The Ethical Hacker Network - Dropping tools and malware using DNS

Latest Additions

Who's Online

EH-Net News Feeds

Latest Additions

EH-Net > Ethical Hacking Discussions and Related Certifications > Network Pen Testing (Moderator: don) > Dropping tools and malware using DNS

Pages: [1] Go Down

« previous next »

	Author	Topic: Dropping tools and malware using DNS (Read 2765 times)
0 Members and 1 Guest are viewing this topic.

jimbob

Guest

Dropping tools and malware using DNS

« on: June 09, 2010, 06:27:49 AM »

Hi,
I blogged about the notion of using DNS TXT records to delivery binary files to a compromised system. Here is the link...

http://jimhalfpenny.blogspot.com/2010/06/delivery-your-malware-by-dns-http-is.html

I hope it's interesting to the folks here.

Regards,
Jim


	Logged

Ketchup

Hero Member

Offline

Posts: 1006

Re: Dropping tools and malware using DNS

« Reply #1 on: June 09, 2010, 07:11:37 AM »

Jim, that's an interesting idea! I believe that the individual TXT record size limitation is 255 characters. You can can get some fairly large file encoded this way, especially if you are splitting them up like you are. DNS even takes care of dealing with UDP traffic. Very nice!


	Logged

~~~~~~~~~~~~~~
Ketchup

yatz

Full Member

Offline

Posts: 222

Re: Dropping tools and malware using DNS

« Reply #2 on: June 09, 2010, 07:41:04 AM »

That's really interesting! How do you suppose you would get the record on the DNS server? Maybe something inside a trusted dynamic DNS update?


	Logged

"Live as though you would die tomorrow, learn as though you would live forever."

CCNA, MCSA, MCTS, Sec+, Net+, Linux+, CEH

jimbob

Guest

Re: Dropping tools and malware using DNS

« Reply #3 on: June 09, 2010, 09:34:47 AM »

Quote from: yatz on June 09, 2010, 07:41:04 AM

How do you suppose you would get the record on the DNS server? Maybe something inside a trusted dynamic DNS update?

You could add the records to a domain you have own, or to a zone file on a compromised DNS server. I'm not sure about dynamic DNS but that would be a novel way of setting up the records.

Jim


	Logged

Pages: [1] Go Up

« previous next »

Jump to:

SANS Deals 4 EH-Netters

$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012

Recent Forum Topics