Feature Request: Stream Dump to S3

[JakePeralta7]

In addition to the stealth provided by streaming the dump to an S3 bucket, there are many instances where the memory size of the instance exceeds the available disk storage.

[SolitudePy]

it would be very useful if avml would support multipart upload using PUT without saving it to local disk first.

[BeanBagKing]

Found this while trying to solve the same problem. Working with devices that don't have a 'hard drive' to speak of and can't write the full memory locally. I'm not sure I'd want S3 specifically, I'd rather keep it vendor agnostic. If they did S3, someone would ask for Azure, someone else for Google Cloud.

Implementing an official way to send to stdout would probably be enough (it fails for me if I try to 'write' to /dev/stdout). That might be the most flexible and neutral option. I'd also support something like using websockets to stream it, and people could write or use whatever receiver they wanted. Websockets could allow for TLS and use standard web ports, making exfil secure and easy (maybe not stealthy though).

In any case, I do think this is a needed feature, in some form.

Streaming the data was brought up and closed as something unlikely to be implemented (2 years ago anyway) here #253

I did find that pipes worked, for anyone else that stumbles across this.

mkfifo /tmp/mem.pipe
nc remote_host 4444 < /tmp/mem.pipe & ./avml-aarch64 /tmp/mem.pipe
rm /tmp/mem.pipe

[demoray]

The latest version of avml supports a mechanism to directly stream to tcp without writing to local disk.

sudo ./avml stream tcp IP:PORT