In a previous scenario,
I've mentioned that I have disabled antivirus because the client gets detected.
Most antivirus and endpoint detection capabilities already flag
the presence of the dnscat client executable.
An option here is to build it yourself from the available source code,
and then use common obfuscation techniques.
A second option is to use an alternative dnscat2 client for file‑less execution.
There is a PowerShell implementation of the client created by Luke Baggett,
and it's available on GitHub.
So let's test this out.
We will load the dnscat2 PowerShell module, and we'll run it to establish a
DNS tunnel. We're once again using the cloud‑hosted droplet.
I have already connected to it via SSH. Similar to the previous
scenario, we're starting the dnscat2 server,
and we use the globonamtics.com domain as the parameter.
This does not change regardless of the client. Switching to our
victim machine, this is the GitHub repository for dnscat2
PowerShell, and scrolling through the ReadMe file,
we can identify the command to load this module into memory.
Below are also a few examples on how this can be
used. So we'll copy this long string.
We open up a PowerShell terminal.
We paste the string and press Enter to download and load it into memory.
Now we can just launch dnscat2 PowerShell client by specifying
our domain. Please note that usually these commands can be
chained together into a single command.
Now this is running without any issues, so we'll switch to the cloud VM.
We'll run windows to view the existing sessions, and we can see a DNS
tunnel is established with the victim machine.
Next, we'll interact with this session, and as proof of
concept, we'll execute the calculator.
Switching to the victim machine, we can see the calculator
is being executed with a bit of delay.