In this course, I will use the Windows VM as the victim machine,
where the dnscat2 client will be deployed,
and the server.
I will use a Kali VM to form a direct connection
between the client and the server.
And later on in the course,
I will use a cloud‑hosted VM that will be set up as an authoritative DNS server,
and the traffic will be routed through the public DNS infrastructure.
Based on the DNS protocol, the tunnel is based on the client sending DNS queries,
asking for commands, or sending information.
The way you control the victim machine will be through
commands that are embedded in the DNS responses.
Do note here that the direct communication channel
between the victim and the dnscat2 server,
while it will be fast, it can easily be detected.
The second mode of operation is based on traversing the DNS hierarchy.
This also requires owning a domain name,
for which the authoritative server will be the machine
where dnscat2 server will be installed.
Moving forward with setting up dnscat2,
the server component of dnscat2 requires Ruby.
If you're using a recent version of Kali,
Ruby is already installed, but if you're deploying dnscat2 on another machine,
it's worth considering installing it.
The client component has native binaries for the most common platforms,
including Windows and Linux.
Links to where to download them can be found on GitHub.
Another aspect to consider is that the server must be running
before any client can connect to it; otherwise,
the client will attempt the connection,
and it will terminate if it does not find a dnscat2 server.
Once the session is established,
there are a couple of important commands for managing the
session that is good for you to be familiar with.
Help will provide the full list of commands.
Windows will list all the existing sessions, and to interact with
the session, you have to use the ‑i parameter,
followed by the ID Number of the session.
Another good tip for a common issue that you might run into, if you're trying
to set up dnscat2 server on Ubuntu systemd‑resolved might be using port 53,
preventing you to run dnscat2 on the native DNS port.
A quick fix for this is to disable the service by using the commands above.
Please note that this will stop the DNS resolution service for your machine,
so you may need to re‑enable it later.