Hands-On Red Team Tactics

Data exfiltration via Empire

We have already learned about getting reverse shells on Empire and using Empire to achieve persistence on the system. The next step is data exfiltration.

Empire has a built-in module which allows us to upload the data directly on to Dropbox. This is very useful in situations in which IP whitelisting is done, as Dropbox is one of the domains that generally allows employee access.

Let's take a look at an example of how this module is used. We interact with our agent and run the command as shown as follows:

usemodule exfiltration/exfil_dropbox

To view the details of the module, we type the info command:

This ...