Data Exfiltration

Data exfiltration (which can also be referred to as data extrusion or data theft) is an unauthorized data transfer from a computer. This can either be done by having physical access to the devices in the network or by remotely using automated scripts.

Advanced Persistent Threats (APTs) usually have data exfiltration as the main goal. The goal of an APT is to gain access to a network but remain undetected as it stealthily seeks out the most valuable data.

There may be cases in which the client wants to check both exploitation as well as data exfiltration. This makes the activity even more interesting as exfiltration of data without detection can sometimes be tricky.

In this chapter, we will cover the following topics:

• Exfiltration basics
• CloakifyFactory
• Data exfiltration via DNS
• Data exfiltration via Empire

Technical requirements

• Metasploit Framework (MSF)
• PGSQL (Postgres)
• Oracle Java 1.7 or latest
• Cobalt Strike
• Empire
• Armitage

Exfiltration basics

We have already covered some basic techniques in the reverse shell chapter. Let's do a quick revision of how these techniques can be used to transfer data from a victim machine to us.

Exfiltration via Netcat

As previously discussed, this is not the best way to transmit data as the data is transmitted in plaintext, which makes it easily detectable.

Exfiltration via OpenSSL

We also saw another way to transfer data via OpenSSL using commands, as shown by the following, to first generate the certificate and then use that certificate to transfer data...

CloakifyFactory

CloakifyFactory is developed by Joe Gervais (TryCatchHCF). This was presented at DEF CON24. This tool hides the data in plain sight—it bypassed data loss prevention (DLP), whitelisting controls, and antivirus (AV) detection. Blue team members already know what to look for when hunting for traces of attack in the memory or in the network traffic. Cloakify defeats them all by transforming any file type into simple strings using text-based steganography.

As mentioned by Souvik Roya and P.Venkateswaran in their white paper:

"Steganography is the art of hiding of a message within another so that the presence of a hidden message is indistinguishable. The key concept behind steganography is that a message to be transmitted is not detectable to the casual eye. This is also the advantage of steganography over cryptography. An unhidden encrypted message, no matter...

Data exfiltration via DNS

Data exfiltration can also be done over DNS to avoid detection. DNSteal is a great tool for this as it creates a fake DNS server, which listens for DNS requests while on the client; we can transfer the file data using simple for loops. This supports single as well as multiple file transfers.

The tool can be downloaded at the following link:

https://github.com/m57/dnsteal

Once downloaded, the tool can be run using the command shown as follows:

python dnsteal.py

This will start the server which will listen on port 53 for incoming connections.

The tool also gives us a command to be run on *nix-based systems. To exfiltrate data, we use that command and paste it in the client's shell as shown as follows:

This will send password.txt to our server and we will receive the file on our server as shown as follows.

Once the file transfer has completed, we...

Data exfiltration via Empire

We have already learned about getting reverse shells on Empire and using Empire to achieve persistence on the system. The next step is data exfiltration.

Empire has a built-in module which allows us to upload the data directly on to Dropbox. This is very useful in situations in which IP whitelisting is done, as Dropbox is one of the domains that generally allows employee access.

Let's take a look at an example of how this module is used. We interact with our agent and run the command as shown as follows:

usemodule exfiltration/exfil_dropbox

To view the details of the module, we type the info command:

This requires the path of the file we wish to transfer and the Dropbox API key, along with the target filename.

Once everything is set we execute the module as shown following, and the agent will then transfer the file to Dropbox using the...

Summary

In this chapter, we learned about data exfiltration and why it is needed. Then, we learned some basic ways of transferring data using simple tools like Netcat, OpenSSL, and PowerShell. Next, we jumped into transforming the data using text-based steganography to avoid detection, as well as looking at the usage of the CloakifyFactory tool. We also learned about extracting data via DNS from a victim machine to our server. Lastly, we explored how to exfiltrate data using Dropbox API to avoid detection, suspicion, and for bypassing firewalls.

Our journey with you ends here. We hope that you have enjoyed reading these chapters and that you have learned from them as well.

We would love to hear your feedback on this book. You can reach us on LinkedIn at the following links:

• https://linkedin.com/in/0xhimanshu
• https://www.linkedin.com/in/hs-ninja
• Email: [e-mail]
...

Questions

1. Are there other ways to exfiltrate data? Are these techniques totally undetectable?
2. What is a frequency analysis attack?
3. What other tools can be used for Data exfiltration?

Further reading

For more information on the topics discussed in this chapter, please visit the following links:

• https://7io.net/2015/09/30/data-exfiltration-dnsteal/
  
• https://n0where.net/data-exfiltration-over-dns-request-covert-channel-dnsexfiltrator
  
• https://github.com/m57/dnsteal
• https://blog.trendmicro.com/trendlabs-security-intelligence/data-exfiltration-in-targeted-attacks/
  
• https://www.techopedia.com/definition/14682/data-exfiltration
  
• https://www.sciencedirect.com/science/article/pii/S2212017313005033