1 of 36

Abusing DNS

Pentesting with DNS

Ron Bowes, DC204 / SkullSpace / etc.

https://tinyurl.com/dnscat-talk-dc204

2 of 36

Wow!

Such BSides

Wow!

Much SkullSpace

Many Google

Wow! DC204!

Yes, I know doge isn't cool anymore. It was when I made this slide. Now I'm taking it back!

3 of 36

You know the drill...

...but I have to say it.

The stuff I talk about here does not reflect the views of my employer, nor do does my employer necessarily condone anything I've done.

Information is provided without warranty, obligation, or consent. All sales final. See your pentester if symptoms continue for more than 3 days.

4 of 36

Things I'm gonna talk about

Things I'm not gonna talk about

  • How to use DNS for evil
    • Eg, data exfiltration
  • Specific DNS vulns
    • (poisoning, misconfiguration, etc.)
  • dnssec

RFC 1035

5 of 36

How DNS works

...in 5 minutes, or your money back (but not actually)

6 of 36

DNS requests (recursive)

Is it cached?

Yes: respond

No: send to 8.8.8.8

Is it cached?

Yes: respond

No: send to�X.root-servers.net

Is it cached?

Yes: respond

No: send to authoritative server

dig @192.168.0.1 test.skullseclabs.org

Return anything we want

X.root-servers.net

8.8.8.8

192.168.0.1

skullseclabs.org

7 of 36

Notice…

The endpoint never directly sent me a packet!

In fact, it didn't send a �single packet that left their �network!��(the router did)

8 of 36

Fun and games with Recursive DNS

9 of 36

The scenario…

I own skullseclabs.org. All requests to �*.skullseclabs.org go to my DNS server

10 of 36

Simple case: is somebody pinging me?

$ ping ab12.skullseclabs.org

Ping request could not find host ab12.skullseclabs.org. Please check the name and try again.

# ruby ./dnslogger.rb

dnslogger v1.0.0 is starting!

Starting dnslogger DNS server on 0.0.0.0:53

...

...

Got a request for ab12.skullseclabs.org [type = A], responding with NXDomain

11 of 36

DNS tunneling

Starring: dnscat2

Photo credit: me!

12 of 36

Some history

There were various DNS tunnels in the past, including one called 'dnscat' (it was Java - hasn't been updated since 2005), based on 'NSTX': http://tadek.pietraszek.org/projects/DNScat/

I wrote my own 'dnscat' as part of 'nbtool' a few years ago, roughly 2009: https://github.com/iagox86/nbtool

Re-wrote from scratch as 'dnscat2' a couple years ago. Still actively developing it!

13 of 36

The theory

You've compromised a machine already, and you need a way to communicate

Social engineering, an exploit, shell injection, etc. etc.

Dnscat2 implements DNS-based C&C

14 of 36

How is this different from…?

Most tunnels were written to get around paywalls, and only tunnel TCP

I explicitly de-scoped general-purpose tunnelling, and focused on command & control

Raw data / shell (not TCP) over DNS is uncommon, possibly unprecedented (at least in the open source world)

15 of 36

Features

Multiple simultaneous sessions

"Command" session (like meterpreter) - can execute commands, upload/download files, etc.

"Proxy" mode - tunnel TCP connections over DNS (like ssh -L)

[Newish!] Encrypted by default

16 of 36

Challenges with DNS

DNS is a really, really frustrating protocol to work with

Let's look at some of the more interesting challenges!

17 of 36

Challenge: DNS is stateless

This may be the most annoying problem

All requests come on the same port, from random upstream servers

It's impossible to know who sent which packet

18 of 36

Solution: session_id field

A field in the dnscat2 header that uniquely identifies a "connection"

Always sent in cleartext at the start of a packet, even encrypted packets (unfortunately, there's no alternative; believe me, I tried!)

19 of 36

Challenge: DNS is one way

The client can ask the server a question

But the server can't ask the client anything

In fact, the server doesn't know who the client is!

20 of 36

Solution: two-way communication

Solution: The client polls the server occasionally

What's the TXT record of "42494e474f0a.skullseclabs.org"?

