In this demonstration,
we'll be exfiltrating a basic text file
from this Ubuntu server,
this compromised server to our attack box,
our Kali Linux machine using ICMP packets.
So we're going to use a Python script to accomplish this.
Imagine that we've already compromised the server
and we're going to perform post-exploitation activities.
So we're going to exfiltrate data on this compromised server
using a covert channel of ICMP.
So for like things like ping, et cetera.
Okay, so we have our basic import statements here
for our Python script.
Then we have our target_ip,
that's going to be the Kali Linux machine that we want
to exfiltrate our data to.
Then we have these icmp_socket variable here,
and we're going to input the socket object here.
So pretty much all this allows us to do
is to manipulate the ICMP packet at the protocol level.
So raw bits.
Now, we don't need to go through
and understand every single line, method
and function that's going on here.
We just need to be able to read this
to understand in general what it's doing.
So we have some good descriptions here.
Create ICMP packet.
So define create_icmp_packet.
We're modifying portions of a TCP packet here.
And then we're going to go through, create the header,
and then we'll split
the data up into chunks, right?
So we're going to split the data up into 48 bytes a piece,
and then send them separately.
And we're going to use this for loop here.
So every time it's going to run,
we're going to send 48 bits.
It's going to run again, send another 48 bits.
All right, so let's exit out of this.
Now, let's just view the file that we're going
to be exfiltrating.
So very basic text file.
So now I'm about to run this command
and then we're going to exfiltrate the data
and then I'm going to switch to the Kali Linux box
and we're going to review the packets that we captured.
We're going to save the file after we perform a TCP dump
and see that the data was successfully sent over.
All right, now I'm about to switch over
to the Kali Linux machine.
So now I'm on my Kali Linux machine
and we see we ran a TCP dump on the interface eth0.
So that's going to be our Ethernet connection
that we're receiving and sending packets from.
And we're looking only for ICMP packets.
And I'm going to use this -X option, which allows us
to see both the hexadecimal value
and the human-readable value.
And then we're going to write it
to the icmp_capture.pcap file.
So let's open this really quick.
All right, so here's the command for that.
We're going to simply use a tcpdump -r.
So we're going to read the ICMP capture file
and we'll use the -X option
to show us both human-readable and hexadecimal values.
All right, perfect.
So we receive the packets from the Ubuntu server
and we use the ICMP echo request,
identified here, right?
So we have the hexadecimal values here,
and then we have the actual human-readable values here.
So once it's converted, so this is a sensitive document
that needs to be exfiltrated.
All right, so we see we had to send it in two chunks.
We see the first one was 48 bytes,
so that's going to be the payload.
We have more for the header.
So the length is 56, but the 48 bytes was here.
And then we have a smaller one finishing the rest
of the actual document.
So the small portion here,
and that was only 19 bytes.
So to sum things up, we simply went over
how to exfiltrate data on a compromised server
using a Python script,
and then capturing the packets on our Kali Linux machine
and going over and reconstructing the data
that we exfiltrated.
I hope you enjoyed this lesson
and I'll see you in the next one.