C2EXFIL

The C2EXFIL command sends a file to the Cloud C² server (if one is connected). This will appear on the Cloud C² dashboard.

Options

C2EXFIL takes one or two options:

When called with a single argument, the file is sent as a binary file to the Cloud C² server:

C2EXFIL /tmp/some-file
C2EXFIL /usb/logs/some-file

When called with the STRING argument, the file will be sent as a text file; this will enable viewing it live via the Cloud C² interface.

C2EXFIL STRING /tmp/some-file.txt
C2EXFIL STRING /usb/logs/some-other-file.txt

Experimenting

You can experiment using the C2EXFIL command live, either in the Web Shell in the web UI, or via ssh!

Using the C2EXFIL command in the Web Shell

Examples

#!/bin/bash

# Title: Cloud C2 Exfil Button
#
# Description: A simple payload that sends a file to Cloud C2 when a button is pressed

# Set the netmode to NAT, otherwise there is no connectivity at all
NETMODE NAT

# Set the LED to blinking cyan
LED C SINGLE

# Wait forever until the button is tapped
BUTTON

# Send /tmp/data to C2; we assume this file exists for some reason
C2EXFIL /tmp/data

# Set the LED to blink blue in a triple pattern
LED B TRIPLE