0003771: CloakifyFactory - Kali Linux Bug Tracker

ID	Project	Category	View Status	Date Submitted	Last Update

0003771	Kali Linux	New Tool Requests	public	2016-12-13 01:17	2020-02-11 16:18

Reporter	TryCatchHCF	Assigned To	g0tmi1k
Priority	normal	Severity	feature	Reproducibility	N/A
Status	closed	Resolution	won't fix

Summary	0003771: CloakifyFactory
Description	Hi Kali Team, For your consideration: https://github.com/TryCatchHCF/Cloakify I created CloakifyFactory to share an old technique of mine with the community. There's a gap in infiltration/exfiltration tools, particularly when secure networks are involved (data blacklisting and whitelisting controls). This toolset bypasses those restrictions and other DLP alerting/blocking schemes. I wrote CloakifyFactory to be as straightforward and reliable as possible. After cloaking/decloaking, the payload is an exact hash-match of the original. I also wanted to make it a little fun. Thanks for your time and efforts. Cheers, -TryCatchHCF
Additional Information	From the GitHub Overview: CloakifyFactory transforms any filetype (e.g. .zip, .exe, .xls, etc.) into a list of harmless-looking strings. This lets you hide the file in plain sight, and transfer the file without triggering alerts. The fancy term for this is "text-based steganography", hiding data by making it look like other data. For example, you can transform a .zip file into a list of Pokemon creatures or Top 100 Websites. You then transfer the cloaked file however you choose, and then decloak the exfiltrated file back into its original form. With your payload cloaked, you can transfer data across a secure network’s perimeter without triggering alerts. You can also defeat data whitelisting controls - is there a security device that only allows IP addresses to leave or enter a network? Turn your payload into IP addresses, problem solved. Additionally, you can derail the security analyst’s review via social engineering attacks against their workflows. And as a final bonus, cloaked files defeat signature-based malware detection tools. The pre-packaged ciphers are designed to appear like harmless / ignorable lists, though some (like MD5 password hashes) are specifically meant as distracting bait. CloakifyFactory is also a great way to introduce people to crypto and steganography concepts. It's simple to use, guides the user through the process, and according to our kids is also fun! Prepackaged ciphers include lists of: `Amphibians (scientific names) Belgian Beers Desserts in English, Arabic, Thai, Russian, Hindi, Chinese, Persian, and Muppet (Swedish Chef) Emoji evadeAV (smallest cipher space, x3 payload size) GeoCoords World Capitals (Lat/Lon) GeoCaching Coordinates (w/ Site Names) IPv4 Addresses of Popular Websites MD5 Password Hashes PokemonGo Monsters Ski Resorts Status Codes (generic) Star Trek characters Top 100 Websites World Beaches World Cup Teams` Prepackaged scripts for adding noise / entropy to your cloaked payloads: `prependEmoji.py: Adds a randomize emoji to each line prependID.py: Adds a randomized ID tag to each line prependLatLonCoords.py: Adds randomized LatLong coordinates to each line prependTimestamps.py: Adds timestamps (log file style) to each line`

g0tmi1k 2018-01-29 14:46 administrator ~0008368	To help speed up the process of evaluating the tool, please make sure to include the following information (the more information you include, the more beneficial it will for us): [Name] - The name of the tool [Version] - What version of the tool should be added? --- If it uses source control (such as git), please make sure there is a release to match (e.g. git tag) [Homepage] - Where can the tool be found online? Where to go to get more information? [Download] - Where to go to get the tool? [Author] - Who made the tool? [Licence] - How is the software distributed? What conditions does it come with? [Description] - What is the tool about? What does it do? [Dependencies] - What is needed for the tool to work? [Similar tools] - What other tools are out there? [How to install] - How do you compile it? [How to use] - What are some basic commands/functions to demonstrate it?

