CIRCO v2 DEF CON 28 Safe Mode

• Python 3
• Modular Code
• New exfiltration method (FM)
• Support net-creds
• Capture VoIP RTP traffic (tapping phone calls)
• Capture SIP hash
• Spoof MAC/IP for exfiltration
• Support any TCP port for exfiltration

DEF CON 27 Release v1.5

• Allow existing IP-Phone to co-exist with CIRCO
• Eliminate template files (craft all packets)
• Support NTP exfiltration
• Software encrypted via Bluetooth (prevent forensic)
• Self destroy and alarm switch
• Bypass active & passive fingerprinting (NAC)
• Credentials integration into Faraday

BlackHat Asia 2019 Release v1.4

• Add Proxy Exfiltration (DHCP 252, WPAD, DNS Guessing)
• Include source IP as exfiltration fields (hex to dotted format)
• Replace switch template from 3850 to 2960 switch
• Add support for clients sending only \r (telnetd/sshd) instead \n\r
• Remove DHCP temp files
• Create Classes & Threading per exfiltration in carpa
• Remove _v1 from directory and programs
• Add Wiki section (Install/Usage/Hardware/Demo)

LLDP Support

• Add LLDP daemon as a IP-Phone/Switch and IOS command support
• Add random delay for exfiltration packets for DEBUG mode
• Include full path for config files

Initial release

• Bring CIRCO live into Github after AV Tokyo 2018 presentation