DNS C2 Spec

[its-a-feature]

On the roadmap for Mythic is to create a DNS C2 profile, so I'd like to start a discussion as to the features, requirements, and specifications people would like to see in it before we start the development process

[v1stra]

I think it would be great to be able to specify different record types to be used, (TXT, AAAA, A), etc

[its-a-feature]

Absolutely! It would be great to make sure they match too. So if you're requesting an A record, you get back a standard response. Having the request type being dynamically configurable would be really helpful too so that you could use something like A records normally, but for large output or file transfers switch to TXT

[nollium]

A lot of dns servers (e.g 8.8.8.8) randomize the case of dns queries to purposefully break dns tunnels using base64.

An option to use base32 (case insensitive) instead is a must have

[its-a-feature]

Oh, I hadn't heard of that before! That's super good to know! We could also use something like the netbios encoding used by Cobalt Strike (https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encoding-decoding/) to constrain the character set and always lowercase it so that the sensitivity doesn't matter

[v1stra]

DNS-0x20 encoding randomly capitalizes the characters https://astrolavos.gatech.edu/articles/increased_dns_resistance.pdf

[nikallass]

Does existing DNS C2 profile working?
https://github.com/MythicC2Profiles/dns

[its-a-feature]

That hasn't been updated, no. It's still on my roadmap to do, other things just came up that needed to happen first

[piolug93]

Possiblity use multiple domain for receive one message. That for evade detection based on volume requests for one domain.

[pr0b3r7]

To be clear, are you referring to rotational hosts in the same way it is being discussed here? If so, +1 on my end.

[piolug93]

Yes this is exactly what I had in mind.

[piolug93]

Minimalize sended data e.g. payloadUUID/callbackUUID is long and consume plce for date in small dns message storage.