Authors: Nathan Yam, Jonathan Kartawidjaja
ICMP data exfiltration is a technique in which attackers embed arbitrary data into the data segment of ICMP packets, then them over to their own machines or servers.
For additional context, ICMP is the protocol that controls network diagnostic tools, such as ping and traceroute.
ICMP data exfiltration can go unnoticed because the protocol is used often by network administrators and is not necessarily malicious by default.
In order to extract the ICMP data segments within the traffic, we may decide to either use wireshark for manual extraction or tshark for a cleaner output. This writeup will utilize tshark, as it is exponentially faster than wireshark for this purpose.
The following query will extract all data segments of ICMP packets within the PCAP file:
tshark -r capture.pcap -Y "icmp" -T fields -e data.data
Below is part of the output:
31363a3838
31363a3838
32323a3532
32323a3532
32383a313235
32383a313235
31343a3935
31343a3935
31313a3532
31313a3532
32363a3633
32363a3633
32333a313136
32333a313136
32353a3638
32353a3638
313a3637
313a3637
393a3935
393a3935
323a3833
323a3833
31373a313032
31373a313032
31393a313038
31393a313038
32373a3333
32373a3333
... #more output
Judging from the character set, it appears to be a list of hexadecimal values. We can try decoding these characters in cyberchef, however the results will be rather messy. Therefore we will be using an additional formula in the tool.
Link to recipe: https://gchq.github.io/CyberChef/
