traffic by default.

  2. Understand the dnscat2 Server Architecture

    master

    The dnscat2 server is written in Ruby and follows a layered architecture designed to decouple network transport from the dnscat protocol.

    Core Components:

    • tunnel_driver: The network layer (e.g., driver_dns.rb). It handles raw packet data and converts it into byte streams. It is agnostic of the dnscat protocol.
    • controller: The central session manager. It receives decoded data from tunnel_drivers, identifies the correct session_id, and routes data to the appropriate session. There is only ever one controller.
    • session: Manages the state of a single connection (sequence/acknowledgement numbers, etc.). It implements the actual dnscat protocol and uses a driver to handle data.
    • driver: The interface between a session and the user/system. It defines how data is displayed or how commands are processed.

  3. Understand dnscat2 Encryption and Signing

    master

    dnscat2 uses ECDH and SHA3 to generate a shared symmetric key, which is then used with SHA3 and Salsa20 to sign and encrypt messages.

    Security Note: This is designed for speed and to prevent passive eavesdropping, not for high-assurance encryption like SSL. Active Man-in-the-Middle (MITM) attacks are only prevented if a pre-shared secret is used.

    Cleartext Data: Only the packet bodies are encrypted. The following header fields are transmitted in cleartext to allow routing and session identification:

    • packet_id: A random value.
    • packet_type: Information on packet type (e.g., syn, msg, fin).
    • session_id: Uniquely identifies the session.

  4. Understand the dnscat2 Client Architecture

    master

    The dnscat2 client is written in C (C89 standard) and follows a modular, layered architecture designed to be platform-independent (Windows, Linux, OS X, and FreeBSD). The architecture consists of four primary layers:

    1. tunnel_driver: The lowest layer that handles raw network communication (e.g., the DNS driver). It is agnostic of the dnscat protocol and simply converts network packets into byte streams.
    2. controller: A session manager that acts as the intermediary between the tunnel_driver and sessions. It routes decoded data from the driver to the correct session based on a session_id and polls sessions for outgoing data.
    3. session: The layer where the dnscat protocol is parsed and managed via a state machine. Each session is identified by a 16-bit ID and handles the logic of sequence numbers and acknowledgments.
    4. driver: The highest layer that defines how a session interacts with the local environment (e.g., a console, an executable, or a command interface). Each session has exactly one driver.

  5. Understand the dnscat2 architecture

    master

    dnscat2 is a layered protocol designed for resilient communication over DNS. Unlike its predecessor, it separates the server and client components and treats all data as a stream of bytes.

    Key architectural features include:

    • Separated Components: The server is implemented in Ruby, while the client is implemented in C.
    • Layered Protocol: It uses a driver to convert a byte stream into DNS requests and back, making DNS a lower-layer transport.
    • Resilient Polling Protocol: The 'dnscat protocol' is a simple polling network protocol where the client polls the server. It is designed to handle out-of-order, dropped, and duplicated packets.

  6. Compile the dnscat2 Client

    master

    The client is written in C.

    On Linux: Requires make and gcc.

    On Windows: Requires Cygwin or Microsoft Visual Studio. Load client/win32/dnscat2.vcproj into Visual Studio and build.

    $ git clone https://github.com/iagox86/dnscat2.git
$ cd dnscat2/client/
$ make

  7. Implement SEQ/ACK Numbering for dnscat2

    master

    The dnscat2 protocol uses SEQ (sequence) and ACK (acknowledgement) numbers to manage data reliability and ordering, similar to TCP.

    Workflow:

    1. Initialization: Both sides choose a random Initial Sequence Number (ISN) and exchange them during the SYN phase.
    2. Relationship: The client's SEQ is the server's ACK, and the server's SEQ is the client's ACK.
    3. Processing Received Messages:
      • If received_SEQ < local_ACK: The data is old/duplicate; re-acknowledge it by sending the current ACK.
      • If received_SEQ > local_ACK: The data is ahead of schedule; cache it or discard it.
      • If received_SEQ == local_ACK: Process the data, then increment local_ACK by the number of bytes received.
    4. Sending Data:
      • When sending, use the current SEQ and include any bytes from the queue that haven't been acknowledged by the peer.
      • Upon receiving an incremented ACK from the peer, increment your own SEQ and send new data from the updated offset.

  8. Tunnel arbitrary connections via dnscat2

    master
    dnscat2 supports tunneling arbitrary connections. This functionality is implemented as part of the command protocol. For detailed implementation details and how to interact with the tunneling mechanism, refer to the command_protocol.md documentation.

  9. Configure dnscat2 encryption and authentication

    master

    dnscat2 uses ECDH for key negotiation, Salsa20 for encryption, and SHA3 for signatures.

    Disabling Encryption

    • Client: Use the --no-encryption flag or compile with make nocrypto.
    • Server: Use the --security=open flag or run set security=open in the console. Note that the server rejects unencrypted connections by default.

    MitM Protection

    You can protect against Man-in-the-Middle attacks using two methods:

    1. Pre-shared Secret: Pass a secret to both sides using the --secret argument. The server can also change this at runtime with set secret=<new value>. If a secret is provided, the server can enforce authentication using --security=authenticated or set security=authenticated.
    2. Short Authentication String: A series of English words printed on both the client and server. If the words match, the connection is considered secure.

  10. Use Short-Authentication Strings (SAS) for Visual Validation

    master

    If a pre-shared secret is not used, a Short-Authentication String (SAS) can be used for manual visual verification of the connection.

    1. Calculate the hash: sas = SHA3-256("authstring" || shared_secret || public_key_client || public_key_server)[0,6] (using the first 6 bytes/48 bits).
    2. Map each byte to a word using the project's wordlist (/data/wordlist_256.txt).
    3. The user compares the 6 words displayed on the client against the 6 words displayed on the server.

  12. Install and Setup the dnscat2 Server

    master

    The server is written in Ruby and requires several gems.

    Prerequisites:

    • Ruby and Gem installed.
    • On Debian/Ubuntu, you may need ruby-dev if you encounter mkmf LoadErrors: sudo apt-get install ruby-dev.

    Installation Steps:

    1. Clone the repository.
    2. Navigate to the server directory.
    3. Install bundler.
    4. Run bundle install to install dependencies.

    Note: If you encounter permission errors, you may need to run these commands as root or use RVM.

    $ git clone https://github.com/iagox86/dnscat2.git
$ cd dnscat2/server/
$ gem install bundler
$ bundle install