HEY EVERYBODY WELCOME TO next video.
We're gonna be talking about a pretty complicated topic in this particular video.
And this is going to be about SS each tunneling.
Now there's three different types of unsafe tunneling.
There's a reverse SS H tunnel a remote port forward tunnel and a dynamic SSA.
Each of these have their own different use cases and they all operate a little differently.
Now the first one we're going to look at is a reverse SS H tunnel.
Now what this is.
Let's say you're attacking a machine that has an internal port let's say an internal Web port.
Right.
So if there's an internal Web port that cannot be reached from the outside so it's bound locally so
only local hosts on that machine can access it.
But you have an exploit that you want to use or you want to play around with the web service but you
don't want to go through using curl the entire time to interface with everything.
Maybe you want to use a browser.
So what you can do is you can do something called reverse SSA tunneling so you can link that remote
port or the remote internal port on the victim machine so let's say port 80 is is only local or port
fifty six hundred whatever the port is.
That's only internal in the machines so you can't reach from the outside.
You can link that port to a local port on the attacking machine using SS H and then you can just you
know access on your web browser to local host port whatever you decided and you would be tunneling the
traffic through to the X to the victim machines internal port which allows you access to that internal
port from the external side.
So if we want to take a look at how this works in reality we're going to create a tunnel for we're gonna
create a reverse tunnel.
So this is done with SS H dash L then we want the port that we want our local machine our attacking
machine to use as the connecting port.
Now keep in mind this is the local port that you'll be using on your local browser on the attacking
machine.
Now keep in mind this is the attacking machine and we want to be able to use this particular port for
anything else we want.
Then we have the local address.
So we have we'll use 4 4 4 4.
Then we have the remote target or our victim 1 2 1 6 8 1 22 and then we're going to tell it whatever
internal port is on that system that we want to use we'll use port 80 in this particular case even though
it's external it's we're going to assume that this is an internal port only and it works for any port
on the system so following this we need a valid account.
So we'll do admin at 9 2 0 1 6 8 1 2.
We'll go ahead run it then we'll do Adnan's password.
Now you can see we are indeed on the remote systems so if we do this we could see one not twenty two
and if we do hostname I believe it's just Carly.
So here we go.
So we now on the local system.
But the difference is is when you make a tunnel you need to keep the tunnel open so you can't close
this prompter closes at all.
Just keep it open then the next thing we're going to do is if we go over to a web browser and we do
it CTP local host import for 4 4 4
we can now see that we do indeed have access to that machine's overdue DPW way which was on our other
machine we can see here we are accessing the internal Web site or the.
In this case its next term Web site but it could be any port and we're we're using port for four four
four on our local host which has been tunneling the traffic through port for for for for into this tunnel
through this tunnel and then connecting to local host port 80 on this.
So that is no different than doing curl HDP local host DPW that is the exact same things happening except
we're doing it from our machine.
So this can be taken even a step further let's say this is a machine that only has an internal port
running that's vulnerable to something for privilege escalation we can we can create this tunnel and
allow medicinally to attack local port for four four four with that exploit and it will actually give
us a shell on the remote machine with the new privileges.
So this can be done with a lot of different ways of letting this is out so the next thing I want to
show you guys is the remote port forwarding now.
This is done.
This is a slightly different way of going about this.
This is a way that if you wanted your local machine your attacking machine you wanted a port on your
on your attacking machine to be present on the remote victim machine.
So if we wanted to go to the victims machine on port for 4 four for and then get access to whatever
we want on the Kelly machine on your attacking machine.
You can do that with a remote port forward so to do this it's SS H Dash are for remote port far for
them we're going to tell it what port on the victim machine do we want to open.
So in this case we'll do for 4 4 4.
And then we're gonna do local host.
So we're connecting our machine from local to the victim machine.
And then what port do we want to have presence on port for 444.
That's connected to our Cally machine.
So as our Cally machine will we'll open up another terminal.
We'll do Python Dash.
Simple ATP server we'll make it on port 80.
Right now we've got a port 80 server running and we'll use Port eight.
