TL;DR DNSlivery allows delivering files to a target using DNS as the transport protocol. Features:
allows to print, execute or save files to the target
does not require any client on the target
does not require a full-fledged DNS server
What problem are you trying to solve? Easily deliver files and/or payloads to a compromised target where classic web delivery is not possible and without the need for a dedicated client software. This applies to restricted environments where outgoing web traffic is forbidden or simply inspected by a curious web proxy.
Even though more complete DNS tunneling tools already exist (s.a. dnscat2 and iodine), they all require to run a dedicated client on the target. The problem is that there is probably no other way then DNS to deliver the client in such restricted environments. In other words, building a DNS communication channel with these tools require to already have a DNS communication channel. In comparison, DNSlivery only provides one-way communication from your server to the target but does not require any dedicated client to do so. Thus, if you need to build a reliable two-way communication channel over DNS, use DNSlivery to deliver the client of a more advanced DNS tunneling tool to your target.
How does it work? Just like most DNS tunneling tools, DNSlivery uses TXT records to store the content of files in their base64 representation. However, it does not require to setup a full-fledged DNS server to work. Instead, it uses the scapy library to listen for incoming DNS packets and craft the desired response.
As most files do not fit in a single TXT record, DNSlivery will create multiple ordered records containing base64 chunks of the file. As an example, the above diagram illustrates the delivery of the 42nd chunk of the file named file. In order to retrieve all base64 chunks and put them back together without the need for a dedicated client on the target, DNSlivery will generate for every file:
a simple cleartext launcher
a reliable base64 encoded stager
This two-stages delivery process is required to add features to the stager (s.a. handling lost DNS responses) that would otherwise not fit in a single TXT record.
Note on target compatibility Currently, only PowerShell targets are supported. However, DNSlivery could be improved to support additional targets such as bash or python. Please let me know @no0be if this is a feature that you would like to see being implemented.
Requirements DNSlivery does not require to build a complex server infrastructure. In fact, there are only two simple requirements:
be able to create a NS record in your public DNS zone
have a Linux server capable of receiving udp/53 traffic from the Internet
DNS Zone The first step is to delegate a sub-domain to the server that will run DNSlivery by creating a new NS record in your domain. As an example, I created the following record to delegate the sub-domain dnsd.no0.be to the server at vps.no0.be.
dnsd IN NS vps.no0.be.
If your zone is managed by a third-party provider, refer to their documentation to create the NS record.
DNSlivery The only requirements to run DNSlivery are python3 and its scapy library.
git clone https://github.com/no0be/DNSlivery.git && cd DNSlivery pip install -r requirements.txt
Server DNSlivery will serve all files of a given directory (pwd by default) and needs to be run with root privileges to listen for incoming udp/53 packets.
DNSlivery - Easy files and payloads delivery over DNS
positional arguments: interface interface to listen to DNS traffic domain FQDN name of the DNS zone nameserver FQDN name of the server running DNSlivery
optional arguments: -h, --help show this help message and exit -p PATH, --path PATH path of directory to serve over DNS (default: pwd) -s SIZE, --size SIZE size in bytes of base64 chunks (default: 255) -v, --verbose increase verbosity