Skip to content

rbrins/dock-worker

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

12 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Dock Worker

Overview

See post at dc864 that describes the proof of concept.

Idea is to use docker hub as a repository to exfiltrate data, using containers. This could be epsecially useful in a devops environment that relies on docker.

Note: this is strictly a Proof-of-concept and has not been seen in the wild to my knowledge. To operationalize this for your red teaming exercise, add your docker hub credentials, create a repository on docker hub (and probably should be private if you are doing this for a client), then unpload the load function onto the victim machine, and the unload function for the attacker machine.

Future Development

While this started out as a python proof-of-concept for a MITRE ATT&CK specific sub-technique, I’m looking at making this a more robust tool for exfiltration.

WONT DO Weigh pros/cons to refactoring to Golang or using HTTP api from something like Nim

With the recent controversies around Golang and google potentially adding telemetry, No to Go; just not within my risk tolerance to also need to keep up with whether Google adds it to Golang or not. Would rather use a project this isn’t considered a worry.

Add encryption of data being exfiltrated as default option

Add other exfiltration channels and techniques instead of just exfil through code repo

Resources

About

exfiltration using docker, docker hub, and containers

Resources

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages