Hello there, and welcome to this course,
which is titled Exfiltration with CloakifyFactory.
This course is part of the red team tools course series,
and I'm super excited to take you through this course.
My name is Rishalin Pillay,
and let's get started. CloakifyFactory enables you to
make use of text‑based steganography.
It is created by Joe Gervais, also known as TryCatchHCF.
Ultimately, this is a toolset that enables data exfiltration and infiltration
in plain sight. It transforms the data into a list of harmless‑looking
strings, essentially letting you hide in plain sight.
The beauty of CloakifyFactory is that it makes use of pre‑packed ciphers.
These ciphers include, for example, a list of Belgian beers,
desserts in English and various languages,
emojis, world beaches, and a lot more.
It also has some prepackaged scripts for adding noise and entropy to your
cloaked payloads. And examples of this could be prepending randomized ID
tags or latitude and longitude coordinates, and, of course, there is a lot
more. But CloakifyFactory works at its best when you are using your own
customized ciphers, and I will show you how you can create customized
ciphers in the demonstrations later. This tool is available on GitHub, so
you can leverage it on Linux or Windows by making use of Python to EXE.
It is simple, clean, and portable. And when I say simple, clean,
and portable, essentially, you can make use of either the
framework, or you can make use of the individual scripts to
either cloak or decloak the data.
Considering the killchain CloakifyFactory works from the action phase onwards,
essentially allowing you to take action on the target. When we
look at the MITRE ATT&CK tactics, in this course, we will focus
predominantly on exfiltration.
We will begin by looking at exfiltration over a C2 channel,
and this is covered by tactic 1041, and then we will move to
tactic 1567 with a subtactic of 0, which is Exfiltration over a Web Service.
Finally,
we will look at tactic 1048 with a subtactic of 1, which is exfiltration
over an alternative protocol such as SMB. As always,
ensure that you stay legal.
This course is designed and built as an education course.
Please do not replicate any of these tasks on targets
that you do not have permission on.
I will be using Kali Linux, specifically Kali Linux 2021.2. And, of course,
make sure that you run an up‑to‑date operating system to ensure that you
have all of the latest updates and upgrades by making use of the apt‑get
update and apt‑get upgrade commands.