We've done this setup in the previous lab and we were able to establish an external command and control
center to compromise the victim that has DNS CK2 installed all the traffic where blocked except the
DNS traffic import 53.
So we were able to compromise this hole in the firewall.
Now how to meet against this is very easy.
Our Internal DNS servers should only communicate with external authorized DNS servers.
And in this situation here we can easily block the IP of the server and life goes on.
Now we have kind of walk around on that using this structure.
Now the Internal DNS server will all be resolved with external legitimate DNS service.
For that we blocked the previous IP.
Now what if we go to for example GoDaddy dot com or any registrar registered our domain there and configure
the name servers of this domain to point to our malicious server that has DNS cat to server and so on.
So our local DNS will not talk to the malicious server directly but will resolve normal query with a
legitimate DNS server but the name servers point to our malicious server.
So for this purpose we need to set up a cloud server here.
We need to buy a domain configure that.
So let me show you how to do that to purchase a cloud server you can use VBA as cheap or digital ocean.
These are two providers that can provide a cheap VPN server per month or even per year.
I've done the setup.
This is my Ubuntu server VPN server and this is my public IP.
Here it's 1 9 2 250 2 3 6 1 5 4 and now on our 1 2 server we need first to install get IP key dash get
install yet after that I just need to run the commands that we've run earlier on our local machine.
Just copy that and paste it here in the terminal.
This will install ruby and we'll clone the DNS cart to server from get hub.
Now after that we're ready to run the server as you can see here that it has started listening to port
fifty three.
Now we can communicate with the server from our client by issuing this command we can put the server
IP here or domain name and then the secret for the connection to be encrypted.
To configure the server to accept secret to encrypt the session you can end the command with hyphen
Hive in secret and your secret one.
In this case one two three four five six.
Just press enter and here we go.
If you want to connect with the server you will use this comment on the client going there on the client.
I'm using the DNS cat command then server ip port and secret hit enter and A session with appreciated
secret will be established.
You can as well interact with a session here using the same command we used previously.
Let's type the help command and let's run again.
For example notepad remotely.
Let's go to the client.
And here we go.
We were able to invoke that from a command and control center over the Internet.
On the other hand I have another DNS server which is published on the Internet as well.
The euro url or the domain name as farmer mad CRM dot com.
This is just domain that I've been using.
So now I need to point or to update the name servers of this domain to point to my malicious ubuntu
server that as DNS cat to install.
So just go here to the domain under the forward lookup zones.
If you're using GoDaddy for that it's very easy as well to to manage these.
So just go to the settings of your domain on your domain manager and point the name servers first of
all you have to create on some registrars you have to create two hosts for name servers.
Name Server one dot to your domain dot com and name server 2 and as to that your domain dot com.
So these two hosts will point to the IP of your choice.
So I'll just update the IP here.
Here we go and name server 2 as well.
So now my domain takes some time to refresh this and to propagate this over the Internet so my domain
name will point to my malicious ubuntu server after performing this configuration on our DNS.
Just have to issue this command here on your client and the same thing will happen.
You'll be able to perform a tunnel over port 53 using a domain name instead of IP.