News for hackers. Stuff that matters.
Re:Exfiltrating files with BusyBox by dfc on Monday October 03, 2016 @08:09PM (#12632413)
That was a let down. Is it really "exfiltration" when you use a protocol designed for mass data transfer and you use it in the exact manner it was intended to be used? The less linkbaity title is "Transferring files with BusyBox's ftp"
Re:Exfiltrating files with BusyBox by bitquark on Monday October 03, 2016 @08:22PM (#12632464)
The point of the post was to show how easy it is, as people seem to miss these commands or may not be aware of how easy it is to set up a listening service. It's exfiltration by definition, but you are of course free to mangle the data any way you want or use DNS techniques if you really care about hiding what you're doing, but that's a different post.
Re:Exfiltrating files with BusyBox by dfc on Monday October 03, 2016 @09:42PM (#12632764)
What is your definition of exfiltration? Or more importantly how do you distinguish between exfil and normal transfer by an authorized user?
Re:Exfiltrating files with BusyBox by comex on Tuesday October 04, 2016 @02:25AM (#12633658)
There are a lot of embedded devices with fairly trivial vulnerabilities that let you run arbitrary shell commands, but a limited enough set of available commands that getting data out, or doing anything else useful, is nontrivial. (Note that you may not even be able to see the stdout/stderr of the command.) This is showing one way to do that.
Re:Exfiltrating files with BusyBox by dfc on Tuesday October 04, 2016 @07:24AM (#12634723)
Yeah, this is showing one way to copy data from a computer using busybox's ftp client. Where is the surreptitious smuggling? I like my exfil to atleast have a hint of James Bond, MacGuyver, or Rube Goldberg; otherwise it's just copying files off a computer using the default file transfer tools.