Exfiltration
Exfiltration
Groupe de sécurité Try Hard
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F2088318145-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Frq9WIQinJaxpWMvakjIQ%252Fuploads%252Fgit-blob-dae1ef8c660e0243188462f22f417bbb1a2719d3%252Ftelegram-cloud-document-1-5159108904864449420.jpg%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=5a1540d4&sv=1)
Domaines couramment autorisés pour exfiltrer des informations
Consultez https://lots-project.com/ pour trouver des domaines couramment autorisés qui peuvent être abusés
Copier&Coller Base64
Linux
Windows
HTTP
Linux
Windows
Téléverser des fichiers
Module Python uploadserver:
Serveur HTTPS
FTP
Serveur FTP (python)
Serveur FTP (NodeJS)
Serveur FTP (pure-ftp)
Client Windows
SMB
Kali en tant que serveur
Ou créez un partage smb en utilisant samba:
Exfiltration
Techniques
Exfiltration Over Command and Control Channel
Description: Data exfiltration can be achieved by sending commands to the compromised system to exfiltrate data over the command and control channel.
Detection: Monitor network traffic for suspicious commands or data transfers over the command and control channel.
Exfiltration Over Alternative Protocol
Description: Data exfiltration can be achieved by using alternative protocols such as DNS, ICMP, or HTTPS to bypass network security controls.
Detection: Monitor network traffic for unusual patterns or data transfers over non-standard protocols.
Tools
[Tool Name]: Description of the tool and how it can be used for data exfiltration.
[Tool Name]: Description of the tool and how it can be used for data exfiltration.
Countermeasures
Implement network segmentation to restrict communication between different parts of the network.
Use encryption to protect data in transit and prevent unauthorized access to exfiltrated data.
Exfiltration
Techniques
Exfiltration Over Command and Control Channel
Description: Data exfiltration can be achieved by sending commands to the compromised system to exfiltrate data over the command and control channel.
Detection: Monitor network traffic for suspicious commands or data transfers over the command and control channel.
Exfiltration Over Alternative Protocol
Description: Data exfiltration can be achieved by using alternative protocols such as DNS, ICMP, or HTTPS to bypass network security controls.
Detection: Monitor network traffic for unusual patterns or data transfers over non-standard protocols.
Tools
[Tool Name]: Description of the tool and how it can be used for data exfiltration.
[Tool Name]: Description of the tool and how it can be used for data exfiltration.
Countermeasures
Implement network segmentation to restrict communication between different parts of the network.
Use encryption to protect data in transit and prevent unauthorized access to exfiltrated data.
SCP
L'attaquant doit avoir SSHd en cours d'exécution.
SSHFS
Si la victime a SSH, l'attaquant peut monter un répertoire de la victime vers l'attaquant.
NC
Description
Netcat (nc) is a versatile networking tool that can be used for various purposes, including exfiltration of data. It allows for creating connections to remote hosts, listening on ports, and transferring data between systems. Netcat can be used to exfiltrate data over the network in a stealthy manner.
Methodology
Basic Usage: Netcat can be used to transfer files between systems by setting up a listener on the receiving end and connecting to it from the sending end.
Reverse Shells: Netcat can be used to create reverse shells, allowing an attacker to gain remote access to a system and exfiltrate data.
Port Scanning: Netcat can also be used for port scanning to identify open ports on a target system, which can then be used for exfiltration.
Encryption: To secure data during exfiltration, Netcat can be used in combination with encryption tools like OpenSSL to encrypt the data before transmission.
Prevention
Firewall Rules: Implement strict firewall rules to restrict the usage of Netcat on systems to prevent unauthorized data exfiltration.
Network Monitoring: Monitor network traffic for any suspicious activities or the use of Netcat to exfiltrate data.
File Integrity Monitoring: Implement file integrity monitoring to detect any unauthorized file transfers using Netcat.
User Training: Provide security awareness training to users to educate them about the risks associated with tools like Netcat and how to prevent data exfiltration.
/dev/tcp
Télécharger un fichier depuis la victime
Téléverser un fichier à la victime
Merci à @BinaryShadow_
ICMP
SMTP
Si vous pouvez envoyer des données à un serveur SMTP, vous pouvez créer un SMTP pour recevoir les données avec python:
TFTP
Par défaut dans XP et 2003 (dans d'autres, il doit être ajouté explicitement lors de l'installation)
Dans Kali, démarrer le serveur TFTP:
Serveur TFTP en python :
Dans victime, connectez-vous au serveur Kali :
PHP
Téléchargez un fichier avec un oneliner PHP :
VBScript
Introduction
VBScript (Visual Basic Scripting Edition) is a scripting language developed by Microsoft. It is commonly used for writing scripts to automate tasks on Windows operating systems.
Exfiltration Techniques
VBScript can be used for exfiltrating data from a compromised system. Below are some techniques that can be used:
Writing to Files: VBScript can be used to write data to files on the system, which can then be exfiltrated by the attacker.
Sending Emails: VBScript can also be used to send emails with the exfiltrated data as attachments or within the email body.
HTTP Requests: VBScript can make HTTP requests to a remote server controlled by the attacker, sending the exfiltrated data in the request body.
Example
Below is an example of VBScript code that exfiltrates data by sending an HTTP request:
In this example, the VBScript code creates an HTTP POST request to "http://attacker-server.com/exfiltrate" with the exfiltrated data in the request body.
Mitigation
To mitigate the risk of exfiltration using VBScript, organizations should restrict the use of VBScript on their systems and monitor for any suspicious VBScript activities. Regular security training for employees can also help in preventing attackers from using VBScript for exfiltration.
Victime
Debug.exe
Le programme debug.exe
permet non seulement l'inspection des binaires, mais a également la capacité de les reconstruire à partir de l'hexadécimal. Cela signifie qu'en fournissant un hexadécimal d'un binaire, debug.exe
peut générer le fichier binaire. Cependant, il est important de noter que debug.exe a une limite d'assemblage de fichiers jusqu'à 64 ko en taille.
Ensuite, copiez-collez le texte dans le shell Windows et un fichier appelé nc.exe sera créé.
DNS
Try Hard Security Group
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F2088318145-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Frq9WIQinJaxpWMvakjIQ%252Fuploads%252Fgit-blob-dae1ef8c660e0243188462f22f417bbb1a2719d3%252Ftelegram-cloud-document-1-5159108904864449420.jpg%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=5a1540d4&sv=1)
Last updated