21.1 Staging and Exfiltration
Key Takeaways
- Domain 5 is 14 percent of PT0-003; objective 5.3 is scoped exfiltration to prove impact, not bulk PII theft — many rules of engagement allow only a filename list or a sample hash.
- Compress and encrypt the proof before it moves; encryption is not steganography, and crypto does not make an out-of-scope dump in-scope.
- Covert channels: HTTPS blends with ordinary web traffic on 443, DNS and ICMP ride protocols that still leave the network, and steganography hides bytes in a carrier file that still opens.
- Email, cloud storage, text storage sites, and cross-account resources are egress paths; a customer's already-public bucket is objective 4.6, not tester-operated 5.3 exfil.
- NTFS alternate data streams and virtual drive mounting are on-host staging, not network channels — the archive still has to leave through a channel you name.
On CompTIA PenTest+ PT0-003, Domain 5 is Post-exploitation and Lateral Movement (14 percent of the exam). Objective 5.3 is staging and exfiltration: after persistence (5.1) and lateral movement (5.2), prove that data you were authorized to touch can leave. 5.3 is not a license to steal a warehouse of personal data, and it is not objective 4.6 (a public customer bucket already readable from the Internet). It is you moving a scoped proof through a channel you chose.
Exfiltration proves impact. A finding that only says "we had Domain Admin" is weaker than "we could have sent payroll off-network." Stakeholders fund that sentence. The rules of engagement (RoE) still bind. Many RoE forbid bulk export of personal data. Testers take a filename list, a sample hash, a redacted header, or a row count — not forty thousand Social Security numbers. If the statement of work (SoW) says "demonstrate access to HR files," a SHA-256 of payroll.xlsx plus the UNC path is the proof. Emailing the workbook to a personal mailbox is a scope violation and often a legal one. Encryption does not make an out-of-scope dump in-scope.
File encryption and compression
File encryption and compression happen before the bytes leave the host. Compression (zip, 7-Zip, tar.gz) turns many files into one smaller blob so the transfer is shorter and less chatty on the wire. Encryption (AES-zip, GPG, an encrypted container) keeps the sample from sitting in cleartext on a proxy, a mail gateway, or a command-and-control (C2) log the client will later read. Identification: the stem says testers packed and encrypted files, then moved them. That pairing is staging, not the covert-channel bullet.
Order the exam wants:
- Select the minimum proof the RoE allows (path, hash, tiny sample).
- Compress so you move one archive.
- Encrypt so the archive is not cleartext personal data on the wire or in a paste.
- Then pick the channel.
Exam trap: encrypting a 20 GB dump because "crypto is always good." If RoE forbade bulk personal data, the dump is still forbidden. Trap two: compressing without encrypting, then attaching the zip to email or a text storage site — operators will read the names. Trap three: treating encryption as steganography. Encryption makes ciphertext. Steganography hides bytes in a carrier that still looks like a photo.
Covert channels: steganography, DNS, ICMP, and HTTPS
A covert channel is egress that does not look like a file copy. CompTIA names steganography, DNS, ICMP, and HTTPS.
Steganography hides payload bytes inside another file — classically an image, an audio clip, or a document someone might email or upload. The carrier still opens as a vacation photo. Identification: "hidden in an image," "the JPEG still displays." Pick stego when the stem is concealment in a carrier file. Do not pick it for a TLS session (that is HTTPS) or for an NTFS stream (that is alternate data streams).
DNS as a covert channel encodes data in queries or responses — long subdomain labels, TXT records — that resolvers forward because DNS is supposed to leave the network. Identification: unusual query volume, over-long labels, or TXT lookups to a zone the testers control. DNS often still works when HTTP proxies are locked. Exam trap: calling every nslookup from Domain 2 "exfil." Objective 2.1 used DNS for reconnaissance. 5.3 is data leaving through DNS. A single lookup of corp.example.com is reconnaissance, not a channel.
ICMP encodes data in ping payloads or other ICMP fields. Firewalls often allow echo "for troubleshooting." Identification: large or steady ICMP to an outside host during the window, sized for a payload. Trap: treating a one-packet ping sweep as exfil. Sweeping is discovery (2.1/2.2). A channel is ongoing and carries staged bytes.
