Icmp File Transfer

Send files using ICMP as the transport protocol. (ICMP/IP)

A simple Proof of Concept to reliably transfer a file through ICMP

Usage:

  ./icmp.py recv <destination file> <remote address>
  ./icmp.py send <file to transfer> <remote address>

Commands

  recv: 
    Listens for ICMP packets and tries to assemble them into a file and store it
    on <destination file> path.
 
  send:
    Reads <file to transfer> and sends it to <remote address> using the ICMP/IP
    stack.

Description:

Icmp File Transfer is a simple tool to test if a network user can exfiltrate information without being noticed using ICMP.

It uses the data field of the ICMP ECHO REQUEST packets in order to hide this information.

Feature

Make reliable using sequence number (Added by Cyku)

Requirements

root privilege

Make sure the server can handle ICMP packet over 65000 Bytes.

If it can't, modify ICMP_PACKET_SIZE in ICMP/IcmpPacket.py to suit your environment.

root@server1:~# ping -s 65000 server2
PING server2 (<ip>) 65000(65028) bytes of data.
65008 bytes from server2 (<ip>): icmp_seq=1 ttl=55 time=206 ms
65008 bytes from server2 (<ip>): icmp_seq=2 ttl=55 time=205 ms
65008 bytes from server2 (<ip>): icmp_seq=3 ttl=55 time=204 ms

Enough RAM

The default size of window (buffer) for ICMP packet is 50. If your server doesn't have enough memory, modify self.window_size in ICMP/IcmpApp.py

Test

Only tested to transfer a 100M file from a server in America (server1) to a server in Singapore (server2).

You can speed up the transmission by telling the Operating System to stop replying to all ICMP packets.

root@server2:~# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
root@server2:~# cat /proc/sys/net/ipv4/icmp_echo_ignore_all
1

Make a 100M garbage file.

root@server1:~/icmp-file-transfer# dd if=/dev/urandom of=./file bs=1024 count=102400
root@server1:~$ ls -lah
total 101M
-rw-rw-r-- 1 root root 100M Feb 16 14:22 file

It costs about 26.082s to finish transmission in my environment.

Speed about 3.834 MB/s.

root@server1:~/icmp-file-transfer# time ./icmp.py send file server2
1616 / 1616

Finished

real    0m26.082s
user    0m21.854s
sys     0m0.519s

root@server2:~/icmp-file-transfer# time ./icmp.py send file server1
1616 / 1616

Finished

And the hashes of the files on both server are same.

root@server1:~/icmp-file-transfer# sha1sum file
8f5fe667b74c9e1fe9490f4ebfcbb00d32fdbf3a  file

root@server2:~/icmp-file-transfer# sha1sum file
8f5fe667b74c9e1fe9490f4ebfcbb00d32fdbf3a  file

Original author

Daniel Vidal de la Rubia.

Bugs

https://github.com/CykuTW/Icmp-File-Transfer/issues

akpotter / icmp-file-transfer Goto Github PK