Egress-Assess
Egress-Assess copied to clipboard
DNS Exfiltration Method Fixes
We were planning to use Egress Assess for a DNS exfiltration exercise for a client of Maveris' when we were quickly met with Python exceptions. The first interpreter we used was Python 3.10 and it was discovered the current Python code is broken out of the box with this version. From my understanding, core libraries in updated Python versions changed some APIs and were expecting data of different types. After this, we discovered the DNS resolved method used base64 for the subdomains. This is an issue if the environment uses upstream DNS servers which can scramble the casing of the subdomain and randomize it and all decoded base64 will be inaccurate. Hence, it was replaced with hexadecimal. It was then run with a different Python interpreter (3.12) where further issues were discovered and ultimately fixed due to library changes.