3 ms·

Don't just get files, use DNS for Command and Control too. http://blog.strategiccyber.com/2013/06/06/dns-command-and-control-added-to-cobalt-strike/ http://blo

• raffi 13y ago
  After I wrote that blog post, I also added the ability to tunnel traffic through Beacon when its checking in several times each second. Recently, I added the ability for it to download a large file, a piece at a time, with each checkin. The size of the piece depends on the data channel (DNS vs. HTTP). It's all encrypted too. - http://blog.strategiccyber.com/2013/06/20/thatll-never-work-we-dont-allow-port-53-out/ http://blog.strategiccyber.com/2013/06/20/thatll-never-work-... - http://blog.strategiccyber.com/2013/07/09/hacking-through-a-straw-pivoting-over-dns/ http://blog.strategiccyber.com/2013/07/09/hacking-through-a-... Cobalt Strike is a commercial tool, so it better include the bells and whistles. The OP does a good job of showing code that anyone can play with, right now. Dan Kaminsky's BlackHat presentations on OzymanDNS are excellent as well.
  • 16s 13y ago
    I really like your blog post and your ideas. With new versions of BIND 10 allowing Python scripting, PowerDNS with Lua scripting and Unbound with Python, I think we'll start seeing more corps controlling DNS queries (or attempting to do so) with whitelists/blackslists, but for the time being, things are mostly wide-open.