Port Forwarding with Socat
Now we are ready to create a port forward.
We have an idea of how we want it to work:
CONFLUENCE01 should listen on a port on the WAN interface and forward all packets
received on this port to the PGDATABASE01 on the internal subnet.
Let’s review this concept with the following diagram:
We want to open TCP port 2345 on the WAN interface of CONFLUENCE01,
then connect to that port from our Kali machine.
We want all the packets that we send to this port to be forwarded by CONFLUENCE01
to TCP port 5432 on PGDATABASE01.
Once we set up our port forward, connecting to TCP port 2345
on CONFLUENCE01
will be exactly like connecting directly to TCP port 5432 on PGDATABASE01.
As part of our enumeration of CONFLUENCE01, we’ll find Socat installed.
Socat is a general-purpose networking tool
that can set up a simple port forward in a single command.
We will use Socat to set up the port forward we want on CONFLUENCE01.
It will listen on a port on the WAN interface,
that our Kali machine can connect to,
and forward packets received on that port to PGDATABASE01.
On CONFLUENCE01, we’ll start a verbose Socat process.
It will listen on TCP port 2345,
fork into a new subprocess when it receives a connection
instead of dying after a single connection,
then forward all traffic it receives to TCP port 5432 on PGDATABASE01.
The network is now set up like the following diagram:
With the Socat process running, we can run psql on our Kali machine,
specifying that we want to connect to CONFLUENCE01 on port 2345,
with the postgres user account.
When prompted, we will enter the password.
and once connected, we can run the \l command to list the available databases.
Success!
We’ve connected to the PostgreSQL database through our port forward.
We’ll also find that we have access to the confluence database.
Using our new database access, we can continue our enumeration.
In the confluence database, let’s query the cwd_user table.
This contains the username and password hashes for all Confluence users.
We’ll connect to the database with the \c confluence command,
then run select * from cwd_user; to review everything in that table.
We receive several rows of user information.
Each row contains data for a single Confluence user,
including their password hash.
We will use Hashcat to try to crack these.
The Hashcat mode number for _Atlassian hashes is 12001,
so we can pass that to the -m mode flag.
After copying the hashes into a file called hashes.txt,
we’ll pass this as the first positional argument.
We can then pass the fastrack.txt password list that’s built into Kali
as the final positional argument.
It appears that the password policy for this Confluence instance isn’t very strong
After only a few minutes of cracking,
Hashcat returns passwords for the database_admin,
hr_admin and rdp_admin users.
We might suspect that these passwords are reused
in other places throughout the network.
After some more enumeration of the internal network,
we’ll find PGDATABASE01 is also running an SSH server.
Let’s try these credentials against this SSH server.
With our new port forwarding skill,
we can create a port forward on CONFLUENCE01 that will allow
us to SSH directly from our Kali machine to PGDATABASE01.
First, we need to kill the original Socat process listening on TCP port 2345.
We’ll then create a new port forward with Socat that will listen on TCP port 2222
and forward to TCP port 22 on PGDATABASE01.
With our new Socat port forward set up,
our network setup will be configured much like the following diagram:
There are only very minimal differences
between this and the previous network setup.
Instead of listening on 2345, we are listening on 2222.
Instead of forwarding to TCP port 5432 on PGDATABASE01,
we are forwarding to TCP port 22 on PGDATABASE01.
We’ll then use our SSH client to connect to port 2222 on CONFLUENCE01,
as though we are connecting directly to port 22 on PGDATABASE01.
We can use the database_admin user, and the password we just cracked using Hashcat
Success!
The database_admin credentials have been reused here.
We have managed to connect to the SSH server on PGDATABASE01
using the credentials for database_admin we found in the PostgreSQL database
through the port forward we set up on CONFLUENCE01 with Socat.
In this Learning Unit, we created some simple port forwards using Socat.
These allowed us to gain deeper access within a network
by leveraging our existing access to a compromised host.