Welcome to Exfiltration with Dnscat2. My name is Cristian Pascariu, and
in this course, you will learn how to bypass network defenses, and manage
to exfiltrate data during Red Team and penetration testing engagements.
dnscat2 is a DNS tunneling tool.
It's created by Ron Bowes and is designed to create an encrypted
command and control channel over the DNS protocol.
One unique aspect of dnscat2 is its ability to leverage legitimate DNS
infrastructure and enable you to exfiltrate data. It's available on GitHub,
where you'll find detailed instructions on how to set it up,
documentation about the protocol, and many other tips and tricks.
dnscat2 has two components, the client, which should be
deployed on a compromised machine,
and the server, which should be deployed on an
authoritative DNS server. And later in this course,
we'll cover what this actually means. In relation to the kill chain,
data exfiltration is an action that is performed after you have gained
the foothold into an environment, and you have an undetected persistent
connection to a compromised machine.
Let's now take a look at the Mitre Att&ck framework,
and see where dnscat2 fits in.
Our tool falls under the command and control and exfiltration
tactics. As dnscat2 is based on the DNS protocol,
it can be classified in the technique T1071 application‑layer protocol, and
the sub technique 004 DNS. In this course, we'll be focusing on data
exfiltration and the specific technique that we'll be covering is T1048,
Exfiltration Over Alternative Protocol.
As dnscat2 is able to encrypt data between the client and the server,
the sub technique 001, Exfiltration Over Symmetric Encrypted Non‑C2
Protocol also applies. To successfully mount an attack during a Red Team
engagement, persistent access to a compromised machine is a
prerequisite. dnscat2 can establish a second communication channel to be
used for data exfiltration. The benefit of this is that if it gets
detected and blocked, you will still have access to the compromised machine.