最初官方的代码没有找到,但是发现github里貌似有:

git clone https://github.com/splitbrain/dnstunnel.git

源码是perl写的,需要安装一些perl依赖包。

安装perl模块方法说明:

(sudo) perl -MCPAN -e shell
install Log::Log4perl
install HTML::TokeParser::Simple
h
q
   
The above will install Log4perl in /usr/lib/perl5/site_perl/5.6.1/Log/Log4perl.
需要注意的是必须使用root权限才能安装成功。

看源码dnstunneld

use Fcntl;
use Net::DNS;
use Net::DNS::Nameserver;
use LWP::UserAgent;
use Time::HiRes qw ( usleep gettimeofday );
use MIME::Base64;
use MIME::Base32 qw ( RFC );
use IO::Socket;
use Class::Struct;
use threads;
use threads::shared;
use Thread::Queue;
use Getopt::Long;

需要安装Net::DNS, LWP::UserAgent,Time::HiRes ,MIME::Base64,IO::Socket,Class::Struct,Getopt::Long。 MIME::Base32不需要,直接注释掉源码!如果不注释掉,发现有导入包的错误。

dnstunnelc,客户端安装包类似:

use Fcntl;
use Net::DNS;
use MIME::Base64;
use MIME::Base32 qw ( RFC );
use Time::HiRes qw (usleep gettimeofday );
use Getopt::Long;
use threads;
use Thread::Queue;

需要安装Net::DNS,MIME::Base64,Time::HiRes,Getopt::Long;同样注释掉use MIME::Base32 qw ( RFC ); 这行代码!

server端:

sudo perl dnstunneld -i 0.0.0.0 a.friendsxxx.com 

client端:

ssh -o ProxyCommand="perl dnstunnelc  a.friendsxxx.com" root@xxx.com

没有成功!可能是被dns服务器给切断了。

The Fake Server

The fake server you can set up at your server to tunnel all the traffic through is a little program called OzymanDNS, written in Perl (Client and Server together 642 SLOC) by DNS guru Dan Kaminsky. The tool is split in four files, two of them being a file upload/download tool using DNS. Nice examples, but rather uninteresting for our approach.

The script nomde.pl is the server. Since the server binds to port 53 UDP on your server (which is a privileged port) you must be root to start the server. Also, make sure port 53 UDP is reachable from the outside (consider running nmap -v -sU host from a remote machine). You will usually want to start it as follows:

sudo ./nomde.pl -i 0.0.0.0 server.example.com

Here, the server will only listen to DNS requests for all subdomains of server.example.com. That way, people who don't know that exact address cannot use the service on your server.

The Client

The OzymanDNS client is just a perl script which encodes and transfers everything it receives on STDIN to it's destination, via DNS requests. Replys are written to STDOUT.

So this isn't particularly useful as a standalone program. But it was designed to be used together with SSH. And with SSH this works great. SSH has a config option, ProxyCommand, which lets you use OzymanDNS's droute.pl client to tunnel the SSH traffic. The command to connect to your server would look like this:

ssh -o ProxyCommand="./droute.pl sshdns.server.example.com" user@localhost

Note two things:

  1. Add a sshdns. in front of the hostname you specified the server to listen to and
  2. Since your connection will already have been tunneled through DNS (and thus has come out at your host already) there is no need to login as user@server.example.com (because that already is localhost)

Once the connection is established (you'll probably have to enter your password) you have a shell! The connection is a little bit droppy sometimes and has not got the best latency, but it is still good keeping in mind that connections to the internet are not allowed at this Cafe/Airport/....

Tunneling

Once you verified that the connection is actually working, you can set up a tunnel so that you may not only have shell, but complete web acces, can fetch mails using POP, etc., etc...

For this, I recommend to read my tutorial on How to Tunnel Everything through SSH.

Don't forget: It may provide great performance increases to use SSH's -C ("compress data") switch!

Communication between the Servers

So, now how might the servers communicate with each other, not being directly able to establish a connection?, you might ask now.

Well, since all subdomain resolve requests are delegatet (ie., relayed) to your host, you can include arbitrary data in the hostname which your server then can interpret and execute/relay.

The bytes you want to send to the server (upstream) will be encoded using Base32 (if you know what Base64 is, Base32 is just the same except there is no case sensivitiy, for EXAMPLE.COM ist just the same as example.com). After the data, there is a unique ID (since some DNS requests may take longer than others and the UDP protocol has no methods to check this) and either one of the keywords up or down, indicating whether the traffic's up- or downstream. Here is what an example request could look like (transferring something to the server):

ntez375sy2qk7jsg2og3eswo2jujscb3r43as6m6hl2ws
xobm7h2olu4tmaq.lyazbf2e2rdynrd3fldvdy2w3tifi
gy2csrx3cqczxyhnxygor72a7fx47uo.nwqy4oa3v5rx6
6b4aek5krzkdm5btgz6jbiwd57ubnohnknpcuybg7py.6
3026-0.id-32227.up.sshdns.feh.dnstunnel.de

The server's response comes as a DNS TXT record. A TXT record can hold arbitrary ASCII data and can hold uppercase letters as well as lowercase letters and numbers (some other characters, as well). So the responses come Base64 encoded. Such a response might look like the following one:

695-8859.id-39201.down.sshdns.feh.dnstunnel.de.   0       IN      TXT
"AAAAlAgfAAAAgQDKrd3sFmf8aLX6FdU8ThUy3SRWGhotR6EsAavqHgBzH2khqsQHQjEf355jS7cT
G+4a8kAmFVQ4mpEEJeBE6IyDWbAQ9a0rgOKcsaWwJ7GdngGm9jpvReXX7S/2oqAIUFCn0M8="
"MHw9tR0kkDVZB7RCfCOpjfHrir7yuiCbt7FpyX8AAAABBQAAAAAAAAAA"

That is, in rough outlines, how tunneling via DNS works.

