Exfiltration over ICMP
MITRE ATT&CK™ - Exfiltration Over Alternative Protocol - Technique T1048
Last updated
Was this helpful?
MITRE ATT&CK™ - Exfiltration Over Alternative Protocol - Technique T1048
Last updated
Was this helpful?
The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers, to send error messages and operational information indicating success or failure when communicating with another IP address ().
At a high level, an ICMP packet consists of multiple fields, including a Data section. This section can contain arbitrary information, such as diagnostic messages, test payloads, or even copied portions of other network packets (e.g., IPv4 headers for error reporting). The following diagram illustrates the Data section, which is optional but can be leveraged for various purposes, including covert communication.
We can, on linux targets, exfiltrate datas with the -p options of the ping command.
On the attacking machine, we can receive the data as follows
Note that the -p option is only available for Linux operating systems. We can confirm that by checking the ping's help manual page.
On a Windows victime, we may exfiltrate data over ICMP using poweshell
On the attacking machine, we can receive the data as follows
To facilitate file exfiltration and remove the limit of 16 bytes in the data field using the native ping command, you can alternatively employ (python).
is an open-source reverse-shell written in Python3 and scapy. The tool uses the same concept we discussed earlier, where an attacker utilizes the Data section within the ICMP packet. The only difference is that an attacker sends a command that needs to be executed on a victim's machine. Once the command is executed, a victim machine sends the execution output within the ICMP packet in the Data section.
