In this demonstration,
we will look at how we can proxy traffic using an http_hop listener.
Before we dive into the demo, let's revisit our diagram.
Since we have already exploited the web server,
we will create a new listener, which uses the http_hop functionality of Empire,
and we will proxy traffic from the IT admin to the web server
and from the web server to our listener,
which resides on the internet.
This will enable us to hide the traffic and evade
detection since it will look as if the IT administrator is
communicating with the web server.
Let's dive in.
We'll kick this demo off by creating an http_hop listener.
In essence,
what a hop listener does is it gives you the ability to use another
server as a jump server back to your attacking machine.
This is good to evade detection,
and you can leverage this if you own a web server that your
target is currently communicating to, as we have in our diagram.
We will create this using Starkiller.
The first thing we need to do is go ahead and create a listener.
I will click on Listeners and CREATE LISTENER,
and under the Type, I'm going to drop this down,
and I'm going to choose http_hop.
I can give it a descriptive name, but I will leave this as it is for now.
And under Host, this is where I will define the web server.
Now, remember, this web server I already own,
so it will be easy to use as a hop or a jump server.
I will leave the Port as port 80.
The Launcher, I will use a powershell launcher,
and I will define the output folder where the HTTP files will be dropped.
Next, we have the RedirectListener.
Now your RedirectListener is the listener that you
want to use for the redirection.
Since I already have a normal standard HTTP listener set up,
I'm going to leave this as is.
And under Optional Fields, I'm going to leave the defaults in place.
I will click on SUBMIT, and if I go back to Listeners,
I can see now that my listener is being created.
Next, I need to set up a stager that's going to use this listener.
So I'll click on Stagers, GENERATE STAGER, and I want to use a normal Windows
VBS stager. Under my Listener, I'm going to select http_hop.
I'll leave the Language as powershell. In Optional Fields, I'm just going to
adjust the output file directory, and I'll click on SUBMIT,
and this will create the launcher for me.
Now, all I need to do is load this launcher on the target, and I
need to copy the http_hop files to the web server.
Let's take a look at the files that were created.
I'll navigate to my File System under my home directory.
I have the directory,
which is called http_hop. Within http_hop, I have a number of files.
In essence, what I need to do is I need to copy these files to the web server.
I'll just navigate back, and you'll notice that we have the
launcher that we've created with Starkiller. I've quickly
switched to the Ubuntu machine, which is running the web server,
and you'll notice that I have copied those files that was
generated by the http_hop listener.
Now what I will do is I will execute the launch on the target machine.
Alright, so I've executed both launches,
including the one which was set up for the http_hop
listener Let's take a look at the agents,
which shows up on Starkiller,
and you'll see that I've got two agents that are reporting.
These essentially are the same agents,
but the IP addresses that they are coming from would be different.
Let's take a look at the first agent.
I'll issue the command sysinfo, and you'll notice the response here that
the traffic is coming in via the 192.168.94.154 listener.
Now I'll switch back to the second agent and issue the same command.
In here, you'll see that the traffic is coming in via the 192.168.94.140
listener. I'll jump back to the web server and issue the command ifconfig,
and you'll see that the web server has an address of 192.168.94.154. And
I've switched back to my Kali machine.
So this shows me, now, that I've got two agents
established from the same machine,
the one is coming directly from the machine to my HTTP
listener, and the other one is coming to my machine via the
web server using the http_hop listener.
This is a good technique to use if you want to evade detection and if you
want to proxy or use various servers for jump hosts as you perform command
and control capabilities on target machines.