OzymanDNS 使用——perl 5.22没有成功。。。的更多相关文章

  1. perl 5.22手动安装Mysql DBI和DBD

    mysql 手动安装DBI 和DBD: DBI版本: [root@dr-mysql01 DBD-mysql-4.033]# perl -MDBI -le 'print $DBI::VERSION;' ...

  2. centos 6.7 perl 5.22 安装DBD 需要使用老的perl版本

    zjzc01:/usr/bin# mv perl.bak perlold zjzc01:/usr/bin# cd zjzc01:/root# cd DBD-Oracle-1.36 zjzc01:/ro ...

  3. [转]Centos 6.5 安装 Scrapy 0.22.2成功

    0. python -V               (此时显示为2.6.6) 1. yum -y update  2. yum groupinstall -y development  3. yum ...

  4. perl 下使用非root用户安装模块

    perl下安装模块可以使用cpan命令,但是通常我们不具有root用户权限,所以只能以sudo方式安装模块. 例如需要安装Net::SCP::Expect模块, 执行cpan Net::SCP::Ex ...

  5. perl语言书籍教程推荐

    互动出版网计算机频道.为您推荐关于perl语言的书籍教程.包括perl push.perl chomp以及perl python等perl语言内容. perl语言书籍一.<Perl语言编程 第四 ...

  6. Linux环境Perl链接MS Sql Server数据库

    1.下载相关软件 unixODBC.freetds和DBD-ODBC ①.Linux系统的ODBC unixODBC-2.3.4.tar.gz ( http://www.unixodbc.org) ② ...

  7. 一个linux内核编译时遇到的perl语法导致的编译问题解决

    在编译linux内核时,遇到了一个比较诡异的问题.具体log如下: Can't locate strict.pm in @INC (you may need to install the strict ...

  8. springboot学习入门简易版九---springboot2.0整合多数据源mybatis mysql8+(22)

    一个项目中配置多个数据源(链接不同库jdbc),无限大,具体多少根据内存大小 项目中多数据源如何划分:分包名(业务)或注解方式.分包名方式类似多个不同的jar,同业务需求放一个包中. 分包方式配置多数 ...

  9. Windows XP SP3下编译安装openssl-1.1.0b

    软件需要: openssl-1.1.0b visual studio 2010(cn_visual_studio_2010_ultimate_x86_dvd_532347.iso) perl:Acti ...

随机推荐

  1. 根据项目类型导入Excel文件到不同数据库

    前提:如果您要针对不同的业务做数据导入,可以参考下这个项目,这个项目的原理就是根据文件名进行区分,然后导入不同的数据表.下面我就写个Demo演示下: 学生表-- 主键,学生姓名,学生年龄,学校归属 教 ...

  2. JsonResult

    注意:如果有大量的json数据要处理,建议使用ASP .NET Web API框架处理,专门用来处理json数据交换并提供跨平台访问能力的 ConentType设置为application/json ...

  3. Java基础3一基础语句

    1.条件语句:所谓的条件语句就是指有选择的去执行部分代码. 包括:if条件语句和switch条件语句 if条件语句: 语法: (1)if(条件语句){ //条件成立时需要执行的代码   } (2)if ...

  4. 如何修改 WordPress 数据库前缀

    我们知道 WordPress 的数据库表,可以设置前缀,默认是 wp_,很多同学也就默认用了 wp_,如果某种原因(比如提高安全性)要修改的 WordPress 数据的前缀,我们应该怎么做? 开始之前 ...

  5. 关于CommandTimeOut

    指示在终止尝试和产生错误之前执行命令期间需等待的时间. 设置和返回值 设置或返回长整型值,该值指示等待命令执行的时间(单位为秒).默认值为 30. 说明 Connection 对象或Command 上 ...

  6. MIME类型记录

    Content-Disposition: attachment; filename="filename.xls" 提供下载

  7. 搞不懂的算法-排序篇<1>

    最近在学习算法,跟着<Algorithms>这本书,可能是自己水平不够吧,看完排序算法后各种,希尔,归并,快排,堆的实现在脑子里乱成一锅粥,所以就打算大概总结一下,不求精确,全面,只想用平 ...

  8. (转)RabbitMQ学习之Headers交换类型(java)

    http://blog.csdn.net/zhu_tianwei/article/details/40923131 Headers类型的exchange使用的比较少,它也是忽略routingKey的一 ...

  9. SaltStact自动化运维工具03

    存储位置   类型      采集方式                 场景Grains    minion        静态    minion启动时,可以刷新    1.获取信息 2.匹配pil ...

  10. 快速搭建一个本地的FTP服务器 win10及win7

    快速搭建一个本地的FTP服务器   如果需要开发FTP文件上传下载功能,那么需要在本机上搭建一个本地FTP服务器,方便调试. (win10) 第一步:配置IIS Web服务器 1.1 控制面板中找到“ ...