Hey there.
Welcome back to our meterpreter course. In this last module,
we'll talk about searching and exfiltrating sensitive data with
meterpreter. This module is all about exfiltrating sensitive
data without being detected.
Remember,
we want to simulate a real attacker so we should use the same stealthy
techniques to exfiltrate data. In this module, we'll continue our scenario
that we have been following throughout the course. In here, since we already
have the admin rights and also have persistence capabilities, our job now is
to search and exfiltrate data.
The idea here is simulating a real hacker to show our client
what kind of damage a real hack could cause.
So let's take a quick look on what will you be learning
here. First, we discuss some of the main techniques for data
exfiltration, and most important,
you'll learn how to be stealthy and how to minimize
your chances of being detected.
Then, in your first demo,
you'll learn how to search and exfiltrate sensitive
files using meterpreter. After that,
we'll discuss some really creepy features of meterpreter,
which is recording microphone audio and webcam video.
Also, you'll learn how to set up keyloggers with meterpreter,
which will allow you to capture everything that a person types,
and as this the last module of the course,
we'll have a course closure section with some tips on
how to practice your new skills.
There are several techniques for data exfiltration,
and we could spend a whole course just discussing on how to
exfiltrate data in a professional way.
But in my day‑to‑day pen testing,
I usually use four main techniques for that exfiltration.
In my opinion, those four techniques are the most effective ones,
and I'm usually successful with at least one of them.
The first one is the most simple one.
We can transfer the sensitive files using the Meterpreter session,
and this is really simple, and it works all the time.
However,
if you're transferring large amounts of data, that can create some alerts in
some detection tools. Another option is create an HTTPS, SFTP, or SCP server,
and transferring the data to there. In this way,
you can have multiple servers to receive the data,
and you can transfer a little bit of data to each server. And
note here, that we're using the encrypted version of the
protocols. For example, instead of using FTP,
you should use SFTP,
and the idea here is to have the traffic encrypted so then the
detection tools don't know what is happening.
Another option is trying to blend the data exfiltration with
the day‑to‑day activity of the company.
For example,
you can encrypt the files you want to transfer and then
send them in several separate emails.
In this way,
you're not generating any kind of suspicious traffic, it just
looks like regular emails leaving the company.
And the last and probably most successful ways of exfiltrating data is
uploading the files to a cloud storage service. Again.
first, encrypt all the files,
and then you can transfer them to Dropbox, Megaupload,
Microsoft OneDrive, or any cloud storage service.
And the reason that this always work is because usually those
services are whitelisted in the Detection tools.
And if the admin sees a lot of files being transferred to the cloud,
they might think it's just a regular employee using the storage service.
As I mentioned, one of our main objectives is to avoid detection.
The four techniques that are described in the previous slide
are usually really good to avoid detection,
but you should always have in mind to be as stealthy
as possible to not be detected.
My recommendation is to always think from the defensive side.
For example,
if you work in a SOC and you see a huge file transfer at 4 in the morning,
that's really suspicious.
But if that happens, and at 10 AM on a Monday, that's a little more normal.
So again, always be careful with your actions. Also,
another really good tip is to always encrypt the data your
exfiltrating to avoid any DLP tools.
Also, try to send the files using normal protocols,
so then you can blend with regular traffic.
For example, if you use random ports to exfiltrate the data,
then most likely you'd be detected, but if you use HTTPS,
then it might look normal for the people in the SOC. And also, try to
investigate any cloud services that the company uses,
and then you can replicate it.
For example,
if the company normally uses Microsoft OneDrive to store data on the cloud,
you can go and create a free OneDrive account and
upload all the sensitive data to there.
In this way,
the SOC guys will not see anything suspicious since the traffic
is going to the Microsoft OneDrive website.