WEBVTT 00:00:01.740 --> 00:00:03.660 So let's kick off with our demonstrations. 00:00:04.240 --> 00:00:06.760 I have already downloaded CloakifyFactory, 00:00:06.960 --> 00:00:09.460 and this is what the folder structure looks like. 00:00:10.040 --> 00:00:11.750 When you navigate to the ciphers, 00:00:13.940 --> 00:00:16.850 you are able to see all of the different ciphers, 00:00:17.170 --> 00:00:19.230 and you can create your own cipher. 00:00:19.230 --> 00:00:24.260 To view the ciphers, I can use a simple command such as cat, 00:00:24.740 --> 00:00:27.350 and I will look at the starTrek ciphers. 00:00:28.340 --> 00:00:31.160 The cipher simply contains a bunch of words. 00:00:31.540 --> 00:00:35.350 You can create your own cipher, and we'll take a look at that a little bit later. 00:00:36.540 --> 00:00:39.860 Now let's take a look at how we can make use of CloakifyFactory. 00:00:40.340 --> 00:00:44.660 I already have a C2 channel established to my target computer. 00:00:45.440 --> 00:00:47.930 We can take a look at what directory we are operating at, 00:00:47.930 --> 00:00:50.860 and right now this is the Documents folder. 00:00:51.640 --> 00:00:55.260 Perhaps there is some interesting information within this folder. 00:00:56.240 --> 00:00:59.660 I do see one folder which is titled Confidential. 00:01:00.340 --> 00:01:03.850 Let's take a look at what is inside the Confidential folder. 00:01:05.019 --> 00:01:08.330 I see that there's a file called PII.csv. 00:01:08.330 --> 00:01:11.660 This could be an interesting file. 00:01:12.040 --> 00:01:15.830 Perhaps it's got some confidential information that I could use 00:01:15.830 --> 00:01:18.670 that could be of value to me as an attacker. 00:01:18.960 --> 00:01:21.810 So let's try to exfiltrate this file. 00:01:22.000 --> 00:01:25.440 Now I could simply copy this using an Meterpreter; however, 00:01:25.450 --> 00:01:28.570 I don't know if there are any security solutions that may 00:01:28.570 --> 00:01:32.350 be looking for this specific file name, the file hash, 00:01:33.040 --> 00:01:35.850 or if the file is also protected by DLP. 00:01:36.000 --> 00:01:41.580 So for now, let's attempt to mask the file using CloakifyFactory, 00:01:41.740 --> 00:01:43.670 exfiltrate that cloaked file, 00:01:43.670 --> 00:01:48.560 and then decloakify it on our Kali Linux machine to see what it has. 00:01:48.560 --> 00:01:52.060 Now since CloakifyFactory uses Python, 00:01:52.240 --> 00:01:55.240 I doubt that Python is installed on this computer, 00:01:55.240 --> 00:01:57.870 so let's go ahead and install this. 00:01:58.440 --> 00:02:02.840 But before we do that, let's check if this machine has Python installed. 00:02:02.840 --> 00:02:09.150 And to do that, we will use one of the Meterpreter post‑exploitation scripts, 00:02:09.220 --> 00:02:13.570 and the script is the post gather/enum_applications. 00:02:13.900 --> 00:02:19.560 So this confirms that the target machine does not have Python installed. 00:02:19.940 --> 00:02:22.160 So let's go ahead and install Python. 00:02:22.840 --> 00:02:24.300 I've already downloaded Python, 00:02:24.300 --> 00:02:28.040 so I'm going to go ahead and upload this using Meterpreter. 00:02:28.150 --> 00:02:33.380 Now that the upload is completed, let's also upload the CloakifyFactory package. 00:02:33.380 --> 00:02:37.760 And the complete package can be downloaded by using the GitHub 00:02:37.770 --> 00:02:40.350 repository and using the Download suboption. 00:02:40.620 --> 00:02:42.150 I've already downloaded the package, 00:02:42.150 --> 00:02:46.300 so I will also upload this within the Meterpretersession. 