How FIN6 Exfiltrates Files Over FTP

Item: How FIN6 Exfiltrates Files Over FTP
Rating: 4
Author: PostSingularity Institute

by HackerSploit · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity URComputer security URHComputer fraud and hacking

🎙 HackerSploit 👥 1.0M 📅 April 9, 2025 ⏱ 24 min 👁 19K 📄 tutorial 🧭 2026-10-09

Available in: English (current) Français

Keywords

FIN6adversary emulationvolume shadow copyNTDS.ditFTP exfiltration

Summary

This is the final episode of HackerSploit’s FIN6 adversary emulation mini-series, continuing from a prior video where initial access and Active Directory enumeration had already been performed. The presenter resumes from a staged set of enumerated text files in the public user’s home directory and walks through privilege escalation using a Metasploit UAC bypass (COM hijack) module. Because the module lacked an explicit architecture definition, he edits the Ruby module file to add x86/x64 support, reloads it, and obtains an elevated 64-bit Meterpreter session on the Windows Server 2019 domain controller. With elevated privileges, he creates a volume shadow copy of the C: drive, copies out NTDS.dit and the SYSTEM registry hive, and saves the HKLM\SYSTEM hive via reg save. He then deletes the shadow copy quietly for stealth. Next, he archives the collected files with a renamed 7-Zip executable (7.exe) using the AD prefix wildcard, producing AD.7zip. For exfiltration, since the original plan did not specify the web-service transfer procedure, he substitutes FTP: a Python pyftpdlib server is started on Kali Linux, and a Windows FTP script (ftp.txt) is built with open, user, password, put and bye commands, then executed with ftp -s. The archive is successfully transferred and verified on both sides. The video closes by announcing the next series on APT29.

214 words

Critical Evaluation

Value of the Information & Strength of the Argument

The informational value lies in the concrete, end-to-end demonstration of a realistic post-compromise workflow: privilege escalation, credential/registry collection via volume shadow copy, staging, archiving and exfiltration. Each step is shown live with the actual commands, error messages and fixes, which is more instructive than a purely conceptual explanation. The presenter explicitly justifies deviations from the emulation plan, notably the choice of a UAC bypass over the plan’s macro-with-elevated-privileges approach, arguing the former is a more realistic privilege escalation vector. He also explains why he modifies the Metasploit module rather than switching payloads, and why he substitutes FTP when the plan left the transfer procedure unspecified. The argumentation is therefore transparent about assumptions and substitutions. Its weakness is that the reasoning stays at the level of tool operation: there is little discussion of detection opportunities, defensive countermeasures, or how closely the emulated chain maps to documented FIN6 behavior beyond the archiving and exfiltration steps.

Scientific Rigor, Source Quality, Title Accuracy

The only substantive external reference is the CTID Adversary Emulation Library on GitHub, which is the authoritative source for the FIN6 emulation plan being followed; the lab platform (Cyber Ranges) provides the environment. No primary threat-intelligence report on FIN6 is cited, and claims about FIN6 behavior (renamed 7-Zip as 7.exe, AD-prefixed archives, plink.exe, web-based exfiltration) are asserted from the emulation plan rather than sourced directly. The title/content fit is good: FTP exfiltration is the culminating demonstration, though it occupies only the final portion of the video. The presenter is careful to flag what is and is not part of the plan, which supports rigor. No comments were provided for analysis.

278 words

Title / Content Match

The title accurately reflects the content: the video demonstrates FIN6-style file exfiltration over FTP, though it also covers privilege escalation, volume shadow copy, NTDS/registry collection and archiving before reaching the FTP step.

Quality & Reliability

7/10

The video is a hands-on walkthrough of a documented adversary emulation plan (FIN6) using the CTID Adversary Emulation Library as its reference. The presenter is transparent about deviations from the plan (e.g., not using the macro-with-elevated-privileges path, modifying a Metasploit module to support x64 payloads, substituting FTP for the unspecified web-service exfiltration). Technical steps are shown live and reproducible in a lab environment. Reliability is limited by the absence of citations to primary threat-intelligence reports on FIN6 and by the fact that the emulation is a simplified adaptation rather than a verbatim reproduction of observed FIN6 tradecraft.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

CTID Adversary Emulation Library — The reference library containing the FIN6 emulation plan followed throughout the series.
Cyber Ranges platform — Platform hosting the lab environment (Kali Linux attacker and Windows Server 2019 domain controller) used for the demonstration.

Concurring Sources

MITRE ATT&CK — FIN6 — Corroborates FIN6's use of collection, archiving and exfiltration techniques consistent with the emulation plan.
CTID Adversary Emulation Library — The plan itself, which the video follows and adapts.

External References

Contribution & Novelties

The video’s contribution is a complete, reproducible walkthrough of the tail end of the FIN6 emulation plan, from privilege escalation through exfiltration, including practical fixes for real-world friction such as the Metasploit module architecture limitation. It also documents a deliberate substitution: because the emulation plan did not specify the web-service transfer procedure, the author demonstrates FTP exfiltration instead, showing how to script the interactive Windows FTP client non-interactively. This makes it a useful complement to the written emulation plan for practitioners building their own labs.

Pour aller plus loin :

MITRE ATT&CK — FIN6 group page (https://attack.mitre.org/groups/G0037/ ) — Documents the threat actor’s known techniques, including collection and exfiltration.
Volume Shadow Copy Service (https://en.wikipedia.org/wiki/Shadow_Copy ) — Background on the snapshot mechanism abused to copy locked files such as NTDS.dit.
MITRE ATT&CK technique T1048 — Exfiltration Over Alternative Protocol (https://attack.mitre.org/techniques/T1048/ ) — Frames the FTP transfer demonstrated here within the ATT&CK taxonomy.
pyftpdlib documentation (https://pyftpdlib.readthedocs.io/ ) — The Python library used to stand up the FTP server on Kali Linux.
Metasploit UAC bypass modules — Concept relevant to the privilege escalation step, cited by name rather than URL.

187 words

Radar Profile

The profile is strong on technical depth and information quantity, reflecting a dense, command-level demonstration. Reliability and information quality are solid but capped by reliance on a single emulation-plan source and limited discussion of detection or defensive context. Overall it reads as a practical, well-executed tutorial rather than an analytical or research-grade treatment.

Reliability 7/10