WEBVTT

00:00:01.240 --> 00:00:02.280
In this demonstration,

00:00:02.290 --> 00:00:05.840
we will look at how we can exfiltrate that same file that has been

00:00:05.840 --> 00:00:10.780
cloaked with the CloakifyFactory using SMB. And by using SMB, we're

00:00:10.780 --> 00:00:14.290
going to make use of another tool that has been built into Kali

00:00:14.290 --> 00:00:16.890
Linux to start the SMB server.

00:00:17.000 --> 00:00:20.500
The tool that we will be using is called impacket‑smbserver.

00:00:20.500 --> 00:00:24.980
Essentially, what this command does is it starts the SMB

00:00:24.980 --> 00:00:27.360
server. We define the share name,

00:00:27.840 --> 00:00:31.590
the share location, and since this is Windows 10 that we are

00:00:31.590 --> 00:00:36.780
targeting, by default, SMB version 1 is disabled, so we need

00:00:36.780 --> 00:00:39.760
to enforce SMB version 2 support.

00:00:39.870 --> 00:00:41.300
Once I execute the command,

00:00:41.650 --> 00:00:46.730
the SMB server has started. Now I will switch back to my C2

00:00:46.730 --> 00:00:49.350
channel, and from within the C2 channel,

00:00:49.360 --> 00:00:53.310
I'm going to drop down into the shell, and now I will use the default

00:00:53.310 --> 00:00:58.070
Windows commands to copy that cloaked file to the SMB server.

00:00:58.100 --> 00:01:02.610
Now that the file has been copied, when I switch back to my Kali Linux machine,

00:01:02.720 --> 00:01:06.870
I can see that the user has authenticated and the file has been

00:01:06.870 --> 00:01:10.590
copied across. Within the folder that I've defined, I can now

00:01:10.590 --> 00:01:14.310
find the starTrek_names cloaked file. And to confirm that this is

00:01:14.310 --> 00:01:15.570
in fact our cloaked file,

00:01:15.660 --> 00:01:21.030
I can see the emojis and the multiple Star Trek names within the file.

00:01:21.320 --> 00:01:21.940
From here,

00:01:21.950 --> 00:01:25.860
I can go ahead and decloak this file using the CloakifyFactory framework.