In this demonstration,
we will look at how we can exfiltrate that same file that has been
cloaked with the CloakifyFactory using SMB. And by using SMB, we're
going to make use of another tool that has been built into Kali
Linux to start the SMB server.
The tool that we will be using is called impacket‑smbserver.
Essentially, what this command does is it starts the SMB
server. We define the share name,
the share location, and since this is Windows 10 that we are
targeting, by default, SMB version 1 is disabled, so we need
to enforce SMB version 2 support.
Once I execute the command,
the SMB server has started. Now I will switch back to my C2
channel, and from within the C2 channel,
I'm going to drop down into the shell, and now I will use the default
Windows commands to copy that cloaked file to the SMB server.
Now that the file has been copied, when I switch back to my Kali Linux machine,
I can see that the user has authenticated and the file has been
copied across. Within the folder that I've defined, I can now
find the starTrek_names cloaked file. And to confirm that this is
in fact our cloaked file,
I can see the emojis and the multiple Star Trek names within the file.
From here,
I can go ahead and decloak this file using the CloakifyFactory framework.