I want to demonstrate an attacking scenario in which DNS tunneling is used to get information out of a protected network. There is the compromised host behind the firewall, at which the client is installed and it needs to send a file over the DNS tunneled connection to a server controlled by the attacker.

I have set up the DNS tunneling using DNSCat2. I can connect the client to the server and interact, I even have shell.

What I want is to transfer a file from the victim host to the server using the DNS tunnel only. I cannot seem to find this functionality*, is there any way to accomplish it?



There are literally tons of ways to do this, but the simplest is to transfer them over text.

  • For example, you can base64 encode the file and echo it out to the remote host (or vice versa) then decode the base64 on the other side.
  • There's also this technique demonstrated by SANS.
  • Be creative!

The tunnel only provides you with a remote shell, nothing more. To receive files you'll need to use an other protocol, FTP, RSYNC or even SSH.

You can also setup the DNS tunnel, bind a local SSH or SOCKS daemon on a high TCP port, then use a remote SSH (initiated from the server) towards the DNS client, this essentially turns the compromised host into a server within the internal network. You can leverage from this to exploit the internal network any further. Of course this is beyond your question.

  • I have already been able to transfer a file from victim to remote server with scp, using my shell session, but my restrictions are the behind the firewall everything is blocked for the victim, accept from the dns requests. So, the question is, is there a way to use the DNS quering mechanism to transfer files over DNS tunneling (in my case and in general)? Sep 9 '16 at 13:11
  • @antonis_man Yes that is what I was referring to. You establish these protocols OVER the tunnel. Sep 9 '16 at 13:18
  • @YorickdeWid I would be curious to see how you set up a TCP exchange within an UDP protocol, moreover when there's an internal DNS server in the path.
    – Tensibai
    Sep 9 '16 at 14:55
  • @Tensibai This happens all the time with tunnels. TCP packets are incapsulated in large (512+) UDP packets. VPN servers do no different Sep 9 '16 at 14:58
  • @YorickdeWid Well this leaves me a strange 'I don't get how this could work' with an output only UDP flow (with a two way flow I could get it). I've to dig the subject on how you could send a TCP SYN/ACK within a DNS query). I you have some link to start from I'll be happy
    – Tensibai
    Sep 9 '16 at 15:07

Turns out that I skipped this part on documentation, the tool offers both download and upload functionality. After you get server running and connect a client, you can start a session on the server with:

session -i 1

and then

download/upload <path/of/the/file>

and this way you can exchange files over DNS tunneling.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.