Share Files

Setup Shared folder

There might come times when I’ll need to transfer some files to the REMnux machine. For that, I’ll share a local folder of my host to be accessible from my REMnux machine.

Caution

I am doing this because I plan on using this REMnux VM only for analysis. I will be running the malwares on different victim machines, like the FlareVM setup I have currently, or some other machines that I might include in my isolated network later.

One should NEVER setup a shared folder on a victim machine. Malwares spread like wildfire and are very dangerous. Doing this might kill the host.

To set up the shared folder:

• Go to VM settings
• Options tab > Shared folders > Set to always enabled
• Set the host path for the shared folder

Now on the REMnux machine, I can see the shared folder under /mnt/hgfs.

remnux@remnux:~$ ls /mnt/hgfs
malware-analysis-remnux-share

Transfer Files to victims

To transfer files to a machine such as FlareVM where I’ll run malware samples, I can serve the file using two ways.

Using INetSim

To use INetSim to serve the specific file to the victim:

From the default inetsim.conf file, I can set the http_fakefile values as instructed.

#########################################
# http_fakefile
#
# Fake files returned in fake mode based on the file extension
# in the HTTP request.
# The fake files must be placed in <data-dir>/http/fakefiles
#
# Syntax: http_fakefile <extension> <filename> <mime-type>
#
# Default: none
#
http_fakefile           txt     sample.txt      text/plain
http_fakefile           htm     sample.html     text/html
http_fakefile           html    sample.html     text/html
http_fakefile           php     sample.html     text/html
http_fakefile           gif     sample.gif      image/gif
http_fakefile           jpg     sample.jpg      image/jpeg
http_fakefile           jpeg    sample.jpg      image/jpeg
http_fakefile           png     sample.png      image/png
http_fakefile           bmp     sample.bmp      image/x-ms-bmp
http_fakefile           ico     favicon.ico     image/x-icon
http_fakefile           exe     sample_gui.exe  x-msdos-program
http_fakefile           com     sample_gui.exe  x-msdos-program

The files should be placed under data/http/fakefiles for INetSim to be able to access it each time I run the service.

Using netcat

On linux machines, netcat can be utilized to communicate a file.

On the receiving machine:

nc -lvp SERVING_PORT > file.exe

On the sending machine:

cat FILE_TO_TRANSFER.exe | nc RECEIVING_MACHINE_IP SERVING_PORT