Overview#
Our implant, deep in the target network, will be calling back to our C2 server (independently of the hops in the middle). This is not done, of course, with a direct IP address or whatsoever. That will alert the defenses, fail miserably, and can’t even integrate any layers in the middle, thus this infrastructure shouldn’t exist at all.
That’s why we use domain names. The implant calls back a domain name, the DNS resolves progressively to the next hop, the next hop filters and forwards the incoming flow to the right place. So this part discusses how is this done, what are the best practices and how to effectly choose relevent and convincing domain names.
Categorization and Reputation#
Reputation#
Like everyone of us, domain names have reputation. This is a trusted score given to domain names to help scanners block and prevent users from accessing potentially malicious services/websites…etc
That being said, we can’t just buy fresh new domain names few weeks before the engagement starts and expect the blue team to not laugh at us. We must have aged and definetly-not-recently-acquired domain names.
The engagement will end before it starts.
Categories#
Each domain out there falls into a category. This is a trusted and very important piece of information that static analyzers use to easily detect potentially malicious websites once they’re queried.
How are domains categorized? The security scanners analyze their live content. And based on rules, texts, metadata, machine learning, they can extract the useful information to categorize a domain as “news”, “shopping”, “adult content” …etc
That being said, if we buy a fresh new domain name (A LONG TIME BEFORE THE ENGAGEMENT STARTS), we should host something legit in there, like a blog site or a fake web service (saas or whatever it seems like anyone has a saas solution now). If we’re buying a previously-used domain name, we will look into that later.
You can check some famous websites categories to see how each content is being treated. For example, this website is categorized as shown:
Tip from Google’s Creative Red Teaming Course#
Disclaimer
Note that this method might not work anymore, but you should always consider it.
To get the exact same category of a very trusted website like anything Microsoft-related, we can setup our server as a web proxy, so when the scanners query our instance, they’ll get silently redirected to the trusted website and come back with high-fidelity data.
This is a very smart workaround to let a low-resources redirector online for few weeks and check its categorization against the target’s defenses.
Expired Domains: Thrifting domain names#
This method is the equivalent of thrifting domain names. Instead of buying a new one, running it for some time to gain some trust and background, why not buy already used ones? Those contain more background, more reputation and why not fan base? Cool right?
But, thrifting is always thrifting. You might run into extremely convincing, well-trusted domains and you might run into malicious and flagged domains.
Before you buy
- Check the domain’s category against multiple providers.
- Make sure the domain names matches the engagement
You can buy some from expireddomains.net
Choosing Relevent Domain Names#
Imagine you’re a blue teamer. A recently downloaded executable that was trusted, seems like a microsoft-related update software, querying a domain name called: myamazingdomain.com. I mean what the fuck is even that?
Or we get to infiltrate a perfectly written and fully-evasive implant that evades every EDR known to man, only to get caught querying a c2.implant-callback.xyz. That is embarassing. Like really embarassing.
So, setup a full attack path, a very comprehensive, complete and convincing scenario, like a Windows Update, some CDN asset delivery, normal web traffic, CI/CD type shii. You do you, just don’t create some http/1-legacy-SCADA-system -very-cool-traffic that will get caught few packets in.