Now that we have cloaked the file, let's go ahead and
exfiltrate it within our C2 channel.
And for this demonstration, we will use the standard Meterpreter C2 that we
have established. I'll confirm the directory that I'm working in, and I
need to move to the Confidential folder, and the file that we're looking
for exists within the Cloakify folder.
So the file that we need to exfiltrate is the one that's titled starTrek_names.
Right. So now that we have the file downloaded, let's go ahead and
decloakify the file using the CloakifyFactory framework.
So now I'll switch to the CloakifyFactory framework, and I'll start
the framework, and then I'm going to select the Decloakify a File
option. I'll specify the file that we've just exfiltrated, and then
I'll define the destination file name.
I can then choose to preview the cloaked file, and here we can confirm
that we've got the emojis that have been added as noise, and the rest of
the file contains random Star Trek characters.
The framework then asks me if noise has been added. In our case, yes,
it has, and we will select the noise generator that was used.
This is the prependEmoji noise generator.
And now I need to select the cipher that was used,
which in our case is the starTrek cipher.
Now the file has been decloaked.
So I'll exit out of this, and let's take a look at what the file
looks like. The file name of the decloaked file is PII, and now
when I take a look at the file, I see that I've got data such as
social security numbers, credit card numbers, and a lot more.
Let's confirm this with the file that we've cloaked on the Windows machine.
So I still have my C2 channel open, and I'm going to drop down into the shell.
And now I want to take a look at what the PII.csv file contains,
and I will view this using the more command.
And sure enough, it's the exact same file.
So that was a demonstration of how we can exfiltrate over a C2 channel.