1 of 45

Introducing DET

(Data Exfiltration Toolkit)

Paul Amar - BSides Ljubjana - 09/03/2016

2 of 45

3 of 45

100

4 of 45

5 of 45

General Approach

​

TCP� DNS� HTTP� ICMP� SMTP

​

​

6 of 45

General Approach

​

TCP� DNS� HTTP� ICMP� SMTP

​

​

7 of 45

General Approach

​

TCP� DNS� HTTP� ICMP� SMTP

​

​

8 of 45

General Approach

​

TCP� DNS� HTTP� ICMP� SMTP

​

​

9 of 45

General Approach

​

TCP� DNS� HTTP� ICMP� SMTP

​

​

10 of 45

General Approach

​

TCP� DNS� HTTP� ICMP� SMTP

​

​

11 of 45

HammerToss (July 2015)

12 of 45

What’s available today?

13 of 45

What’s available today?

And many more.. created almost everyday.

​

Not kidding.

14 of 45

Current state

TCP� DNS� HTTP� ICMP� Twitter DMs� SMTP (eg. Gmail)

​

​

15 of 45

Introducing DET

16 of 45

Configuration file (JSON format)

17 of 45

File to exfiltrate

18 of 45

Folder to exfiltrate / multi-threaded

19 of 45

Plugin(s) to use

20 of 45

Plugin(s) to exclude

21 of 45

Server mode

22 of 45

Configuration file

​

​

List all your plugins and their configuration

​

​

​

​

23 of 45

Configuration file

​

​

Each plugin has its own configuration �(username, pwd, …)

​

​

24 of 45

Configuration file

​

​

Additional configuration (XOR Key, Sleeping time, …)

25 of 45

Let’s dig a bit (Client-side)

26 of 45

“Registration” phase 1/2

27 of 45

“Registration” phase 2/2

28 of 45

Sending the data 1/2

29 of 45

Sending the data 2/2

30 of 45

“End” phase 1/2

31 of 45

“End” phase 2/2

32 of 45

So in few words..

33 of 45

34 of 45

35 of 45

36 of 45

But wait! There’s moar.

37 of 45

Additional plugins (Tor Integration) 1/2

​

​

​

​

​

�Source: http://foxglovesecurity.com/2015/11/02/hack-like-the-bad-guys-using-tor-for-firewall-evasion-and-anonymous-remote-access/

38 of 45

Additional plugins (Tor Integration) 2/2

39 of 45

“Experimental” plugins

40 of 45

41 of 45

What’s next

​

  • Port DET *entirely* to PowerShell (With Plugin based) (“Empire”-like)�
  • More plugins!�
  • Data obfuscation layer using Markov Chains

42 of 45

43 of 45

44 of 45

Installation

Get/install it:

  • git clone https://github.com/sensepost/DET
  • pip install -r requirements --user (instal dependencies for the local user)

​

Client side:� - python det.py -f /etc/passwd -c ./config.json (or PS scripts)�Server side:� - python det.py -L -c ./config.json

45 of 45

sys.exit(0)

​

​

​

​

​

Paul Amar (paul@sensepost.com) / @PaulWebSec