CloakifyFactory 1.0.3 – Data Exfiltration & Infiltration In Plain Sight

by do son · Published December 24, 2017 · Updated May 12, 2018

CloakifyFactory & the Cloakify Toolset – Data Exfiltration & Infiltration In Plain Sight; Evade DLP/MLS Devices; Social Engineering of Analysts; Defeat Data Whitelisting Controls; Evade AV Detection. Text-based steganography using lists. Convert any file type (e.g. executables, Office, Zip, images) into a list of everyday strings. Very simple tools, powerful concept, limited only by your imagination.

CloakifyFactory transforms any filetype (e.g. .zip, .exe, .xls, etc.) into a list of harmless-looking strings. This lets you hide the file in plain sight, and transfer the file without triggering alerts. The fancy term for this is “text-based steganography”, hiding data by making it look like other data. For example, you can transform a .zip file into a list of Pokemon creatures or Top 100 Websites. You then transfer the cloaked file however you choose, and then decloak the exfiltrated file back into its original form.

With your payload cloaked, you can transfer data across a secure network’s perimeter without triggering alerts. You can also defeat data whitelisting controls – is there a security device that only allows IP addresses to leave or enter a network? Turn your payload into IP addresses, problem solved. Additionally, you can derail the security analyst’s review via social engineering attacks against their workflows. And as a final bonus, cloaked files defeat signature-based malware detection tools.

The pre-packaged ciphers are designed to appear like harmless/ignorable lists, though some (like MD5 password hashes) is specifically meant as distracting bait.

CloakifyFactory is also a great way to introduce people to crypto and steganography concepts. It’s simple to use, guides the user through the process, and according to our kids is also fun!

Changelog v1.0.3

Added ‘rickrollYoutube’ cipher to baseline (list of shortened YouTube URLs, all pointing to videos of “Never Gonna Give You Up” performances and covers).

Download

git clone https://github.com/TryCatchHCF/Cloakify.git

Usage

$ ./cloakifyFactory.py

CloakifyFactory is a menu-driven tool that leverages Cloakify Toolset scripts. When you choose to Cloakify a file, the scripts first Base64-encode the payload, then apply a cipher to generate a list of strings that encode the Base64 payload. You then transfer the file however you wish to its desired destination. Once exfiltrated, choose Decloakify with the same cipher to decode the payload.

NOTE: Cloakify is not a secure encryption scheme. It’s vulnerable to frequency analysis attacks. Use the ‘Add Noise’ option to add entropy when cloaking a payload to help degrade frequency analysis attacks. Be sure to encrypt the file prior to cloaking if secrecy is needed.

The supporting scripts (cloakify.py and decloakify.py) can be used as standalone scripts. Very small, simple, clean, portable. For scenarios where infiltrating the full toolset is impractical, you can quickly type the standalone into a target’s local shell, generate a cipher in place, and cloakify -> exfiltrate.

Use py2exe if Windows target lacks Python. (http://www.py2exe.org/)

Prepackaged ciphers include lists of:

Amphibians (scientific names)
Belgian Beers
Desserts in English, Arabic, Thai, Russian, Hindi, Chinese, Persian, and Muppet (Swedish Chef)
Emoji
evadeAV (smallest cipher space, x3 payload size)
GeoCoords World Capitals (Lat/Lon)
GeoCaching Coordinates (w/ Site Names)
IPv4 Addresses of Popular Websites
MD5 Password Hashes
PokemonGo Monsters
Ski Resorts
Status Codes (generic)
Star Trek characters
Top 100 Websites
World Beaches
World Cup Teams