Post‐Exploitation and Local Privilege Escalation Operations (Phase 3) - sophialevasseur/SEC-335 GitHub Wiki

😱Main Doc😱

⭐Objective⭐

• Exfil the consolidated log file using a protocol other than HTTP/HTTPS to evade standard network monitoring. Note, other than HTTPS doesn’t mean you can’t use OpenSSL/TLS.

1. Exfiltration: Transfer the archive to the C2 server using a non-standard exfiltration method. Acceptable methods include DNS tunneling, ICMP encapsulation, SMB file sharing, raw sockets with netcat/ncat, etc. Standard web protocols are not allowed for this specific step.
2. Verification on c2: On the C2 server, decompress the archive and verify the integrity and readability of at least one file.

📜Documentation for Phase 3📜

• Report Section:
  1. Identify the exfiltration method used.
  2. Provide a technical justification for this choice, specifically addressing how it evades standard network monitoring compared to HTTP/HTTPS.
  3. Detail how an organization could detect this specific exfiltration method (e.g., beaconing patterns, unusual port usage).
  4. Include the commands used to decompress the archive on the C2 server and verify file integrity (e.g., ls, cat of a sample file).
     • Screenshot the files listed after extraction and show the output of one file.

---

1. Report section 1:

   • The Exfiltration Method used is _________.

2. Report section 2:

   • I chose this exfiltration method because ______.

3. Report section 3:

   • An organization could detect this exfiltration method by ________.

4. Report section 4:

   • Commands used to decompress the archive on the C2 server and verify file integrity: