4 ms·
Dnsteal – DNS exfiltration tool for stealthily sending files over DNS requests
- efm 11y agoBe extra careful running this code, the second line contains a stack smash attempt.
- gruez 11y agocan you elaborate? is it exploiting a vulnerability in cpython? if so, what is it?
- efm 11y agoI do not believe this is exploiting a vulnerability in cpython.
- sargun 11y agoYou mean: # ~ \x90 What leads you to believe that's a stack smashing attempt?
- Dylan16807 11y agoI really hope you get an answer. I don't care that it's wrong, I want to hear why.
- tedunangst 11y ago"I once saw '0x90' in an exploit. I see it in this file. This file must be an exploit."
- Dylan16807 11y agoAnd that's enough to get someone that almost never comments to post an alert? I hope it's at least a little more interesting than that.
- eugenekolo2 11y agoIt's NOP in x86 asm and the guy's handle. https://twitter.com/_x90__ https://twitter.com/_x90__ Or what is the second line to you?
- efm 11y agoThanks.
- electrum 11y agohttp://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/592350.aspx http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...
- eugenekolo2 11y agoIt's a fun little program, but calling it stealthy is a reach. It seems to just extract a bytestream from the subdomain of the domain requested. Very easy to detect, very easy to see, and not much data can be xfered. It's equally as "stealthy" as just sending requests to a domain you own and logging every request. e.g. mysite.com/<bytes>
- spydum 11y agoLots of big enterprises shops monitor http traffic (proxies, transparent and otherwise).. DNS is one of those left unmonitored usually..
- dsl 11y agoLots of big enterprise shops monitor DNS too. OpenDNS (now Cisco) sells this as a service, lots of other security companies have tried to play catch up with various solutions.
- eugenekolo2 11y agoI think your use of dots speaks for itself there ;). I know of several companies that log DNS, and it wouldn't pass inspection by a human operator which also has to be considered for something to be stealthy.
- kbaker 11y agoI think it is stealthy since the data is not sent directly from the victim PC to the server, but rather the DNS server relays the file as a normal part of DNS recursion. Since it looks like a normal DNS request, it is much harder to filter than sending out packets on monitored and easily proxied ports like 80 and 443. I certainly wouldn't want to try and whitelist every DNS entry on the whole Internet...
- mercora 11y agoI don't think it is possible to use recursion for this. At least not reliably, as its quite likely you will hit a cached record. Which means the file would not have been transferred completely to your authoritative server... (using some kind of counter could help though)
- patrickmcmanus 11y agomore generally - ip over dns https://github.com/yarrick/iodine https://github.com/yarrick/iodine