DNSlivery icon indicating copy to clipboard operation
DNSlivery copied to clipboard

Some improvements to the code

Open snooze6 opened this issue 10 months ago • 0 comments

Hey there,

I had to use dnslivery on a engagement and there were some changes that I had to implement, I leave them here if you want to merge them.

  • Added resolution to type A and AAAA dns queries because some dns servers require that to forward the request. I found that when using nslookup file-txt.save.domain.com 8.8.8.8 dnslivery received a type A query for save.domain.com and if that was unanswered the dns server 8.8.8.8 returned timeout. Resolving everything to localhost worked perfectly.
  • Added case insensitive domain resolution. In one scenario a client had a dns server that randomized upercase and lowercase letters, probably to avoid dns c&cs. I just added a quick patch to make the code case insensitive.
  • Added CLM mode. If Powershell's language mode is set to constrained it is not possible to execute the default save payload because method invocation is supported only on core types in the constrained language mode.
  • Added 53 UDP socket listener to show the port as open.

snooze6 avatar Apr 11 '24 22:04 snooze6