TryCatchHCF 2018-02-14 05:10 reporter ~0008673	(Realized I'd made those replies private, reposting so others on team can view) [Name] - Cloakify Toolset [Version] - v1.0.1 [Homepage] - https://github.com/TryCatchHCF/Cloakify [Download] - https://github.com/TryCatchHCF/Cloakify [Author] - TryCatchHCF (Joe Gervais) [Licence] - MIT License [Description] - CloakifyFactory & the Cloakify Toolset employs text-based steganography using lists, converting any file type (e.g. executables, Office, Zip, images) into a list of everyday strings. Operational use cases include: Data Exfiltration & Infiltration; Evading DLP/MLS Devices; Social Engineering of Analysts; Defeating Data Whitelisting Controls; and Evading AV Detection. CloakifyFactory transforms any filetype (e.g. .zip, .exe, .xls, etc.) into a list of harmless-looking strings. This lets you hide the file in plain sight, and transfer the file without triggering alerts. For example, you can transform a .zip file into a list of Pokemon creatures or Top 100 Websites. You then transfer the cloaked file however you choose, and then decloak the exfiltrated file back into its original form. My favorite combination is to use the 'pokemonGo' cipher, then Add Noise 'prependLatLonCoords'. Move it around your DLP-protected networks. Get a copy into the SOC's hands and see what the analysts do with it. Adds color to the pentest / Red Team engagement report afterwards. With your payload cloaked, you can transfer data across a secure network’s perimeter without triggering alerts. You can also defeat data whitelisting controls - is there a security device that only allows IP addresses to leave or enter a network? Turn your payload into IP addresses, problem solved. Additionaly, you can derail the security analyst’s review via social engineering attacks against their workflows. And as a final bonus, cloaked files defeat signature-based malware detection tools. The pre-packaged ciphers are designed to appear like harmless / ignorable lists, though some (like MD5 password hashes) are specifically meant as distracting bait. CloakifyFactory is a menu-driven tool that leverages the Cloakify Toolset scripts. When you choose to Cloakify a file, the scripts first Base64-encode the payload, then apply a cipher to generate a list of strings that encodes the Base64 payload. You then transfer the file however you wish to its desired destination. Once exfiltrated, choose Decloakify with the same cipher to decode the payload. NOTE: Cloakify is not a secure encryption scheme. It's vulnerable to frequency analysis attacks. Use the 'Add Noise' option to add entropy when cloaking a payload to help degrade frequency analysis attacks. Be sure to encrypt the file prior to cloaking if secrecy is needed. The supporting scripts (cloakify.py and decloakify.py) can be used as standalone scripts. Very small, simple, clean, portable. For scenarios where infiltrating the full toolset is impractical, you can quickly type the standalone script into a target’s local shell, generate a cipher in place, and cloakify -> exfiltrate. [Dependencies] - Python 2.7+ [Similar tools] - None, really. Most steganograpy tools embed data in images. Most exfil tools obfuscate the data in a manner that clearly indicates obfuscation, and/or use obscure methods of data transport for final exfil (e.g. DNS queries). Cloakify was written to hide and transfer data in plain sight, in text/string format. Cloakify is also the only tool in its class that can defeat data whitelisting controls across secure network boundaries. [How to install] - Download and uncompress. The python scripts are ready to execute. [How to use] - CloakifyFactory.py is the menu-driven script that guides you through the process of cloakifying / decloakifying files. $ ./cloakifyFactory.py You can check the resulting cloaked files with any text editor for curiosity. Cloakify Factory will also give you the option of displaying the first 20 lines of any cloaked file (to check your results without exiting the tool or requiring a second shell). The supporting scripts can be used individually as stand-alone as well, but there aren't many operational scenarios where that would be preferable. Please let me know if you want more info, I'll get back with it ASAP. Thanks! Cheers, -TryCatchHCF

g0tmi1k 2020-02-11 16:18 administrator ~0012244	This looks like its python 2 - which is EOL

Date Modified	Username	Field	Change
2016-12-13 01:17	TryCatchHCF	New Issue
2018-01-29 14:46	g0tmi1k	Note Added: 0008368
2018-02-14 05:10	TryCatchHCF	Note Added: 0008673
2020-02-11 16:18	g0tmi1k	Note Added: 0012244
2020-02-11 16:18	g0tmi1k	Assigned To	=> g0tmi1k
2020-02-11 16:18	g0tmi1k	Status	new => closed
2020-02-11 16:18	g0tmi1k	Resolution	open => won't fix