In the process of identifying and exploiting vulnerabilities, it is sometimes necessary to resort to Out of Band (OOB) techniques in order to exfiltrate information through DNS resolutions or HTTP requests.
To address this kind of situation the faster and simpler solution can be the use of a Burp Collaborator instance or a online service like requestbin.net, but this has a big disadvantage: both are services hosted by a third party. Local instances of Burp Collaborator or requestbin can be deployed but they are heavy and poorly customizable or adaptable. To suply this need during a RedTeam operation a tool (Arecibo) with an easy API was developed.
Arecibo is a small tool written in python with following capabilities:
- Detection of incoming HTTP requests (à la Requestbin)
- Configuration of HTML, server headers and status code from the server
- Upload & Download files
- Detection of subdomains resolutions (DNS exfiltration)
- Dynamic resolution (127.0.0.1.ip.XXXX resolves to 127.0.0.1, 10.1.1.10.ip.XXXX resolves to 10.1.1.10, etc.)
Internally it is composed of two parts, on one hand a python script that interacts with PowerDNS through a “backend pipe” and on the other hand the scripts that act as API (Flask + SQLite3) that allows to add new functionalities easily.
Arecibo is a lightweight tool that brings together the features of requestbin, file.io, xip.io, etc. in a single tool, allowing its easy deployment. It has the advantages of being able to operate easily through its API, so it is a very good alternative to use in penetration tests.
Installing and configuring Arecibo for exfiltration
It is necessary to have installed pdns (packages pdns and pdns-backend-pipe) and the modules flask and flask_restful for python. The ideal situation is to deploy the API in the local interface and use an NGINX as a reverse proxy to handle authentication and security. Once these requirements are met, the process would be:
1. Modify the configuration of arecibo-dns-backend.py
2. Assign execution permissions to arecibo-dns-backend.py (chmod + x)
3. Edit the pdns.conf file (its location can vary between distributions):
- setuid=1001
- setgid=1001
- launch=pipe
- pipe-command=/your/path/arecibo-dns-backend.py
(changing the setuid / setgid by the user that will be used to run the service, which will be the same used for the API)
4. Execute arecibo-api.py and pdns_server (the location can change according to distribution)
