Exfiltrating files with BusyBox • Hacker News Board

Re: Exfiltrating files with BusyBox

#21

Post by micro_softy » Tue, Oct 04, 2016, 3:08 AM UTC

na85 wrote: post #9

netsec_burn wrote: post #6

Earlier quoted context omitted.

Much the other way around. Netcat is ubiquitous. I haven't come across many systems with ftpput and ftpget. Neat challenge left as an exercise to the reader: whois can be used to transfer files too. :)

>whois can be used to transfer files too. Ah, the old DNS-tunnelling trick. A fun way to flip cheap hotels the bird.

He is suggesting something much easier and different from DNS.

WHOIS is one of the simplest internet protocols. The RFC is beautifully short. Unlike DNS, there's no rules on sizes of requests or responses, and it uses TCP by default.

His suggestion deserves an upvote for its simplicity, elegance.

Re: Exfiltrating files with BusyBox

#22

Post by pbnjay » Tue, Oct 04, 2016, 5:14 AM UTC

I had to get some files off/on a hacked device over a serial port (networking was broken). Luckily the BusyBox included uuencode/decode so I didn't have to get too extreme.

"Exfiltrating" implies a covert action... Using ftp is kinda obvious!

Re: Exfiltrating files with BusyBox

#23

Post by comex » Tue, Oct 04, 2016, 6:25 AM UTC

dfc wrote: post #14

That was a let down. Is it really "exfiltration" when you use a protocol designed for mass data transfer and you use it in the exact manner it was intended to be used? The less linkbaity title is "Transferring files with BusyBox's ftp"

There are a lot of embedded devices with fairly trivial vulnerabilities that let you run arbitrary shell commands, but a limited enough set of available commands that getting data out, or doing anything else useful, is nontrivial. (Note that you may not even be able to see the stdout/stderr of the command.) This is showing one way to do that.

Re: Exfiltrating files with BusyBox

#24

Post by dfc » Tue, Oct 04, 2016, 11:24 AM UTC

comex wrote: post #23

dfc wrote: post #14

That was a let down. Is it really "exfiltration" when you use a protocol designed for mass data transfer and you use it in the exact manner it was intended to be used? The less linkbaity title is "Transferring files with BusyBox's ftp"

There are a lot of embedded devices with fairly trivial vulnerabilities that let you run arbitrary shell commands, but a limited enough set of available commands that getting data out, or doing anything else useful, is nontrivial. (Note that you may not even be able to see the stdout/stderr of the command.) This is showing one way to do that.

Yeah, this is showing one way to copy data from a computer using busybox's ftp client. Where is the surreptitious smuggling? I like my exfil to atleast have a hint of James Bond, MacGuyver, or Rube Goldberg; otherwise it's just copying files off a computer using the default file transfer tools.