Module 4

📜Learning Objectives📜

• After completing this assignment, you will be able to:

  1. Use Living Off the Land Binaries (LOLBins) to enumerate host information and collect data
  2. Compress collected data using multiple Windows-native and third-party tools
  3. Establish a reverse shell and exfiltrate compressed archives via Meterpreter
  4. Decompress archives on the c2 server and verify data integrity
  5. Exfiltrate data using non-standard protocols (ICMP, DNS, SMTP) to evade detection
  6. Document each technique with screenshots and explain its value to an attacker

🌹Background🌹

🌞Enumeration🌞

Enumeration is the phase where an attacker maps out a compromised host. Before exfiltrating data, you need to know what is on the target: running processes, network connections, user accounts, group memberships, firewall rules, and system configuration. This information tells you what data is worth stealing and how to move laterally or how to enumerate privileges - if that is their goal.

Attackers use LOLBins for enumeration because these binaries are already on the system and signed by Microsoft. Running net user or tasklist does not trigger antivirus the way uploading nmap.exe would. The goal is to look like normal system activity while gathering intelligence.

🌞Exfiltration🌞

Exfiltration is the unauthorized transfer of data from a target network to an attacker-controlled system. Once you have collected and staged data, you need to move it off the target without triggering alerts.

• Common exfiltration methods include:
  • File transfer over C2 channels: Using Meterpreter's download command or similar tools to pull files through an established command-and-control connection
  • Standard protocols: Transferring data over HTTP, HTTPS, FTP, or SMB, which may blend with legitimate traffic
  • Non-standard protocols: Hiding data in protocols not typically used for file transfer, such as ICMP (ping), DNS queries, or SMTP (email)

Non-standard protocol exfiltration is harder to detect because network monitoring tools often allow these protocols through firewalls. A ping packet can carry a few bytes of data. A DNS query can encode data in subdomain labels. An email can attach a file. Defenders must inspect payload content, not just protocol headers, to catch these techniques.

🌞Compression🌞

Before exfiltration, attackers compress collected files to reduce transfer size and bundle multiple files into a single archive. Password-protected archives add a layer of protection: even if intercepted, the archive contents remain encrypted.

• Windows provides several native compression tools:

  • makecab: Creates .cab files, used by Windows Update and installer packages
  • PowerShell Compress-Archive: Creates .zip files using .NET compression

• Third-party tools like 7-Zip and tar offer additional format support and password protection.

💻Lab Environment Setup💻

Use your Windows 10 VM on Proxmox. You need standard user access as champuser and access to your Kali/C2 server. Prerequisites

• Complete these steps before starting Task 1:
  1. Download the command-line version of 7-Zip to your Windows VM
  2. Use the native Windows version of the tar command
  3. Read the documentation for PowerShell's Compress-Archive cmdlet
  4. Read how to use makecab to create compressed files
  5. Read how to decompress each of the compressed file types you create

🌲Task 1: Enumeration🌲

⭐Objective⭐

Use LOLBins to enumerate host information. Save the output of each command to a separate file.

Task 1

🌲Task 2: Exfiltration via C2 Channel🌲

⭐Objective⭐

Establish a reverse shell and exfiltrate the compressed archives to your C2 server.

Task 2

🌲Task 3: Archive Decompression and Verification🌲

⭐Objective⭐

Decompress each archive on Linux and verify data integrity.

Task 3

🌲Task 4: Non-Standard Protocol Exfiltration🌲

⭐Objective⭐

Exfiltrate data using protocols not typically used for file transfer.

Task 4