Re:Escaping from isolated networks using Broadcast DNS
by oherrala on Monday January 15, 2024 @04:08AM
(#38998761)
Greetings from SensorFu and thanks for a good question! Sending DNS query via broadcast is a hack to escape from isolated environments and it takes advantage of operating system IP-stack's shortcomings. Since this is probably not conforming to any specifications anything could happen.
I'd say return channel might work and it depends on the device used to exfiltrate out. In case of proper DNS server like Active Directory mentioned in the article it's likely that it could work. But we have not yet done testing.
We have also seen devices that are not DNS servers and still just forward broadcast packets from one network interface to another. In such case the return channel might not be possible.
Re:Escaping from isolated networks using Broadcast DNS
by justsomehnguy on Monday January 15, 2024 @12:02PM
(#39003065)
There is no such thing as a broadcast DNS.
There could be packets directed to the network broadcast address (for IPv4 networks), there could be packets with a broadcast MAC address (all FFs), nothing from that requires packet to be of DNS protocol.
> devices that are not DNS servers and still just forward broadcast packets from one network interface to another
You would be suprised, but these devices are called routers and this is their job to lob the packets from one interface to another. Being able to process DNS in any way is not a requirement for them.
Which begs the question, because you purposely omitted (or don't even know, because the person who wrote the article probably as far from the engineers as a pupmkin latte from a coffee) the specifics - what exactly did you found? What type of packets, what type of broadcast? What device was configured in a production industrial network what was configured as a bridge? Did the network had a configured helper address on production VLANs? Why the hell there is a security and sensor net and yada-yada yet there is a 'forgotten' domain controller?
I'd say return channel might work and it depends on the device used to exfiltrate out. In case of proper DNS server like Active Directory mentioned in the article it's likely that it could work. But we have not yet done testing.
We have also seen devices that are not DNS servers and still just forward broadcast packets from one network interface to another. In such case the return channel might not be possible.
There could be packets directed to the network broadcast address (for IPv4 networks), there could be packets with a broadcast MAC address (all FFs), nothing from that requires packet to be of DNS protocol.
> devices that are not DNS servers and still just forward broadcast packets from one network interface to another
You would be suprised, but these devices are called routers and this is their job to lob the packets from one interface to another. Being able to process DNS in any way is not a requirement for them.
Which begs the question, because you purposely omitted (or don't even know, because the person who wrote the article probably as far from the engineers as a pupmkin latte from a coffee) the specifics - what exactly did you found? What type of packets, what type of broadcast? What device was configured in a production industrial network what was configured as a bridge? Did the network had a configured helper address on production VLANs? Why the hell there is a security and sensor net and yada-yada yet there is a 'forgotten' domain controller?