The last thing you want to do in a penetration test is make it difficult to transfer the data over that newly formed stunnel tunnel. Because of this, having a tool you can run that will just copy the files over your request is key. In my case, I tend to use a script that will send the files over to the correct directory on my C&C server. We can run this script whenever we have evidence to move over.
My default setup on the Raspberry Pi and C&C server is as follows. Feel free to change the directories to whatever works best for you:
- On the internal server (Raspberry Pi), create the evidence folder in /var and, within this directory, create a file called LOG. Make sure that the log file is writable:
- Now that the evidence directory is all set, we just need to create the script. I placed the script in /root/scripts on the Raspberry Pi. After...
