In a situation the one described previously, organizations monitor the outgoing connection very closely so it is difficult to get access without getting detected. Fortunately, many organizations use cloud-based file sharing services from project execution to delivery. Their trust on these cloud-based file sharing services is often immovable. As a red teamer, we are going to exploit this trust so that we can get access in a far stealthier manner.
We are going to make the cloud-based file sharing service a middle-man to set up the communication playground between the target server and the Empire C2:
Assuming that the Empire C2 is properly installed and configured, we will be using Dropbox and Microsoft's OneDrive for the cloud-based file sharing C2.