It's "57617320686973206e616d652d6f0a"

21 of 36

The client even sends blank messages when it has no data

It's "77686f2773207468657265"

TXT for "656666"?

It's "6566662077686f3f"

TXT for "65666620796f7521"?

It's ""

TXT for ""?

It's "474554204954213f"

TXT for ""?

It's ""

TXT for ""?

It's ""

TXT for "6b6e6f636b206b6e6f636b.skullseclabs.org"?

22 of 36

Simple, right?

In reality, it works a little more like:

TXT for "6b6e6f636b206b6e6f636b.skullseclabs.org"?

It's "6566662077686f3f"

TXT for "6b6e6f636b206b6e6f636b.skullseclabs.org"?

It's "6566662077686f3f"

It's "6566662077686f3f"

Screw it. I'm getting a beer.

TXT for "6b6e6f636b206b6e6f636b.skullseclabs.org"?

TXT for "6b6e6f636b206b6e6f636b.skullseclabs.org"?

23 of 36

Challenge: DNS is incredibly unreliable

Retransmissions and drops are common

In fact, many DNS clients / relays will gratuitously retransmit, like it's a game or something!

24 of 36

Solution: A custom protocol

Uses a simple TCP-like protocol, designed with one-way communication mind

Has SYN/FIN packets to start/end sessions like TCP, and has MSG packets in the middle

Also has "ENC" packets, for setting up encryption

25 of 36

New(ish) feature:�Encryption!

26 of 36

Big new feature: Encryption!

All sessions are now encrypted - by default!

They can also be authenticated (to prevent man-in-the-middle attacks) with a pre-shared secret

Note: I'm not a crypto expert!

27 of 36

Technical details

Key exchange: ECDH w/ 256-bit keys (P-256)

Authenticator/signature/SAS: SHA-3 (sometimes truncated)

Encryption: Salsa20

(The choices were more informed by what I could find in Ruby/C than by what I actually wanted to use; however, they're still pretty solid choices)

28 of 36

Traffic forwarding

Newest feature!

On server:

Server will listen on port 1234, forward all connections via the dnscat2 session!

dnscat2> listen 1234 otherhost.com:4321

29 of 36

Traffic forwarding

Metasploit, etc

dnscat2� server

Owned client

Vulnerable server

Listens on port 1234

Connects on port 4321

30 of 36

Future plans

  • More speed! Better encoding! Compression!!
  • Shellcode!
  • Better UI! More web?
  • Gem-ification has started! With unit tests!
    • https://github.com/iagox86/dnscat2-core

31 of 36

Defense

32 of 36

The ultimate goal of dnscat2…

… is for dnscat2 not to work anywhere.

That's the fun of writing offensive tools.

But really, it's about giving us an easy way to prove that there's a problem!

33 of 36

Detection

… because I have friends who get mad when I only deliver bad news. :)

Tunneled DNS traffic stands out like a sore thumb; it's just a matter of looking for it!

A local friend wrote a thesis on it:�https://www.riebart.ca/hg/thesis/file/70f30181eb5c/Proposal/proposal.pdf

34 of 36

Detection

To summarize:

  • Collect all DNS queries for some block of time
  • Group the DNS queries by registered domain
    • For each domain, compute:
      • The average length of queries
      • The entropy of the queries
    • Then multiply them - the product is the metric for that domain.
  • DNS tunnels stand out like a sore thumb
    • Current version of dnscat2 was detected in ~10 seconds
    • (There are some false positives, such as CDNs)

35 of 36

Some other resources…

Some other research I've run across (if I miss something, please let me know!):

  • The owner of the Bro Network Security Monitor said he detects it with a Bro Script, but I can't find the script
  • Blacks Hills Information Security used RITA (Real Intelligence Threat Analysis) to detect dnscat2 and other backdoors by entropy:

36 of 36

Question?

Ron Bowes <ron@skullsecurity.net>

https://www.skullsecurity.org/

Twitter: @iagox86

Github: iagox86

https://tinyurl.com/dnscat-talk-dc204