编辑“︁DNS”︁（章节）

== 例题 ==

<blockquote>题目：<code>BSides San Francisco CTF 2017</code> ： <code>dnscap.pcap</code>
</blockquote>
我们通过 <code>wireshark</code> 打开发现全部为 <code>DNS</code> 协议,查询名为大量字符串<code>([\w\.]+)\.skullseclabs\.org</code>

我们通过 <code>tshark -r dnscap.pcap -T fields -e dns.qry.name &gt; hex</code>提取后，利用 <code>python</code> 转码：

<syntaxhighlight lang="python">import re


find = ""

with open('hex','rb') as f:
    for i in f:
        text = re.findall(r'([\w\.]+)\.skull',i)
        if text:
            find += text[0].replace('.','')
print find</syntaxhighlight>
我们发现了几条关键信息：

<pre>Welcome to dnscap! The flag is below, have fun!!
Welcome to dnscap! The flag is below, have fun!!
!command (sirvimes)
...
IHDR
gAMA
bKGD
        pHYs
IHDR
gAMA
bKGD
        pHYs
tIME
IDATx
...
2017-02-01T21:04:00-08:00
IEND
console (sirvimes)
console (sirvimes)
Good luck! That was dnscat2 traffic on a flaky connection with lots of re-transmits. Seriously,
Good luck! That was dnscat2 traffic on a flaky connection with lots of re-transmits. Seriously, d[
good luck. :)+</pre>
<code>flag</code> 确实包含在其中,但是有大量重复信息,一是应为<code>question</code> 。在 <code>dns</code> 协议中查询和反馈时都会用到，<code> -Y &quot;ip.src == 192.168.43.91&quot;</code>进行过滤后发现还是有不少重复部分。

<pre>%2A}
%2A}
%2A}q
%2A}x
%2A}
IHDR
gAMA
bKGD
        pHYs
tIME
IDATx
HBBH
CxRH!
C1%t
ceyF
i4ZI32
rP@1
ceyF
i4ZI32
rP@1
ceyF
i4ZI32
rP@1
ceyF
i4ZI32
rP@1</pre>
根据发现的 <code>dnscat</code> 找到 https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md 这里介绍了 <code>dnscat</code> 协议的相关信息,这是一种通过 <code>DNS</code> 传递数据的变种协议,题目文件中应该未使用加密,所以直接看这里的数据块信息

<pre>MESSAGE_TYPE_MSG: [0x01]
(uint16_t) packet_id
(uint8_t) message_type [0x01]
(uint16_t) session_id
(uint16_t) seq
(uint16_t) ack
(byte[]) data</pre>
在<code>qry.name</code>中去除其余字段,只留下 <code>data</code> 快,从而合并数据,再从 <code>16</code> 进制中检索<code>89504e.....6082</code>提取<code>png</code>,得到 <code>flag</code> 。

<syntaxhighlight lang="python">import re


find = []

with open('hex','rb') as f:
    for i in f:
        text = re.findall(r'([\w\.]+)\.skull',i)
        if text:
            tmp =  text[0].replace('.','')
            find.append(tmp[18:])
last = []

for i in find:
    if i not in last:
        last.append(i)


print  ''.join(last)</syntaxhighlight>
''flag''

[[File:./figure/dnscat_flag.png|dnscat_flag]]