Dnscat - Revision history

Unknown user: /* DNS Setup */

2022-03-07T14:29:57Z

DNS Setup

← Older revision		Revision as of 14:29, 7 March 2022
Line 83:		Line 83:
	The C2 server should be a registered domain, and should be an authoritative DNS server, and the authoritative DNS server should be the same server running the dnscat2 server.		The C2 server should be a registered domain, and should be an authoritative DNS server, and the authoritative DNS server should be the same server running the dnscat2 server.

	~~To make a DNS server authoritative for your domain, you will inform the domain registrar of the authoritative DNS in the domain. There is often an option~~ to ~~do this in Domain Management/Domain Settings.~~		Here's how to set that up:

	~~Edit DNS Zone file, and add several records:~~
	* Add two A records <code>ns1</code> and <code>ns2</code> that ~~point to the C2 server~~
	* Add two DNS records with host <code>ns1</code> and <code>ns2</code> to point to n1.domain.com and n2.domain.com

	~~Next, make sure the domain is set~~ up ~~to use your own, custom nameservers. Add the nameservers ns1.domain.com and ns2.domain.com). Give some time for settings to take effect.~~

	~~Now when you run dnscat2 on either machine, you'll specify domain.com~~

			* Suppose you are using example.com as the domain

			* Add two new A records that will be the nameserver subdomains, and will both point to the dnscat2 server IP address:
			** <code>ns1.example.com</code>
			** <code>ns2.example.com</code>

			* Now you should inform the domain registrar that the authoritative DNS server for this domain is the dnscat2 server
			** Set up the domain to use your own, custom nameservers
			** Add the nameservers ns1.example.com and ns2.example.com

			Give some time for settings to take effect.

			Now when you run dnscat2 on the server, you specify example.com domain (instead of no argument), and on the server, you specify example.com domain (for --host flag, instead of host IP).

	=Resources=		=Resources=

Unknown user at 14:21, 7 March 2022

2022-03-07T14:21:48Z

@@ Line 1: / Line 1: @@
-Imagine the power of [[Netcat]], but with everything tunneled through DNS packets. Imagine the power!!!
+=Overview=
-Dnscat2 does precisely that: http://www.doctorchaos.com/dnscat2-dns-reverse-tunneling-thru-secure-networks/
+==What is it?==
-More detailed info: https://zeltser.com/c2-dns-tunneling/
+dnscat2 is a tool for smuggling connections into secure networks by hiding the connection in DNS queries. It works by running a dnscat2 server and a dnscat2 client, and having the two ends communicate via DNS queries.
-Code on Github: https://github.com/iagox86/dnscat2
+There are two ways of running dnscat2:
-The dnscat2 software is run on a C2 server that listens for a client. The software is then run on a client, which attempts to connect to the C2 server and establish a session. Once a session is established, a reverse connection is created from the C2 server, which enables an attacker to run arbitrary commands on the remote client's machine.
+* In "direct DNS" mode, the client can communicate with the attacker directly as if the attacker were a standard DNS server. This is the simplest setup, but in a more secure network, machines may be restricted to only run DNS queries using explicitly allow-listed DNS servers.
-The C2 server should be a registered domain, and should be an authoritative DNS server, and the authoritative DNS server should be the same server running the dnscat2 server. To make a DNS server authoritative for your domain, you will inform the domain registrar of the authoritative DNS in the domain. There is often an option to do this in Domain Management/Domain Settings. Edit DNS Zone file, and add several records:
+* In "proxy DNS" mode, the client and server can still communicate, but the DNS queries are proxied by another DNS server. This method requires a public DNS entry that points to the dnscat2 server. The client can then send and receive DNS queries to and from the dnscat2 server by using that public domain, and having the DNS queries handled by an intermediary DNS server.
 * Add two A records <code>ns1</code> and <code>ns2</code> that point to the C2 server
 * Add two DNS records with host <code>ns1</code> and <code>ns2</code> to point to n1.domain.com and n2.domain.com
@@ Line 16: / Line 92: @@
 Now when you run dnscat2 on either machine, you'll specify domain.com
 =Flags=
 {{KaliFlag}}

Admin at 19:10, 19 August 2016

2016-08-19T19:10:52Z

← Older revision		Revision as of 19:10, 19 August 2016
Line 16:		Line 16:

	Now when you run dnscat2 on either machine, you'll specify domain.com		Now when you run dnscat2 on either machine, you'll specify domain.com

			=Flags=

			{{KaliFlag}}

Admin: Created page with "Imagine the power of Netcat, but with everything tunneled through DNS packets. Imagine the power!!! Dnscat2 does precisely that: http://www.doctorchaos.com/dnscat2-dns-re..."

2016-08-19T19:10:40Z

Created page with "Imagine the power of Netcat, but with everything tunneled through DNS packets. Imagine the power!!! Dnscat2 does precisely that: http://www.doctorchaos.com/dnscat2-dns-re..."

New page

Imagine the power of [[Netcat]], but with everything tunneled through DNS packets. Imagine the power!!!

Dnscat2 does precisely that: http://www.doctorchaos.com/dnscat2-dns-reverse-tunneling-thru-secure-networks/

More detailed info: https://zeltser.com/c2-dns-tunneling/

Code on Github: https://github.com/iagox86/dnscat2

The dnscat2 software is run on a C2 server that listens for a client. The software is then run on a client, which attempts to connect to the C2 server and establish a session. Once a session is established, a reverse connection is created from the C2 server, which enables an attacker to run arbitrary commands on the remote client's machine.

The C2 server should be a registered domain, and should be an authoritative DNS server, and the authoritative DNS server should be the same server running the dnscat2 server. To make a DNS server authoritative for your domain, you will inform the domain registrar of the authoritative DNS in the domain. There is often an option to do this in Domain Management/Domain Settings. Edit DNS Zone file, and add several records:
* Add two A records <code>ns1</code> and <code>ns2</code> that point to the C2 server
* Add two DNS records with host <code>ns1</code> and <code>ns2</code> to point to n1.domain.com and n2.domain.com

Next, make sure the domain is set up to use your own, custom nameservers. Add the nameservers ns1.domain.com and ns2.domain.com). Give some time for settings to take effect.

Now when you run dnscat2 on either machine, you'll specify domain.com