Hi, and welcome back to Section 12 tunneling through a network.
In this video, you'll learn how to perform H T D P tunneling.
I hope you're excited. So, Letson, in this scenario,
we'll be using this topology design.
We don't need to make any further modifications to our current lab
topology. However, we are creating a scenario in this scenario,
our taco machine, which is our main Carly machine,
it is on the internet and we have successfully compromised a
Lenox machine within a company,
which is this one which says compromised Lenox machine.
The thing is, the Compromise Lenox machine has access to the internet.
Hence we are able to have a shell between the Compromise Lenox machine
and our attack machine. But if we were to, let's say,
perform additional scans and exploitation to other systems on the internal,
on the internal network,
these internal systems may not have direct internet access. For instance,
metal exploitable tree do not have internet access.
Perhaps it has been blocked by a firewall or some other device.
But the compromised OX machine has direct connectivity to the Meta Exploitable
tree machine.
The objective is to set up an each T D P tunnel between
our attack machine to the Compromise System and from the Compromise System to
the Meta Exploitable tree machine. Therefore,
if we have to transfer any tools between one system to another system,
it'll reduce the need to transfer tools from Theta Machine to the compromised
system then to the meta exploitable system,
we want to establish direct connectivity from Theta machine
straight to Meta Tree Windows virtual machine. To get started,
we'll definitely need to create an additional Carli Lenox virtual machine.
So I'm simply going to delete my clone machine that I had created earlier today.
And let's start by creating a clone version or Carli Lenox virtual machine.
Simply right click on it, click on clone,
click on full clone current machine state,
and let's change the market address policy to generate new market addresses
for all network adapters.
And click on this clone machine will function as a compromise
machine on the internal network.
So we can simply adjust the name to let's say Compromise
Lenox vm. And let's click on clone.
This will take a few minutes, so perhaps a few seconds to complete.
Once this is complete, we can simply power on this virtual machine.
Keep in mind this clone machine will be our compromise system on
the internal network,
which has access to meta exploitable tree windows virtual machine.
Great. So we have the clone machine.
You can simply power on the meta exploitable tree windows, which machine,
and let's capture the IP address.
You can simply hover on a network icon and you can see the internal IP address
as 1 7 2 31 20.
Let's power on our Compromise Lenox virtual machine.
Let's say the start button and once the virtual machine is powered on,
let us update the packages Source repository ands installed
H TT P tunnel package three.
Let's log in.
And since this compromised launch machine has internet access,
let's open a terminal to update the packages repository and then
we'll install the H T D P tunnel two.
So let's do pseudo app update and enter.
Enter your password like so. Alicia, take a few seconds to complete.
Great. Next, let's install the H T D P tunnel tool.
This tool is needed on border compromise system and our attacker system.
Great. We'll need to bill a tunnel,
specifically a local S port forwarding between our
compromised OX machine and our target Windows system.
Since our target Windows system is running the remote desktop protocol,
the protocol doesn't really matter to put simply.
So while we are on the Compromise Lenox system,
let us enable S SSH to do this,
we can simply type pseudo service
s SSH and let's type start.
Great to verify this service is running,
let's type SS space dash A NT P
grab will specify port 22 to verify our system
is listing on port 22. Excellent. Next,
we'll need to actually establish a local port base holding.
To do this on the compromise system,
we are going to type SSH dash capital L
0 0 0 0.
Let's use 8 8 88.
Next we will specify the IP address of for Target,
which is a Windows virtual machine, the ip, it's
1 7 2 31 8
and we'll specify the port for rdp,
which is 3 3 89.
Next we need to specify our local credentials for our
Carly Links virtual machine.
We'll specify Carly at and we'll specify the LU Park IP
address,
which is 1 2 7 0 0 1 let's
it enter. And now we are trying to log into our own system.
In other words, the Compromise Carly Logs machine trying to log into itself.
Let's type yes and let's enter the password create
so we have S SSH into our own system.
Next we need to actually tell our local system
to listen on port 1, 2, 3, 4,
and de encapsulate any in common H T D P traffic and
redirect it to port 8, 8, 8 8. To do this,
let's type HTS like sue dash dash forward
dashboard local hosts
88 88 and specify port
1, 2, 3, 4. Great.
So put simply any in common traffic on this host on port
1, 2, 3, 4.
It will be redirected or forwarded to port 88.
Let's it enter. Do we want to install htp?
Let's type yes. Actually they don't install,
so let's just type Y and it enter.
Enter the Carlys password once more and this will simply download
uninstall HTP two. Once it's finished,
we will press up a few times to execute our command.
Once more like so
I actually made a mistake, it's actually HTS
great. Ensure syntax is accurate,
Wells is not going to work.
So now that we have everything set up on our compromise machine,
let's minimize this. Now let's power on our Tucker machine,
which is our main Cali machine.
Simply it starts and once our machine is powered on,
simply log in and open the terminal.
Great. So now that we are now Carly Attacker machine,
let's open a terminal and let's install the H T T Tunnel
tool We'll type app update
to simply update the packages repository list.
Great. Next we'll type app,
install H T D P tunnel and let installation
continue.
Great. Now the installation is complete.
Let's actually set up the final part of the HTT P tunnel from our
system to the Compromise Carly Lenox machine.
To do this we'll type HTC dash dash forward
ports a 80 T followed by the IP address
of the Compromise Lenox machine.
Then we'll specify port 1, 2, 3, 4. That's it.
Enter What this means is any traffic that is
leaving our system that is going to the Compromise System,
it'll go to port 1, 2, 3, 4.
But on the Compromise System traffic will now be redirected to port 8 8 88
and will be forwarded using each T D P two to Windows
the system. So how could we test this out? Well,
we can simply try to establish an R DP session from our tuck
machine to the actual Windows target system.
You can type our desktop like so,
and we are gonna specify our lubar ip followed by Port 80
80.
Our traffic from this address will be sent to the
compromised lung system with a destination port of 1, 2, 3, 4,
let's it enter.
And you may have to actually accept the user credentials or the certificate.
Let's try this one more time and we seem to have some difficulties.
One of the mistakes I've made is I've said incorrect.
The IP address for this command,
the Compromise Lock system is it is actually operating on the IP address
of 1 7 2 3 1 40.
Previously I was entering the incorrect IP address, which was 47,
but after checking shortly, it is IP address 40.
Let's it enter. Let's try to RDP once more.
And here we go. From our Tucker system,
we are able to RDP directly to the target system.
Let's click on other users.
Let's enter Vagrant as username and vagrant as
password. As shown,
we are able to log in directly from our attack machine,
true on each T D P tunnel,
that provides us access to internal systems which do not have internet
access. During this video,
you have learned how to set up each TDP tunneling using Carli Lenox.
In the next video, you'll learn about poor traffic attacks.
I hope this video has been affirmative for you and I'll see you in the next one.