In this demonstration,
we're going to exfiltrate data using
a Python-based HTTPS client server setup.
The Kali Linux machine will host a flask-based HTTPS server
to receive the exfiltrated data,
while the Ubuntu server
that I'll show you in a little bit,
will act as the client sending
the sensitive information over HTTPS.
We'll go over the two scripts.
So first, we're going to go over the Kali Linux script here
for the HTTPS server,
and then we're going to switch over to Ubuntu
and go over that script that's going to be sending
or exfiltrating the sensitive data over HTTPS.
All right, so let's get things started.
Here, we have the basic import statements.
So we're importing the flask tools and libraries
and all things required for this HTTP server.
They also have the request function,
so that gives us other things and methods
that we're going to need for the server.
Then we have this app.route function right here.
So pretty much, it creates a route,
meaning it tells flask, the web server,
that any request to the /exfiltrate URL
should trigger the function immediately following it.
So here, right, the exfiltrate method
that we're defining is going to be the one triggered.
Once anyone sends a HTTP post request
to our IP address here with this route exfiltrate.
Next we're going to receive the data, right?
And then we're going to decode the data.
So we have our request object
and we're going to parse through the response
that we get over the Internet
and then we're going to break it down
and save the information into this exfiltrate data variable.
So then we're going to move along and we're going to print
out the information on the screen displayed for us.
So once we turn on this HTTPS server,
once we receive something,
it's going to print the actual data
out for us to see.
And then we're going to save the information
to the exfiltrated.data file, right?
So it's going to be a text file
that we're going to save it to.
And then we're going to return the 200 HTTP code.
So that means we're going to respond
to the client, confirming
that we received the data,
and then that particular script is going to trigger
a message letting us know that we received the data.
Okay, so then we have this basic information here,
setting up where the host will be,
that's going to be our IP address, which port, et cetera.
And then we have the self-sign certificate things.
We're not going to go over this portion,
but this will be a main staple of a HTTP server.
Now let me go ahead and start this HTTPS server,
and then we're going to switch to the Ubuntu server
and go over the script there.
Sudu python3.
All right, perfect, so now we're just
waiting for requests, okay?
So now I'm about to switch over to the Ubuntu server.
All right, so I'm on our compromised server.
So again, we're assuming that we already
compromised the server
and we created a script on this server
and we're going to use it to exfiltrate
our data using HTTPS.
So similar to the other script,
we're going to import our request statement,
and then we're going to have the URL
that we're going to send it to.
So remember my Kali Linux Machine has a IP address here
of 10.211.55.6.
And remember, we're going to execute
this exfiltrate function
and we saw that on the other script.
So once the system sees this exfiltrate,
it knows which function to run.
So here we're going to have the path to the file.
So it's going to be our present working directory.
So we don't need any other information
except for the file name itself.
And then we're going to save the data
from this file here, right?
So file_to_exfiltrate, we're going to open it up.
I'm going to save this information
into the data variable, right?
So we're going to do the "f",
we're going to name this file.read.
So all the contents from this file will go
into this data variable.
And then we're going to send the data variable here.
So this is where the information's going to go
over HTTPS, right?
So we're going to use this request method
and we're going to use a post method,
information's going to send a response.
And then we're going to run this if L statement.
So pretty much if we receive the status code 200,
as we saw on the other script,
where we will send a 200,
once we receive the information.
Once it receives the 200 back,
it's going to show on this screen
that the data was successfully exfiltrated.
So let's exit out and run this.
All right, perfect, so we're getting
the confirmation message here,
that the data was successfully exfiltrated.
So let's switch back to the Kali Linux machine
and see it printed on the screen.
All right, great, so we've confirmed
that we got the information,
'cause our script said we were just going to receive it
and we're just going to print out the exfiltrated data
and the contents of the file.
So that's here, that's what the information
from that sensitive document said.
And this is described in the contents of the HTTPS request.
So in summary, we created two separate scripts.
We created a HTTPS server
to receive information from a compromised server,
and then we created a script on that compromised server
to send the exfiltrated data over the HTTPS protocol.
I hope you enjoyed this demonstration
and I'll see you in the next one.