It might be the only board that companies do not block.
Yes this is the DNS sport.
Attackers can abuse this weakness and firewalls to set up a command and control channel that can be
very difficult to detect or even block.
We need to set up a server with DNS cat to software installed that will listen to the DNS queries from
the DNS to client.
Once this is established we can transmit data and even invoke commands over this channel.
As you can see here on the screen this is the server with DNS to cat installed.
And this is the client.
All the traffic is blocked through the firewall.
Consider it a corporate firewall except the DNS traffic on Port 53 that is used to resolve you or else.
So attackers will leverage this open port here to set up an external command and control center to perform
various types of malicious acts.
First of all we need to install the DNS capital server on our caliber machine and then run on it for
this purpose here.
Just have to copy this this code will update the repository of Kali and we'll install ruby on rails.
Then we'll install the bundler and then we'll get the DNS cut too from GetUp.
It will clone it on our killing machine.
Then we will navigate through this directly under the DNS get to folder and then we'll run bundle install
so let's go here and based these comments.
That's it.
Now let's do some listing here.
You know you need to run Ruby and invoke the DNS cat to dot Barbie.
Here we go.
The DNS scattered server started listening to port fifty three.
Now our server is set up and ready.
Now we'll go to store the client port for the claim.
Just navigate to downloads.
That's called Security dot org slash DNS Cat 2 and installed windows the version on the client side.
I have downloaded that here.
We're open command prompt navigate to the desktop and invoke this command.
So this comment is DNS cat to dot e XY then hyphen hyphen DNS space server equal.
Now we have to put here the IP of the command and control center opening new terminal and let's check
the IP it is 61 or 1 4 4.
So by invoking this command the server that has already presented an interactive shell to remotely control
systems will establish this channel over port 53
so encrypted session has been established on Port 53 as you can see and the type is the D.C. name and
x.
If you go again you will see that in your session new window created session number one.
Now a connection has been established and the server has been notified of that to interact with the
first session.
Just type session I find I want and you'll see that this is the name of the client here the victim.
Now we have a remote child to interact with it type help and you will see all the commands that you
can run remotely such as upload download exact shutdown et cetera.
Now let's try to run notepad remotely.
Just type exec notepad that he XY in the press enter it to tell you that the request has been sent and
let's go here to the victim and you will see that notepad has been invoked with creating each session.
You'll be notified here on the server and you can interact accordingly using this command session.
My wife and I and a number of the session as you can see a tunnel has been established between the client
and server over port CFTC just to make sure that it's over the ports that you see.
We will run wild shrike in order to sniff the traffic and investigate the type of traffic being sent
and received
will select the only way in and then we'll press capture now.
Web site is active on the server side.
That's clear again.
And
trigger the same command and let's open wire shark as you can see here.
The protocol is mainly DNS
so anyone who is monitoring that the victim's network traffic will only see DNS queries.
This traffic will of course blend with the noise that is present on many networks.
Let's say for example here.
Establishing the initial command and control connection.
It requires DNS cat client to resolve it Texaco which is basically very normal thing to do.
So it will not trigger an alert.
So to protect against this type of attack you should block outbound DNS traffic and only allow trusted
DNS servers interaction.