Now let's talk about our second scenario here.
Again, you're a red team specialist trying to attack the Globomantics company.
And note here the IPs.
The DMZ sever IP is an external IP, 3.96.201.184.
And the internal database server is an internal IP, which is 172.31.100.56.
And this means that we can only access the DMZ server since
it's the only server with an external IP.
So here, in this scenario,
you poked around a little bit and you were able to
compromise the server in the DMZ.
Now,
what we have to do is use the ProxyChains to tunnel our traffic and
reach the other servers in the internal network.
So, if you're ready, let's go back to our lab environment.
Awesome!
We're back to our lab environment.
As mentioned in the slides, because the DMZ server has an external IP,
we do have access to the server.
For example, if you try to ssh into that server, it works fine.
However, if we try to ssh into the internal server, it simply doesn't work.
As you can see, the ssh client hangs,
and that's because it cannot connect to that IP.
Again, remember, that IP is an internal IP and is not available externally.
So, what we can do is tunnel our traffic through the server in the DMZ.
And in here, in this demo,
we're assuming that you already have some kind of access to the DMZ server.
So the easiest way to create a secure tunnel is using the SSH tool.
The idea here is creating an SSH tunnel between my
attacker machine and the DMZ server and then tunneling all
the traffic through this tunnel.
To create this SSH tunnel, I'll use this command here,
ssh, then ‑D,
which is to indicate that I want to create a dynamic port forwarding,
then deporting a local machine that I'll use for my tunnel,
and then the username and the server IP of the DMZ server.
And again,
what this will do is create an encrypted tunnel between my
attacker machine and the DMZ server.
And then create a SOCKS proxy on the port 1122, as they specify in the command.
With this SOCKS proxy open,
I can then use ProxyChains to tunnel all the traffic through the DMZ IP.
Perfect.
So, let's just press Enter, and this will prompt the password for my SSH session.
Once I type it, I will get a normal SSH session.
But because I used the flag ‑D,
the SSH tool also creates a SOCKS proxy that runs on the port 1122.
Also, really important, note that in here,
I don't need root access to the victim machine.
Even if you have a regular user account,
you can route your traffic using this technique.
So to use ProxyChains,
we need to edit its configuration file and set up
the proxy that we just created.
For that, let's just use sudo vim and then /etc/proxychains4.conf.
At the end of this file, I will comment this line here.
That is for the Tor proxy.
We don't need that anymore.
And then, I will add one line here for our SSH proxy.
For that, I will type socks5 since the SSH used this protocol,
and then press Tab twice, and my loopback IP.
Then, after that, I'll have to put the port of my SSH tunnel,
which is 1122, and that's it.
That's done.
All I have to do now is save and close this file,
and then we are ready to use ProxyChains.
So just as a test, let me try to SSH into the internal server using ProxyChains.
For that,
I'll type proxychains and then the exact same SSH
commands that I tried to run before.
Remember, in here, we're using the internal IP,
which is not available externally.
Once I press Enter, my SSH connection will be tunneled through the DMZ server.
And take a look, it works now.
We're able to reach the SSH of the internal server.
And just to confirm that this is an internal machine,
take a look at the IP address that we have here.
It is the internal IP address that is not available externally.
Pretty cool, right?
But you might be thinking, wait, Ricardo,
if I already have SSH access to the DMZ server,
couldn't I simply use the terminal of the DMZ server
to access the internal server?
Yes, for SSH,
you could simply log into the DMZ server and then SSH into the internal server.
But with ProxyChains, you can do way more than that.
For example, let's say you want to do a port scan against the internal server.
You really don't want to install Nmap on the DMZ server.
Instead, you can just type in your attacker machine,
proxychains, and then the same nmap to scan the internal server.
And simple as that, I can easily scan the internal server through the DMZ server.
And take a look at this, the internal server has the port 80 open,
which is probably a web server.
Normally,
you wouldn't be able to access this web page via
the terminal or via the internet, but remember,
we have ProxyChains.
So you can just type proxychains and then firefox.
Now, all our traffic from Firefox goes through the DMZ server.
So if you want to access that internal web page,
we can simply type http and then the internal IP that we want to access.
And take a look, we just got access to the internal Globomantics HR server.
In here,
we just bypass all the firewalls and directly connect it to
the internal web page from the internet.
And from here,
you can try to exploit this web page and go even
further on your red team exercise.
And in my opinion,
that's why ProxyChains is one of the most used tools by red team specialists.