Now, there are other protocols out there
that leverage payloads of data whenever
they're trying to do whatever it is these protocols do.
And we can manipulate those payloads of data.
Guess what.
Attackers can, too.
So when the attackers receive or find
the data that they're looking for in your environment,
they can use these text-based protocols to just fire off
the data, even one character at a time.
These are protocols like ICMP, what
we use to send ping messages, or NTP, Network Time Protocol.
So in this Nugget, we're actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in this Nugget, we're actually
going to explore a script that I found
on GitHub that leverages the ICMP protocol to exfiltrate
data one character at a time.
A really cool way that they can attack us and exfiltrate data.
But be careful, you want to monitor these things.
They're an indicator of compromise at the same time.
Let's get going.
Now, look, I'm going to be honest.
This is another one that kind of blew my mind the first time
that I saw it, because I didn't realize
that we could manipulate the protocols these ways.
But hackers absolutely can. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There are protocols that are sending data
across the wire just using ASCII level text.
And these are protocols that we can change on the fly
and use it to exfiltrate data.
Just the same way that we could exfiltrate DNS data
by using a base64 encoding, and then just sending
a query for that message, we can leverage similar protocols,
like NTP, to send messages using the exact same exfiltration
technique there.
Or we could even use the most classic protocol of all, ICMP, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or we could even use the most classic protocol of all, ICMP,
to send ping requests.
Check this out.
If I bring up my Wireshark capture here,
you can see I've initiated four basic ping requests.
Look at the payload right there.
Look at that.
What is this?
This is nothing more than just the alphabet, a string of text.
And you can absolutely change this protocol.
You could actually absolutely change this payload of data
to send something like that base64 encoded username
and password so long as it doesn't violate any links
or MTUs along the path.
Of course, you could fragment it along the way, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Of course, you could fragment it along the way,
but if there is a don't fragment bit sent, well,
then you're not going to be able to exfiltrate the data.
But the point is that we can change this payload right here
on the fly.
And one of the cool things that I found
is there's actually scripts out there
publicly available on GitHub that
walk you through how to do it.
Check this out.
I'll bring it up right now.
This I found, this little sample code.
You can see it right here on this URL.
This is the GitHub repository of martinoj2009.
And he's got a little script here called ICMPExfil. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And he's got a little script here called ICMPExfil.
Now, the script that I'm focused on right here is the ping.
He's also got another script in this repository, which
is how the server actually handles the response as it's
coming in.
This is a Python script.
And again, hackers can absolutely
run malicious scripts whenever they want.
The idea is that it runs the ping.py script,
but it passes in variables, or arguments, as they're called.
And these arguments are going to be
things like the username or the password.
And they might be base64 encoded.
Whatever the case is, they simply run the script WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Whatever the case is, they simply run the script
and provide the additional information.
And all of this can be done in the background
unbeknownst to you, or the end users who are watching.
So if I make it all the way down to the bottom,
you can see right here it's running
the subprocess call, a count of one ping, to this destination.
And it sends that payload for every line in the data.
And for every character in the line,
it sends that ping one line at a time, one character at a time.
Now, above this, all the stuff that's going on here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, above this, all the stuff that's going on here
is this is just how it's handling the data that it's
trying to exfiltrate.
It does have to be encoded in ASCII text.
It does have to be plaintext.
And it has to be written in a specific way.
So all of this handling code here
is just making sure that the payload will
be accessible and usable both by the ICMP protocol, as well as
the server that's receiving it.
But the idea is I just wanted to show you
the script, that the script actually exists out there
on GitHub right now showing you how people can use the ICMP
protocol to send one character at a time WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
protocol to send one character at a time
to exfiltrate data that they care about using the ICMP
protocol.
So the big takeaway here is that just keep in mind
that any protocol that has any sort of text-based payload
might be able to be manipulated by a hacker
that they can use to exfiltrate the data.
Maybe that data is ASCII encoded, or base64
encoded, or whatever.
But even the most basic protocols,
like ICMP, or Network Time Protocol, NTP,
can be manipulated and used to exfiltrate sensitive data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can be manipulated and used to exfiltrate sensitive data.
Whether it's coming from your database, files,
or key loggers, whatever the case,
hackers can find a way in, and then they can find a way out.
So that's been understanding how data can be exfiltrated.
I hope this has been informative for you.
And I'd like to thank you for viewing.