WEBVTT

00:00:00.140 --> 00:00:03.020
Now that we have cloaked the file, let's go ahead and

00:00:03.030 --> 00:00:06.260
exfiltrate it within our C2 channel.

00:00:07.540 --> 00:00:12.870
And for this demonstration, we will use the standard Meterpreter C2 that we

00:00:12.870 --> 00:00:17.340
have established. I'll confirm the directory that I'm working in, and I

00:00:17.340 --> 00:00:21.320
need to move to the Confidential folder, and the file that we're looking

00:00:21.320 --> 00:00:24.270
for exists within the Cloakify folder.

00:00:24.490 --> 00:00:29.250
So the file that we need to exfiltrate is the one that's titled starTrek_names.

00:00:29.640 --> 00:00:33.310
Right. So now that we have the file downloaded, let's go ahead and

00:00:33.400 --> 00:00:37.050
decloakify the file using the CloakifyFactory framework.

00:00:37.540 --> 00:00:41.380
So now I'll switch to the CloakifyFactory framework, and I'll start

00:00:41.380 --> 00:00:46.160
the framework, and then I'm going to select the Decloakify a File

00:00:46.160 --> 00:00:51.480
option. I'll specify the file that we've just exfiltrated, and then

00:00:51.480 --> 00:00:53.560
I'll define the destination file name.

00:00:54.240 --> 00:00:59.320
I can then choose to preview the cloaked file, and here we can confirm

00:00:59.330 --> 00:01:03.930
that we've got the emojis that have been added as noise, and the rest of

00:01:03.930 --> 00:01:07.430
the file contains random Star Trek characters.

00:01:07.440 --> 00:01:12.620
The framework then asks me if noise has been added. In our case, yes,

00:01:12.620 --> 00:01:17.340
it has, and we will select the noise generator that was used.

00:01:17.420 --> 00:01:21.260
This is the prependEmoji noise generator.

00:01:22.540 --> 00:01:26.120
And now I need to select the cipher that was used,

00:01:26.130 --> 00:01:29.410
which in our case is the starTrek cipher.

00:01:29.420 --> 00:01:31.360
Now the file has been decloaked.

00:01:32.240 --> 00:01:35.380
So I'll exit out of this, and let's take a look at what the file

00:01:35.380 --> 00:01:39.780
looks like. The file name of the decloaked file is PII, and now

00:01:39.780 --> 00:01:43.680
when I take a look at the file, I see that I've got data such as

00:01:43.780 --> 00:01:47.660
social security numbers, credit card numbers, and a lot more.

00:01:48.140 --> 00:01:52.960
Let's confirm this with the file that we've cloaked on the Windows machine.

00:01:53.440 --> 00:01:57.550
So I still have my C2 channel open, and I'm going to drop down into the shell.

00:02:00.540 --> 00:02:05.070
And now I want to take a look at what the PII.csv file contains,

00:02:05.070 --> 00:02:07.910
and I will view this using the more command.

00:02:07.950 --> 00:02:10.259
And sure enough, it's the exact same file.

00:02:11.039 --> 00:02:16.260
So that was a demonstration of how we can exfiltrate over a C2 channel.