WEBVTT

00:00:00.540 --> 00:00:05.250
Now let's attempt to exfiltrate that same file over a web service.

00:00:05.740 --> 00:00:09.050
Generally, end user computers would have access to the internet,

00:00:09.050 --> 00:00:14.570
and this could be over Port 80 or Port 443. Sometimes the traffic

00:00:14.570 --> 00:00:17.060
is inspected, and sometimes it's not.

00:00:18.040 --> 00:00:22.490
So you can exfiltrate data over a web service either to something like

00:00:22.500 --> 00:00:26.190
baseband or a web server that you may already control.

00:00:26.410 --> 00:00:29.880
In this demonstration, we will use a simple web server that's

00:00:29.880 --> 00:00:34.020
running on our attacker machine, and we will make use of a PHP

00:00:34.020 --> 00:00:37.750
upload script and Windows to perform the upload.

00:00:38.040 --> 00:00:42.190
The first thing that I will do is navigate to my Apache Server

00:00:42.200 --> 00:00:45.000
folder directory on the Kali Linux machine.

00:00:45.230 --> 00:00:49.450
Now within this directory, I have added an uploads folder, and

00:00:49.450 --> 00:00:53.430
I've created a simple upload.php script. And what this simple

00:00:53.430 --> 00:00:59.070
script does is that any call to this PHP script will move files to

00:00:59.070 --> 00:01:01.100
the specific uploads directory.

00:01:01.110 --> 00:01:05.120
Now all I need to do is start the Apache Server, and once my server

00:01:05.120 --> 00:01:10.190
has started, I will be able to use it to exfiltrate the file. I've

00:01:10.190 --> 00:01:13.380
now switched back to the C2 communication channel, which is

00:01:13.380 --> 00:01:15.160
established with the Windows machine.

00:01:16.040 --> 00:01:21.100
I'm still operating in the Cloakify‑master folder where the cloaked file that

00:01:21.100 --> 00:01:26.070
we have just created still exists. And to confirm, we see that the file does

00:01:26.070 --> 00:01:29.380
indeed exist, and it is titled starTrek_names.

00:01:30.140 --> 00:01:33.160
Now since we have the Apache Server that is started up,

00:01:33.300 --> 00:01:35.960
we need to upload the file to that server.

00:01:36.510 --> 00:01:40.550
This can be done in a variety of ways. You can use a simple script.

00:01:40.850 --> 00:01:41.340
However,

00:01:41.340 --> 00:01:46.030
we're not sure what type of script languages the OS supports, and if

00:01:46.030 --> 00:01:49.050
there's any monitoring on those type of languages,

00:01:49.740 --> 00:01:54.150
if I use PowerShell, I will need to make use of the script bypass command,

00:01:54.290 --> 00:01:59.760
which may trigger an alert to SecOps. Telnet is not installed by default on

00:01:59.760 --> 00:02:01.990
Windows 10, and if I attempt to install it,

00:02:02.180 --> 00:02:03.690
it might also raise a flag.

00:02:03.700 --> 00:02:04.380
However,

00:02:04.390 --> 00:02:10.199
since Windows 10 is shipped by default with a tool called curl

00:02:10.210 --> 00:02:13.210
that we can use, that will be the best‑case scenario to

00:02:13.210 --> 00:02:15.020
leverage within this demonstration.

00:02:15.260 --> 00:02:20.360
So we will be using a simple curl script that's going to be calling the

00:02:20.360 --> 00:02:24.760
starTrek_names file and uploading it to our Apache server.

00:02:25.440 --> 00:02:26.910
So to execute the script,

00:02:26.920 --> 00:02:30.470
I'm going to drop down into the shell prompt, and I will use the curl

00:02:30.470 --> 00:02:34.990
command, specifying the content type, defining my target file,

00:02:35.000 --> 00:02:39.150
which is the starTrek_names file, and in the function, which

00:02:39.150 --> 00:02:41.840
is to post this file to the web server,

00:02:42.080 --> 00:02:47.740
leveraging the upload.php script we've created. And once the command executes,

00:02:47.750 --> 00:02:50.960
the file should now be uploaded to my Kali Linux machine.

00:02:51.740 --> 00:02:54.450
I'll switch back to the Apache folder structure and

00:02:54.450 --> 00:02:57.000
navigate to uploads, and sure enough,

00:02:57.260 --> 00:03:02.100
there is my file. I can confirm that this is the cloaked file since it has

00:03:02.100 --> 00:03:07.390
both the emojis and randomized Star Trek names. From here,

00:03:07.570 --> 00:03:10.600
I can follow the same process as before to decloak the

00:03:10.600 --> 00:03:13.660
file using the CloakifyFactory framework.