scusi/dns_xor.go

dns_xor.go · 1.6 KiB · Go Raw

// domain data encoding/decoding algo for FrameworkPOS Malware DNS-Tunneling Variant, 
// as described on: 
// https://blog.gdata.de/artikel/neue-variante-von-frameworkpos-schoepft-daten-ueber-dns-anfragen-ab/
//
package main

import(
	"fmt"
	"os"
	"encoding/hex"
	"flag"
)

// test vectors:
// data := []byte{0xc3, 0xcb, 0xc0, 0xdc, 0xc3, 0xc4, 0xca, 0xdc, 0xc4, 0xcb, 0xdc, 0xc4, 0xcb}
// string := "192.168.69.69"
//
// data := []byte{0xa2, 0xb3, 0xa7, 0xbe, 0xdf, 0xb3, 0xb0, 0xb1, 0xc3, 0xc0, 0xc1, 0xc6}
// string := "PAUL-ABC1234"
const A = 0xAA
const B = 0x9B
const C = 0xC3

var op string
var in string

func init(){
	flag.StringVar(&op, "op", "decode", "operation to perform: 'encode' or 'decode', default is 'decode'")
	flag.StringVar(&in, "in", "", "Inputstring to perform choosen operation on")
}

// decode - decodes single values from dns queries into cleartext
func decode(data []byte)(result []byte){
	for _, v := range data {
		a := v ^ A
		b := a ^ B
		result = append(result, b ^ C)
	}
	return result
}

// encode - encodes cleartext values to be used in dns queries
func encode(data []byte)(result []byte) {
	for _, v := range data {
		b := v ^ C
		a := b ^ B
		result = append(result, a ^ A)
	}
	return result
}

func main(){
	flag.Parse()
	input := []byte(in)

switch {
	case op == "encode":
		encoded := encode(input)
		fmt.Printf("%s %x\n", input, string(encoded))
	case op == "decode":
		data, err := hex.DecodeString(string(input))
		if err != nil {
			panic(err)
		}
		decoded := decode(data)
		fmt.Printf("%x %s\n", data, string(decoded))
	default:
		prog := os.Args[0]
		fmt.Printf("For USAGE INFO call: '%s -h'\n", prog)
	}
}

1	// domain data encoding/decoding algo for FrameworkPOS Malware DNS-Tunneling Variant,
2	// as described on:
3	// https://blog.gdata.de/artikel/neue-variante-von-frameworkpos-schoepft-daten-ueber-dns-anfragen-ab/
4	//
5	package main
6
7	import(
8	"fmt"
9	"os"
10	"encoding/hex"
11	"flag"
12	)
13
14	// test vectors:
15	// data := []byte{0xc3, 0xcb, 0xc0, 0xdc, 0xc3, 0xc4, 0xca, 0xdc, 0xc4, 0xcb, 0xdc, 0xc4, 0xcb}
16	// string := "192.168.69.69"
17	//
18	// data := []byte{0xa2, 0xb3, 0xa7, 0xbe, 0xdf, 0xb3, 0xb0, 0xb1, 0xc3, 0xc0, 0xc1, 0xc6}
19	// string := "PAUL-ABC1234"
20	const A = 0xAA
21	const B = 0x9B
22	const C = 0xC3
23
24	var op string
25	var in string
26
27	func init(){
28	flag.StringVar(&op, "op", "decode", "operation to perform: 'encode' or 'decode', default is 'decode'")
29	flag.StringVar(&in, "in", "", "Inputstring to perform choosen operation on")
30	}
31
32	// decode - decodes single values from dns queries into cleartext
33	func decode(data []byte)(result []byte){
34	for _, v := range data {
35	a := v ^ A
36	b := a ^ B
37	result = append(result, b ^ C)
38	}
39	return result
40	}
41
42	// encode - encodes cleartext values to be used in dns queries
43	func encode(data []byte)(result []byte) {
44	for _, v := range data {
45	b := v ^ C
46	a := b ^ B
47	result = append(result, a ^ A)
48	}
49	return result
50	}
51
52	func main(){
53	flag.Parse()
54	input := []byte(in)
55
56	switch {
57	case op == "encode":
58	encoded := encode(input)
59	fmt.Printf("%s %x\n", input, string(encoded))
60	case op == "decode":
61	data, err := hex.DecodeString(string(input))
62	if err != nil {
63	panic(err)
64	}
65	decoded := decode(data)
66	fmt.Printf("%x %s\n", data, string(decoded))
67	default:
68	prog := os.Args[0]
69	fmt.Printf("For USAGE INFO call: '%s -h'\n", prog)
70	}
71	}