Let’s kick this off by installing Dnsmasq on our Kali machine. This utility contains a simple conf file and for our purposes will be trivially smaller than most configurations. Dnsmasq is a lightweight utility that’s able to provide both DNS and DHCP services. One of the ways we can have a DNS server run on Kali Linux is through the use of Dnsmasq. In particular, we’ll demonstrate three different types of staged payloads we can stage in DNS, a listener address, shellcode, and even an entire script. This makes DNS a valuable tool for us to use to our advantage as we can use it to host DNS records that contain data we can incorporate into our payloads. In addition to this, it’s equally as uncommon for local DNS traffic to be monitored when it doesn’t go through this set of servers. Although it’s expected for a specific set of DNS servers to be configured on a client, it’s not all that common for DNS traffic to be explicitly restricted to that same set of configured servers. One of the benefits of DNS is that it’s a protocol that is nearly guaranteed to be accessible through an endpoint firewall. The referenced scripts and other materials from this post can be found in the following GitHub repo DNS Smuggling We will kick this off by demonstrating how you can accomplish this through DNS. What I’m looking to impart to you are techniques you can employ to create your own methods to deliver staged payloads, right from Kali Linux. This becomes equally as important when the more common techniques keep getting busted by various endpoint defenses. The concept of a staged payload is very useful and can be incorporated into various other strategies to prevent embedding too much information. One of the more common frameworks for this that most of us have become accustomed to using staged payloads with is the Metasploit Framework.

A staged payload contains just enough code to call back to a system under our control and retrieve the remaining code necessary for us to complete our task, such as to establish a reverse shell.

Security Operations for Beginners (SOC-100)Īs penetration testers, we often come up with creative methods to deliver and execute our payloads, such as staged payloads.Exploit Development Prerequisites (EXP-100).

How to use exiftool kali linux