search

iagox86 / dnscat2

BSD 3-Clause "New" or "Revised" License
3.43k stars 601 forks source link

Packet sequence number errors #68

Open dleecefft opened 9 years ago

dleecefft commented 9 years ago

I can connect to the DNS cat server from a client by specifying the server but get a steady stream of sequence errors the minute I try to interact with a session created using the authoritative DNS setup.

./dnscat somedom.org

Puting any amount of data through the session will crash the client but able to interact with the client as long as the load is very light.

Bad sequence number on incoming packet: expected 0x2b53, received 0x60f3 Bad sequence number on incoming packet: expected 0x2b53, received 0x60f3 Bad sequence number on incoming packet: expected 0x2b53, received 0x60f3 Bad sequence number on incoming packet: expected 0x2b53, received 0x60f3

command window <-- You are here! session 34910 [*] :: command (default) dnscat2> dnscat2>

iagox86 commented 9 years ago

Thanks for filing a bug!

There are two things...

One is, the sequence numbers are horribly wrong. Unless I had an endianness fail, I suspect something might be re-writing the request and breaking it. Can you provide a pcap?

Second is, even if that's the case, the client shouldn't crash, but it might exit cleanly. Does it actually segfault? If so, if it's reliable enough, can you make it crash in gdb and get me the backtrace?

gdb --args ./dnscat2 --options=whatever
(gdb) run
...
(gdb) backtrace

Hopefully that'll help make it so the client doesn't crash at all. :)

iagox86 commented 9 years ago

Hey, any updates? Does this still happen?

dleecefft commented 9 years ago

Hi Ron,

Great to run into you at Derbycon, lots of Canadians there this year :).

I will run some tests in the next couple days and see if I can pin point it, my domain is fully propagated now so it should avoid trips to the root name servers which may have been messing things up.

I will update the bug ticket with whatever I find.

Thanks,

Doug Leece

From: Ron [mailto:notifications@github.com] Sent: October 13, 2015 2:42 PM To: iagox86/dnscat2 dnscat2@noreply.github.com Cc: dleecefft dleece@firstfiretech.ca Subject: Re: [dnscat2] Packet sequence number errors (#68)

Hey, any updates? Does this still happen?

— Reply to this email directly or view it on GitHub https://github.com/iagox86/dnscat2/issues/68#issuecomment-147846438 . https://github.com/notifications/beacon/ABoDgsit8g2ePP2T9QqIDsJcuW4uJBbOks5o7WQWgaJpZM4GB-FV.gif