{"id":14895,"date":"2021-07-21T21:02:20","date_gmt":"2021-07-21T15:32:20","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=14895"},"modified":"2021-07-21T21:02:20","modified_gmt":"2021-07-21T15:32:20","slug":"dnsstager","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/dnsstager\/","title":{"rendered":"DNSStager : Hide Your Payload In DNS"},"content":{"rendered":"\n

DNSStager<\/strong> is an open-source project based on Python used to hide and transfer your payload using DNS.<\/p>\n\n\n\n

DNSStager will create a malicious DNS server that handles DNS requests to your domain and return your payload as a response to specific record requests such as AAAA<\/code> or TXT<\/code> records after splitting it into chunks and encoding the payload using different algorithms.<\/p>\n\n\n\n

DNSStager can generate a custom agent written in C<\/code> or GoLang<\/code> that will resolve a sequence of domains, retrieve the payload, decode it and finally inject it into the memory based on any technique you want.<\/p>\n\n\n\n

You can edit the code of DNSStager agent as you wish, and build it using your own custom execution techniques.<\/p>\n\n\n\n

The main goal of using DNSStager is to help red teamers\/pentesters to deliver their payloads in stealthy channel using DNS.<\/p>\n\n\n\n

How Does It Work?<\/strong><\/p>\n\n\n\n

Based on your DNS resolution option, DNSStager will split your payload into chunks and save each chunk of the payload as a response for a subdomain.<\/p>\n\n\n\n

For example, if you choose IPV6<\/strong><\/code> as your option to retrieve the payload, the DNS response will be something like:<\/p>\n\n\n\n

cloud-srv-1.test.mydnsserver.live. 300 IN AAAA 5648:31d2:6548:8b52:6048:8b52:1848:8b52<\/strong><\/code><\/p>\n\n\n\n

Where 5648:31d2:6548:8b52:6048:8b52:1848:8b52<\/strong><\/code> is a part of your payload.<\/p>\n\n\n\n

So, the agent will resolve some domains to retrieve the payload and then decode it and finally inject it into memory.<\/p>\n\n\n\n

Currently, DNSStager only supports two records, AAAA<\/strong><\/code> and TXT<\/strong><\/code>. You can encode your payload using XOR for the AAAA<\/code> record and by default it will be encoded as base64 if you choose TXT<\/code> record.<\/p>\n\n\n\n

DNSStager Key Features<\/strong><\/p>\n\n\n\n

DNSStager has some key features such as:<\/p>\n\n\n\n