So what this is going to do is this can open up port for four for 4 on the victim machine that then
anybody who touches that port is then given is moved over to port 80 on the attacking machine.
So again when you add been at 1 9 2 0 1 6 8 I want to go ahead and log in now you can see here nothing's
really changed but if we curl each TTP local host port or four 4 4 4 go ahead and curl that you can
see we're getting a directory listing but we're seeing traffic dot P cab test stop BHP.
But what's interesting is on our local host port 80
we can see this is our actual listing so we can see if we scroll down here we can see test up HP traffic
w cap because this is local to this web service you can see we have a get request coming from local
host they're all coming from local host.
The reason being even though this guy's curling his local host.
So this keep in mind this is the web server that's 1 9 2 1 6 8 1 22.
So this is our victim machine or curling.
It's local host on port for 444 which is then being tunneled through that port through this tunnel here
to port 80 on our attacking machine which is then why we see we see this request happening right there.
So it's a very useful tunnel.
But what's interesting we can take this even a step further with the last tunnel.
So we'll go ahead and exit out of this.
The next one is a dynamic tunnel.
This is normally done for pivoting so you can actually push traffic through and normally this is in
conjunction with proxy changed so much show you how to create the tunnel and we'll do a quick test on
proxy change I'm not going to go all how to configure it or even how to use it you're just going to
see me slowly configure it really quickly just because I haven't configured it yet.
So if we go via ATC proxy change because there's going to be a pivoting video that actually takes over
and looks up and how to set a proxy change not set up pivoting routes and medicinally.
So you hop you worry about that later.
So this is just kind of a quick heads up on it.
So we'll go ahead and come down here.
We will close out
proxy DNS and we'll change socks for proxy to port 444 for
that next year we want to do is SS H dash D is for dynamic.
We're going to we'll use port for 4 4 4 as similar to what we did in the proxy chains config file.
Then we're going to admin at 1 and 2 1 6 8 1 22 to.
So what we've done right now is we've made up a SoCs for proxy configured over SSD age on Port 4 4 4
4 on our local machine which means any traffic center for 4 4 4 is redirected to 1 9 2 1 6 8 1 22.
So it doesn't matter what traffic it is songs are going over port 4 4 4 4.
Keep in mind this is a T CPE only so when you run and map for example the the sense in default isn't
going to work in the pings aren't going to work so you need to make sure you handle this correctly which
will go over a little bit more in the other video but now we've correct.
We've made a tunnel between our machine on port for 444 and the target machine.
Not on a specific port on the target machine but just an SSA channel in general so we can push traffic
across so what we'll do here is now we've got that done we'll do proxy chains.
Don't worry about this just yet.
We'll do and map dash and P dash s t and then we'll do if we looked here we do s been if config so we
can see what this is a dual homed machine.
So we've got 10 that 0 about 2.5.
Let's take a look at what's on 10 0 2 4.
So when we go ahead and run this all up and map
p n sorry about that so you see here it's actually practicing on Port 4 4 4 4.
It's going over to the internal port on our machine on our 1 9 2 1 6 8 1 twenty two and then it's going
head and going out that other address.
The other is eith one to the Ten Network and then we can see here on our new Ten Network 10 down 0 2
4 which looks to be a Windows machine but now we can see we have full access to any map scanning the
n the other network which we didn't have access to originally.
So this is a quick look at pivoting but knowing that it's SSA tunneling is what causes that socket proxy
to actually occur which is the dynamic proxy.
So take it take a minute where you watch The View if you need to.
There's a little bit more description below the video but understanding how to do tunnels like this
whether it's reverse forward or dynamic is a very key importance to a red team.
Because this doesn't just allow you to for example hook to an internal port or reversing your own port.
You can use these in a lot of different ways and you can chain up multiple tunnels between different
systems to push yourself even further into networks and even bypass firewalls.
So take a second review this read the tutorial below the video as well as go out and search on your
own.
Each of these types of tunnels and see what different use cases they have for them.
There's so much there to learn and it is a very very useful skill to have as a red team or as an attacker.