A talk by Paul Amar (@paulwebsec) about DET; a tool for stealthily exfiltrating data from internal network, at BSides Ljubjana 2016.

1. Introducing DET
(Data Exfiltration Toolkit)
Paul Amar - BSides Ljubjana - 09/03/2016

3. 100

5. General Approach
TCP
DNS
HTTP
ICMP
SMTP

6. General Approach
TCP
DNS
HTTP
ICMP
SMTP

7. General Approach
TCP
DNS
HTTP
ICMP
SMTP

8. General Approach
TCP
DNS
HTTP
ICMP
SMTP

9. General Approach
TCP
DNS
HTTP
ICMP
SMTP

10. General Approach
TCP
DNS
HTTP
ICMP
SMTP

11. HammerToss (July 2015)

12. What’s available today?

13. What’s available today?
And many more.. created
almost everyday.
Not kidding.

14. Current state
TCP
DNS
HTTP
ICMP
Twitter DMs
SMTP (eg. Gmail)

15. Introducing DET

16. Configuration file (JSON format)

17. File to exfiltrate

18. Folder to exfiltrate / multi-threaded

19. Plugin(s) to use

20. Plugin(s) to exclude

21. Server mode

22. Configuration file
List all your plugins and their configuration

23. Configuration file
Each plugin has its own configuration
(username, pwd, …)

24. Configuration file
Additional configuration (XOR Key, Sleeping time, …)

25. Let’s dig a bit (Client-side)

26. “Registration” phase 1/2

27. “Registration” phase 2/2

28. Sending the data 1/2

29. Sending the data 2/2

30. “End” phase 1/2

31. “End” phase 2/2

32. So in few words..

36. But wait! There’s moar.

37. Additional plugins (Tor Integration) 1/2
Source: http://foxglovesecurity.com/2015/11/02/hack-like-the-bad-guys-using-tor-for-
firewall-evasion-and-anonymous-remote-access/

38. Additional plugins (Tor Integration) 2/2

39. “Experimental” plugins

41. What’s next
- Port DET *entirely* to PowerShell (With Plugin based) (“Empire”-like)
- More plugins!
- Data obfuscation layer using Markov Chains
- https://github.com/bwall/markovobfuscate

44. Installation
Get/install it:
- git clone https://github.com/sensepost/DET
- pip install -r requirements --user (instal dependencies for the local user)
Client side:
- python det.py -f /etc/passwd -c ./config.json (or PS scripts)
Server side:
- python det.py -L -c ./config.json

45. sys.exit(0)
Paul Amar (paul@sensepost.com) / @PaulWebSec