What #dns#exfiltration tool sends requests made of 3 levels of subdomains in hex strings with a 1-byte command prefix (00 start file, 01 file data, 02 file end) followed by a two-byte packet number, with packets sent in semi-random order? We solved it, but I wonder it exist or was it made for the purpose of the exercise? #infosec#ctf
@f4grx doesn't sound like dnssteal. I wrote one that sounds almost exactly like that, many years back, but I don't recall publishing it. given how simple it is, I'd guess they self-wrote it.
@gsuberland
Yep of course we had a look at dnssteal. Whatever, in the end it was completed with a few lines of shell script +it taught me the paste command). And a look at @Ange 's JFIF cheat sheet to reconstruct a half-missing jpeg header. That was fun.
Add comment