HTTPS is the blend-in channel. Almost every enterprise allows outbound 443. TLS hides the body from casual inspection, so a POST to an outside host looks like ordinary web traffic. Identification: "testers sent the archive over 443 to blend with browser traffic." HTTPS is encrypted transport, not steganography. Trap: answering HTTPS because an image was attached to email — that may be stego-over-mail. Trap two: answering HTTPS for a DNS TXT channel because both use the Internet.
| Channel | What it does | When you pick it | Exam trap |
|---|---|---|---|
| HTTPS | TLS body blends with web | Outbound 443 is normal; hide the body | Not "bytes in a JPEG" |
| DNS | Data in queries or TXT | DNS leaves; HTTP is blocked or watched | Not 2.1 recon lookups |
| ICMP | Data in echo payloads | Ping allowed; other egress watched | Not a discovery sweep |
| Steganography | Hide in a carrier file | Image or audio still opens | Not zip or AES encryption |
Email, cloud storage, text storage sites, and cross-account resources
Not every egress is a tunnel. CompTIA also lists email, cloud storage, text storage sites, and cross-account resources.
Email is attaching or pasting the sample to a mailbox the testers control, or sending from a compromised mailbox to an outside address. Identification: SMTP, a webmail attach, "they mailed the zip to themselves." Mail gateways may inspect attachments — encrypt first. Trap: treating phishing (4.8) as 5.3 email exfil. 4.8 is how you get credentials. 5.3 is how data goes out.
Cloud storage is a Dropbox, Drive, OneDrive, S3, or similar location the testers can write from inside the network. Identification: an unexpected upload to a tester-controlled cloud. Data-loss-prevention products often watch these. Trap: calling a public customer bucket (4.6 exposed storage) "exfil." 4.6 is the customer's misconfiguration already readable from the Internet. 5.3 is the tester moving a proof through storage they chose.
Text storage sites (paste-style hosts, gist-like pads) take a small payload: a token, a hash list, a short file. Identification: "the tester pasted the sample to a text host." They are a poor place for bulk personal data and often violate RoE, but they are an official egress the exam wants named. Encrypt first. Prefer a private paste the engagement allows. Trap: pasting live employee records because "text sites are in scope for 5.3." The objective names the channel, not a waiver of privacy rules.
Cross-account resources are objects in another cloud or SaaS account the testers can reach: a second AWS account's bucket, a personal tenant, a collaborator drive. The screenshot may never show a laptop download; the object copies across an account boundary. Identification: "copied to an attacker-controlled cloud account." The exam distinction versus consumer cloud storage is the account boundary. Trap: treating 4.6 trust relationship abuse as 5.3. 4.6 is how you got the role. 5.3 is using a second account as the drop.
Alternate data streams and virtual drive mounting
Alternate data streams (ADS) are an NTFS feature. A file can hold extra named streams besides the default $DATA. Testers can stage an archive as report.pdf:payload.zip so Explorer still shows a PDF. Identification: Windows NTFS, a colon stream, "bytes were not in the default data stream." ADS is on-host staging, not a network channel. Linux ext4 does not provide NTFS ADS. Trap: calling ADS steganography. Stego hides in a JPEG's pixels. ADS is a filesystem fork. Trap two: calling ADS "exfil" by itself. The stream still sits on the host until a channel moves it.
Virtual drive mounting attaches an encrypted container or virtual disk (VHD/VHDX, an encrypted volume, an ISO, a RAM disk) as a drive letter or mount point. Testers write the sample into the volume, then unmount. The host sees a file; the proof lives inside the mounted container. Identification: "mounted a virtual disk, copied the sample in, dismounted." This is staging, often combined with encryption. Trap: calling every USB copy virtual-drive mounting. A physical USB stick is removable media, not a mounted virtual volume.
Worked corp.example.com path
Testers reached \\fs01\HR\payroll.xlsx on corp.example.com. RoE forbids exporting employee personal data. They record the UNC path, take a SHA-256, and compress plus encrypt a header-only sample the client pre-approved. Staging uses a mounted encrypted virtual disk so the sample is not sitting in Downloads; on NTFS they could also hide the archive in an ADS. For egress, outbound 443 is wide open — HTTPS is the blend-in channel. If 443 were blocked but DNS still left the network, they would name DNS. If ping were the only allowed outbound, ICMP. If the proof had to ride in a PNG the help desk already emails, steganography. If the only authorized drop was a second AWS account listed in the RoE, cross-account copy. They do not zip the whole workbook to a public text site, and they do not call a customer public bucket "our exfil."
Sequence: scope the proof (hash and filename, not bulk personal data) → compress and encrypt → stage (ADS or virtual drive) → choose the channel (covert DNS, ICMP, HTTPS, or stego; or email, cloud storage, text sites, or cross-account).
Testers need to move a scoped, encrypted sample off a Windows host. Outbound 443 is allowed and heavily used by browsers; HTTP proxies inspect cleartext. Which 5.3 method matches blending with ordinary web traffic?
Rules of engagement forbid bulk export of payroll personal data, but the test objective is to prove testers could reach payroll.xlsx. Which action is in-scope staging and exfiltration on PT0-003?
A Windows foothold uses NTFS. Testers want the staged archive invisible in an ordinary directory listing of report.pdf. Which 5.3 technique is that?