PAYLOAD: ICMP Data Exfiltration - USB Rubber Ducky/Exfiltration [PAYLOAD MINUTE]

Delving into the ICMP Data Exfiltration payload by TW-D for the USB Rubber Ducky, this time on [PAYLOAD MINUTE]
Payloads → payloads.hak5.org
____________________________________________
Hak5: Cyber Security Education, Inspiration & Community since 2005.
____________________________________________
Shop → hakshop.myshopify.com/
Subscribe → ua-cam.com/users/Hak5Darr...
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community - where all hackers belong.

[@drexalOS]

I tried this. There's now a van with "Flowers By Irene" parked outside me house... how long does it take to deliver flowers?

[@blackthorne-rose]

[@batica81]

Ha didn't know about space before command trick, quite fun! Btw I don't know what are you doing with video encoding/colors but it now has some 90s vibe which looks cool! :)

[@atajahangiri5861]

VERY very GOOD video

[@repairstudio4940]

Thnx Darren! 🎉

[@JonMurray]

Awesome man!

[@LinedRogue]

Thank you 👍

[@Angelinajolieshorts]

Great content creator

[@klamberext]

Interesting method

[@kevinwetsch5209]

Fascinating

[@DavidStringham]

Would be nice to have a link to the actual payload to see what it actually does and maybe try it out.

[@iblackfeathers]

a variant of this technique was presented at a very early toorcon in san diego and at defcon 10… called icmp moonbounce

[@catatonicprime]

There's an entire ICMP overlay network, called Project Loki, described in phrack 49-6 too. And implementation discussed in phrack 51-6. ICMP is very cool for bypassing firewalls and the like and this payload could be reshaped to send much larger fragments at a time.

[@iblackfeathers]

@@catatonicprimeagreed.

[@rationalbushcraft]

very cool. Can we do the same thing with DNS on a windows machine. Be good to get authentication tokens this way.

[@DavidStringham]

DNS tunneling is a well-known technique.

[@gilbertbergh8980]

Looks alot like the exfil with the dns protocol.

[@Westmadeit]

Can it be done on windows 10 and 11?

[@kjrholmf472]

how to i change keyboard layout

[@himanshuthakur9205]

U removed video!?

[@1980cantrell]

I tried this and it was all in the logs.

[@shephusted2714]

having it use tor would be nice, combine it with evercookie and store it in 7 places would be another session grabber, putting it on mbr part or in ufei areas could make it more resilient like logofail, lastly make it immutable with a flag switch to harden it a bit more #idle chattr

[@toto99303]

IPS firewalls will catch this as the signature is clear.

[@DarrenKitchen]

that's good to hear. would encrypting the data before transmission help, or is it that there's any extra data in the ICMP packet as compared to what modern machines send?

[@toto99303]

@@DarrenKitchen the extra data, and basically the way they re-assemble the payload as they scan the icmp replies should be enough to catch it.

[@CoinJarMusicVideos]

A more effective approach involves synchronizing clocks and transmitting a standard ping packet within a designated time frame to convey a single bit's status. While this method may be slower, it significantly enhances the difficulty of detection and decoding, making it challenging for anyone to discern what's going on beyond a typical ping.

[@DavidStringham]

I would try hex-encoding the data and using the output values to vary the size of the ICMP packets.

[@fancy_bread5959]

hi

[@Secret-Robot]

Ping!

[@humanxoxo4]

Patrick Bateman