Now let's attempt to exfiltrate that same file over a web service.
Generally, end user computers would have access to the internet,
and this could be over Port 80 or Port 443. Sometimes the traffic
is inspected, and sometimes it's not.
So you can exfiltrate data over a web service either to something like
baseband or a web server that you may already control.
In this demonstration, we will use a simple web server that's
running on our attacker machine, and we will make use of a PHP
upload script and Windows to perform the upload.
The first thing that I will do is navigate to my Apache Server
folder directory on the Kali Linux machine.
Now within this directory, I have added an uploads folder, and
I've created a simple upload.php script. And what this simple
script does is that any call to this PHP script will move files to
the specific uploads directory.
Now all I need to do is start the Apache Server, and once my server
has started, I will be able to use it to exfiltrate the file. I've
now switched back to the C2 communication channel, which is
established with the Windows machine.
I'm still operating in the Cloakify‑master folder where the cloaked file that
we have just created still exists. And to confirm, we see that the file does
indeed exist, and it is titled starTrek_names.
Now since we have the Apache Server that is started up,
we need to upload the file to that server.
This can be done in a variety of ways. You can use a simple script.
However,
we're not sure what type of script languages the OS supports, and if
there's any monitoring on those type of languages,
if I use PowerShell, I will need to make use of the script bypass command,
which may trigger an alert to SecOps. Telnet is not installed by default on
Windows 10, and if I attempt to install it,
it might also raise a flag.
However,
since Windows 10 is shipped by default with a tool called curl
that we can use, that will be the best‑case scenario to
leverage within this demonstration.
So we will be using a simple curl script that's going to be calling the
starTrek_names file and uploading it to our Apache server.
So to execute the script,
I'm going to drop down into the shell prompt, and I will use the curl
command, specifying the content type, defining my target file,
which is the starTrek_names file, and in the function, which
is to post this file to the web server,
leveraging the upload.php script we've created. And once the command executes,
the file should now be uploaded to my Kali Linux machine.
I'll switch back to the Apache folder structure and
navigate to uploads, and sure enough,
there is my file. I can confirm that this is the cloaked file since it has
both the emojis and randomized Star Trek names. From here,
I can follow the same process as before to decloak the
file using the CloakifyFactory framework.