Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

First DNS Query Fails on Windows Server #116

Closed
moloch-- opened this issue Jul 12, 2019 · 2 comments
Closed

First DNS Query Fails on Windows Server #116

moloch-- opened this issue Jul 12, 2019 · 2 comments
Labels
bug Something isn't working

Comments

@moloch--
Copy link
Member

Describe the bug

The first DNS-C2 query on Windows Server operating system consistently fails, however subsequent attempts to establish a session are successful. This only seems to affect Windows Server-based operating systems

To Reproduce
Steps to reproduce the behavior:

  1. Deploy DNS C2 implant on Windows Server

Expected behavior
Establishes session on first attempt.

Desktop (please complete the following information):

  • OS: Windows Server 2k8, and Server 2016
  • Version: v0.0.7 (master)
@moloch-- moloch-- added the bug Something isn't working label Jul 12, 2019
@digital-shokunin
Copy link

Not sure if this is related, but after fixing the last issue in #135 I was able to build an implant and test out C2 communications. It seems the implant is reaching the C2 but communication seems to be broken:

image

@moloch--
Copy link
Member Author

moloch-- commented Nov 27, 2019

Yea, I've been trying to find sometime to look into more details as to why this is so unreliable. It somewhat related to Windows' Go ( golang/go#33097 (comment) ). The current DNS implementation also lacks redundancy in send/recv/ack, which isn't helping the situation. In my experience if you let the implant sit for a little bit the handshake will eventually go thru.

I've also found v0.0.6 to be slightly more reliable, though there's no significant changes between this and master.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants