forked from arschlochnop/hack_tools_for_me
-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathREADME
239 lines (174 loc) · 10.7 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
v0.1 Alpha version
_____
|_ _| _ _ __ _ __ __ _
| || | | | '_ \| '_ \ / _` |
| || |_| | | | | | | | (_| |
|_| \__,_|_| |_|_| |_|\__,_|
Tunna 0.1, for HTTP tunneling TCP connections by Nikos Vassakis
http://www.secforce.com / nikos.vassakis <at> secforce.com
################################################################################################################
High level Diagram:
+-------------------------------------------+ +-------------------------------------------+
| Local Host | | Remote Host |
|-------------------------------------------| |-------------------------------------------|
| +----------+ +------------+ | +-------------+ | +------------+ +----------+ |
| |Client App|+----->|Local Proxy |<==========| Firewall |======>| Webshell |+------>|Server App| |
| +----------+ +------------+ | +-------------+ | +------------+ +----------+ |
+-------------------------------------------+ +------------------------------------------ +
Technical Diagram:
+-------------------------------------------+ +-------------------------------------------+
| Local Host | | Remote Host |
|-------------------------------------------| |-------------------------------------------|
| | | |
| +-----------------+ | | +-----------------+ |
| | Local Proxy | | | | Web Shell (URL) | |
| |-----------------| | | |-----------------| |
| | +-------------+ | | | | | |
| | |HTTP encap. | | | HTTP Traffic | | +-----------+ | |
| | +------^------+ <=================================> |HTTP-->Sock| | |
| | | | | | | +-----+-----+ | |
| | +------+------+ | | | | | | |
| +-| Local Port |-+ | | +--------v--------+ |
| +------^------+ | | | |
| | | | | |
| +----------------+ | | | | +----------------+ |
| |Local Client | | | | +--------> Remote Service | |
| |----------------| | | | |----------------| |
| |Connect to local| | | | |Connection | |
| |Socket | | | | |received from | |
| | +--------+ | | |localhost | |
| | | | | | | |
| | | | | | | |
| +----------------+ | | +----------------+ |
+-------------------------------------------+ +-------------------------------------------+
SUMMARY
=======
TLDR: Tunnels TCP connections over HTTP
In a fully firewalled (inbound and outbound connections restricted - except the webserver port)
The webshell can be used to connect to any service on the remote host.
This would be a local connection on a local port at the remote host and *should* be allowed by the firewall.
The webshell will read data from the service port wrap them over HTTP and send it as an HTTP response to the
local proxy.
The local proxy will unwrap and write the data to its local port where the client program would be connected.
When the local proxy receives data on the local port, it will send them over to the webshell as an HTTP Post.
The webshell will read the data from the HTTP Post and put them on the service port
and repeat --^
Only the webserver port needs to be open (typically 80 - *not really tested over 443 SSL)
The whole communication (Externally) is done over the HTTP protocol
Theoretically (UNTESTED) the webshell can connect to any other remote host / remote service:
* There are some webserver limitations - not allowing external socket connections etc.
USAGE
======
ruby proxy.rb -u <remoteurl> -p <localport> -r <remote_service_port> [options]
or
python proxy.py -u <remoteurl> -p <localport> -r <remote_service_port> [options]
-u, --url URL url of the remote webshell
-l, --lport PORT local port of proxy
-r, --rport PORT remote port of service for the webshell to connect to
-q, --ping-interval NUM webshprx pinging thread interval (default = 0.5)
-a, --addr IP address for remote webshell to connect to (default = 127.0.0.1)
* -b, --buffer BUFF HTTP request size (some webshels have limitations on the size)
-s, --start-ping start the pinging thread first - some services send data first (SSH)
-v, --verbose verbose output - for debugging purposes
-h, --help Display this screen
* See limitations
example usage:
ruby proxy.rb -u http://10.3.3.1/conn.aspx -l 4444 -r 3389 -b 8192 -v
# This will initiate a connection between the webshell and Remote host RDP (3389) service
# The RDP client can connect on localhost port 4444
# This connection will be wrapped over HTTP
Prerequisites
=============
The ability to upload a webshell on the remote server
LIMITATIONS / KNOWN BUGS / HACKS
================================
This is a POC code and might cause DoS of the server.
All efforts to clean up after execution or on error have been made ... but no promises
Based on local tests:
* JSP buffer needs to be limited (buffer option):
4096 worked in Linux Apache Tomcat
1024 worked in XAMPP Apache Tomcat (slow)
* More than that created problems with bytes missing at the remote socket
eg: ruby proxy.rb -u http://10.3.3.1/conn.jsp -l 4444 -r 3389 -b 1024 -v
* Sockets not enabled by default php windows (IIS + PHP)
* Return cariages on webshells (outside the code):
get sent on responses / get written on local socket --> corrupt the packets
* PHP webshell for windows: the loop function DoS'es the remote socket:
sleep function added -> works but a bit slow
FILES
=====
Webshells:
conn.jsp Tested on Apache Tomcat (windows + linux)
conn.aspx Tested on IIS 6+8 (windows server 2003/2012)
conn.php Tested on LAMP + XAMPP + IIS (windows + linux)
Proxies:
proxy.rb Tested with ruby 1.9.2
proxy.py Tested with Python 2.6.5
Technical Details
=================
Architecture descisions
-----------------------
Data is sent raw in the HTTP Post Body (no post variable)
To save a couple of bytes
Instructions / configuration is sent to the webshell as URL parameters (HTTP Get)
Data is sent in the HTTP body (HTTP Post)
Websockets not used: Not supported by default by most of webservers (Maybe futrure dev)
Asyncronous HTTP responses not really possible
Proxy queries the server constantly (default 0.5 seconds)
INITIATION PHASE
----------------
1st packet initiates a session with the webshell - gets a cookie back
eg: http://webserver/conn.ext?proxy
2nd packet sends connection configuration options to the webshell
eg: http://webserver/conn.ext?proxy&port=4444&ip=127.0.0.1
IP and port for the webshell to connect to
This is a threaded request:
In php this request will go into an infinate loop
to keep the webshell socket connection alive
In other webshells [OK] is received back
PROXY
-----
A local socket is going to get created where the client program is going to connect to
Once the client is connected the pinging thread is initiated and execution starts.
Any data on the socket (from the client) get read and get sent as a HTTP Post request
Any data on the webshell socket get sent as a response to the POST request
PINGING THREAD
--------------
Because HTTP responses cannot be asyncronous.
This thread will do HTTP Get requests on the webshell based on an interval (default 0.5 sec)
If the webshell has data to send, it will (also) send it as a reply to this request
Otherwise it sends an empty response
In general:
Data from the local proxy get send with HTTP Post
There are Get requests every 0.5 sec to query the webshell for data
If there is data on the webshell side get send over as a response to one of these requests
WEBSHELL
--------
The webshell connects to a socket on the local or a remote host.
Any data written on the socket get sent back to the proxy as a reply to a request (POST/GET)
Any data received with a post get written to the socket.
NOTES
-----
All requests need to have the URL parameter "proxy" set to be handled by the webshell
(http://webserver/conn.ext?proxy)
AT EXIT / AT ERROR
------------------
Kills all threads and closes local socket
Sends proxy&close to webshell:
Kills remote threads and closes socket
COPYRIGHT & DISCLAIMER
======================
Tunna, TCP Tunneling Over HTTP
Nikos Vassakis
Copyright (C) 2013 SECFORCE.
This tool is for legal purposes only.
This program is free software: you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by the
Free Software Foundation, either version 3 of the License, or (at your
option) any later version.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
Public License for more details.
You should have received a copy of the GNU General Public License along
with this program. If not, see <http://www.gnu.org/licenses/>.