So let's kick off with our demonstrations.
I have already downloaded CloakifyFactory,
and this is what the folder structure looks like.
When you navigate to the ciphers,
you are able to see all of the different ciphers,
and you can create your own cipher.
To view the ciphers, I can use a simple command such as cat,
and I will look at the starTrek ciphers.
The cipher simply contains a bunch of words.
You can create your own cipher, and we'll take a look at that a little bit later.
Now let's take a look at how we can make use of CloakifyFactory.
I already have a C2 channel established to my target computer.
We can take a look at what directory we are operating at,
and right now this is the Documents folder.
Perhaps there is some interesting information within this folder.
I do see one folder which is titled Confidential.
Let's take a look at what is inside the Confidential folder.
I see that there's a file called PII.csv.
This could be an interesting file.
Perhaps it's got some confidential information that I could use
that could be of value to me as an attacker.
So let's try to exfiltrate this file.
Now I could simply copy this using an Meterpreter; however,
I don't know if there are any security solutions that may
be looking for this specific file name, the file hash,
or if the file is also protected by DLP.
So for now, let's attempt to mask the file using CloakifyFactory,
exfiltrate that cloaked file,
and then decloakify it on our Kali Linux machine to see what it has.
Now since CloakifyFactory uses Python,
I doubt that Python is installed on this computer,
so let's go ahead and install this.
But before we do that, let's check if this machine has Python installed.
And to do that, we will use one of the Meterpreter post‑exploitation scripts,
and the script is the post gather/enum_applications.
So this confirms that the target machine does not have Python installed.
So let's go ahead and install Python.
I've already downloaded Python,
so I'm going to go ahead and upload this using Meterpreter.
Now that the upload is completed, let's also upload the CloakifyFactory package.
And the complete package can be downloaded by using the GitHub
repository and using the Download suboption.
I've already downloaded the package,
so I will also upload this within the Meterpretersession.
Now that this has been uploaded, I'm going to use a component of 7‑Zip,
which can extract the Cloakify package without any
prompts to the user on the computer.
If you would like to use that same component that I am referring to,
you can obtain this from the 7‑Zip website,
and within that package, the file that I am looking for specifically is 7za.exe.
This is the 7‑Zip Extra: standalone console version.
So I'm going to go ahead and upload just that one
file within the Meterpreter session.
Right.
So now I have all the files that I need uploaded in order
to go ahead and Cloakify that PII file and exfiltrate it
back to my Kali Linux machine.
So let's get started.
We'll verify that we have the files needed,
and sure enough, I've got the required files.
And once I have verified that I have the required files,
I'm going to drop down into the shell of the target machine.
Now since I'm already in the Confidential folder,
the first thing I'm going to do is install Python.
Now generally when you install Python the normal way,
the user would get some prompts or would need to accept the license agreement,
etc.
Of course, we don't want that to happen,
so we're going to install it using the quiet mode
since this is an MSI installer.
So using the msiexec command line followed by defining the package
and using the qn for no prompt and quiet mode,
I'm also going to include the norestart option as well.
And while that's been installed, I'm going to quickly minimize my browser.
Right, so I received no errors back.
Now let's check and confirm that Python is installed.
I'm going to move back to Meterpreter by exiting out of the shell session,
and I'm going to rerun the post‑exploitation script to
verify the applications that's installed.
For some reason, Meterpreter does not show the application,
so let's go back to the shell prompt, and this time we will verify it manually.
And by just doing a standard directory listing,
I can see the Python27 directory.
So this confirms that Python is actually installed.
Let's move back to the directory that we need to be in,
which is the Confidential folder.
Right, so now that we have Python installed,
the next step is to extract the Cloakify package.
And to do that, I'm going to use the 7‑Zip standalone version.
I'm going to use the extract command,
and I'm going to define the Cloakify‑master package.
Now let's take a look at what has been extracted,
and now we have the Cloakify‑master directory.
And within the directory, I've got the various standalone scripts that I can use,
and I've got the actual framework script that I could use as well.
If I attempt to run the framework,
it's going to try and spawn another shell or another window,
and it's not going to work.
So in this case,
I'm going to have to make use of the Cloakify standalone scripts.
And before we do that, I'm just going to clear up my screen,
and now let's take a look at what the standalone
Cloakify script syntax looks like.
The first command I'm going to issue is to run the
actual Cloakify Python script.
Now I can see the usage,
which shows me that I need to define the payload file name,
which in this case is the PII.csv file,
and then I need to define a cipher file name.
So I'll go ahead and reissue the command.
This time, I will define the target file, which is PII.csv.
I will then make use of a cipher, which in my case would be the starTrek ciphers,
and I would like to send the output to a specific file.
And the file that I would output this to will be called starTrek_names.
Once the command has completed successfully,
I could take a look if this worked,
and now I have a file which is titled starTrek_names.
I can confirm that this file actually includes data by issuing the type command,
and this will show me the output of the file.
So now when anybody looks at the file,
it simply contains random names of Star Trek characters.
Now I could exfiltrate the file as it is,
but I would like to add some additional entropy to the file,
and this can be done by making use of the noise tools.
The list of noise tools that we have include emojis,
IDs, latitude and longitude coordinates,
and timestamps.
For my demonstration, I will use the emoji noise tool.
So I will drop back to the Cloakify‑master package,
and this time I will use the Python command,
but leveraging the noiseTools Python script and referring it to
the file that we've just created previously.
Now that noise has been added, let's take a look at the output of the file.
And now in the output, I've got emojis next to the different names.
Now the file looks less like PII data and more like a random list of
Star Trek characters with some really cool emojis.
Now let's go ahead and exfiltrate this file.