00:02:46.600 --> 00:02:51.700 Now that this has been uploaded, I'm going to use a component of 7‑Zip, 00:02:51.700 --> 00:02:55.300 which can extract the Cloakify package without any 00:02:55.300 --> 00:02:57.630 prompts to the user on the computer. 00:02:57.750 --> 00:03:01.050 If you would like to use that same component that I am referring to, 00:03:01.050 --> 00:03:04.140 you can obtain this from the 7‑Zip website, 00:03:04.150 --> 00:03:10.450 and within that package, the file that I am looking for specifically is 7za.exe. 00:03:10.910 --> 00:03:14.790 This is the 7‑Zip Extra: standalone console version. 00:03:15.440 --> 00:03:18.060 So I'm going to go ahead and upload just that one 00:03:18.060 --> 00:03:20.190 file within the Meterpreter session. 00:03:20.330 --> 00:03:20.760 Right. 00:03:20.770 --> 00:03:25.010 So now I have all the files that I need uploaded in order 00:03:25.010 --> 00:03:29.590 to go ahead and Cloakify that PII file and exfiltrate it 00:03:29.600 --> 00:03:31.760 back to my Kali Linux machine. 00:03:32.440 --> 00:03:33.490 So let's get started. 00:03:33.500 --> 00:03:35.540 We'll verify that we have the files needed, 00:03:35.550 --> 00:03:37.700 and sure enough, I've got the required files. 00:03:37.700 --> 00:03:40.710 And once I have verified that I have the required files, 00:03:40.720 --> 00:03:44.900 I'm going to drop down into the shell of the target machine. 00:03:44.910 --> 00:03:47.950 Now since I'm already in the Confidential folder, 00:03:48.050 --> 00:03:51.160 the first thing I'm going to do is install Python. 00:03:51.240 --> 00:03:53.860 Now generally when you install Python the normal way, 00:03:53.970 --> 00:03:57.950 the user would get some prompts or would need to accept the license agreement, 00:03:58.100 --> 00:03:58.760 etc. 00:03:59.340 --> 00:04:01.130 Of course, we don't want that to happen, 00:04:01.130 --> 00:04:04.090 so we're going to install it using the quiet mode 00:04:04.090 --> 00:04:07.250 since this is an MSI installer. 00:04:07.260 --> 00:04:11.890 So using the msiexec command line followed by defining the package 00:04:12.000 --> 00:04:15.730 and using the qn for no prompt and quiet mode, 00:04:16.019 --> 00:04:19.700 I'm also going to include the norestart option as well. 00:04:19.709 --> 00:04:23.620 And while that's been installed, I'm going to quickly minimize my browser. 00:04:23.750 --> 00:04:25.510 Right, so I received no errors back. 00:04:25.510 --> 00:04:29.290 Now let's check and confirm that Python is installed. 00:04:29.400 --> 00:04:33.620 I'm going to move back to Meterpreter by exiting out of the shell session, 00:04:33.630 --> 00:04:37.090 and I'm going to rerun the post‑exploitation script to 00:04:37.090 --> 00:04:39.560 verify the applications that's installed. 00:04:40.040 --> 00:04:43.610 For some reason, Meterpreter does not show the application, 00:04:43.610 --> 00:04:49.160 so let's go back to the shell prompt, and this time we will verify it manually. 00:04:49.640 --> 00:04:52.220 And by just doing a standard directory listing, 00:04:52.390 --> 00:04:54.990 I can see the Python27 directory. 00:04:55.440 --> 00:04:58.360 So this confirms that Python is actually installed. 00:04:58.630 --> 00:05:01.780 Let's move back to the directory that we need to be in, 00:05:01.940 --> 00:05:03.590 which is the Confidential folder. 00:05:03.760 --> 00:05:05.960 Right, so now that we have Python installed, 00:05:06.120 --> 00:05:09.360 the next step is to extract the Cloakify package. 00:05:09.360 --> 00:05:13.650 And to do that, I'm going to use the 7‑Zip standalone version. 00:05:13.840 --> 00:05:15.960 I'm going to use the extract command, 00:05:16.040 --> 00:05:20.070 and I'm going to define the Cloakify‑master package. 00:05:20.110 --> 00:05:22.450 Now let's take a look at what has been extracted, 00:05:22.600 --> 00:05:25.270 and now we have the Cloakify‑master directory. 00:05:25.270 --> 00:05:30.320 And within the directory, I've got the various standalone scripts that I can use, 00:05:30.550 --> 00:05:34.010 and I've got the actual framework script that I could use as well. 00:05:34.110 --> 00:05:36.530 If I attempt to run the framework, 00:05:36.540 --> 00:05:40.160 it's going to try and spawn another shell or another window, 00:05:40.340 --> 00:05:41.660 and it's not going to work. 00:05:42.240 --> 00:05:43.240 So in this case, 00:05:43.250 --> 00:05:47.130 I'm going to have to make use of the Cloakify standalone scripts. 00:05:47.130 --> 00:05:50.360 And before we do that, I'm just going to clear up my screen, 00:05:50.740 --> 00:05:53.510 and now let's take a look at what the standalone 00:05:53.520 --> 00:05:56.150 Cloakify script syntax looks like. 00:05:56.150 --> 00:05:59.080 The first command I'm going to issue is to run the 00:05:59.080 --> 00:06:01.290 actual Cloakify Python script. 00:06:01.460 --> 00:06:03.070 Now I can see the usage, 00:06:03.160 --> 00:06:06.300 which shows me that I need to define the payload file name, 00:06:06.310 --> 00:06:09.330 which in this case is the PII.csv file, 00:06:09.400 --> 00:06:12.060 and then I need to define a cipher file name. 00:06:12.140 --> 00:06:13.980 So I'll go ahead and reissue the command. 00:06:14.150 --> 00:06:17.950 This time, I will define the target file, which is PII.csv. 00:06:17.950 --> 00:06:23.020 I will then make use of a cipher, which in my case would be the starTrek ciphers, 00:06:23.140 --> 00:06:26.420 and I would like to send the output to a specific file. 00:06:26.420 --> 00:06:30.950 And the file that I would output this to will be called starTrek_names. 00:06:31.140 --> 00:06:33.260 Once the command has completed successfully, 00:06:33.350 --> 00:06:35.010 I could take a look if this worked, 00:06:35.110 --> 00:06:38.660 and now I have a file which is titled starTrek_names. 00:06:39.240 --> 00:06:44.620 I can confirm that this file actually includes data by issuing the type command, 00:06:44.750 --> 00:06:47.120 and this will show me the output of the file. 00:06:47.410 --> 00:06:49.350 So now when anybody looks at the file, 00:06:49.470 --> 00:06:53.490 it simply contains random names of Star Trek characters. 00:06:53.600 --> 00:06:55.910 Now I could exfiltrate the file as it is, 00:06:56.060 --> 00:06:59.100 but I would like to add some additional entropy to the file, 00:06:59.400 --> 00:07:02.560 and this can be done by making use of the noise tools. 00:07:02.560 --> 00:07:06.370 The list of noise tools that we have include emojis, 00:07:06.500 --> 00:07:09.620 IDs, latitude and longitude coordinates, 00:07:09.700 --> 00:07:10.140 and timestamps. 00:07:10.140 --> 00:07:14.610 For my demonstration, I will use the emoji noise tool. 00:07:14.610 --> 00:07:17.240 So I will drop back to the Cloakify‑master package, 00:07:17.250 --> 00:07:19.470 and this time I will use the Python command, 00:07:19.480 --> 00:07:24.650 but leveraging the noiseTools Python script and referring it to 00:07:24.650 --> 00:07:26.980 the file that we've just created previously. 00:07:26.990 --> 00:07:30.650 Now that noise has been added, let's take a look at the output of the file. 00:07:30.650 --> 00:07:36.490 And now in the output, I've got emojis next to the different names. 00:07:36.820 --> 00:07:42.630 Now the file looks less like PII data and more like a random list of 00:07:42.630 --> 00:07:45.810 Star Trek characters with some really cool emojis. 00:07:46.440 --> 00:07:48.450 Now let's go ahead and exfiltrate this file.