The last tunneling technique that I want to cover is p-tunnel. This one has been put off for a little
bit because I wanted to cover this earlier in a previous skill and I was having problems with it,
but I've got it ironed out because we have everything going through Wireshark. It wasn't
so much that I was having trouble with p-tunnel, I was having trouble with the verification to show
you how it worked. In order to be able to have multiple methods of tunneling through a firewall,
we have to have multiple protocols or IP addresses to be able to tunnel through.
One of the most surefire, although not 100% guaranteed, ways to be able to tunnel through
a firewall is by using a common everyday protocol that nobody bats a second eye to,
and that is ICMP, the thing we normally ping with. Let me hop on over to the lab real quick,
and you can see up here that I am inside of the Kali box and I have Wireshark running.
Now, this is primarily for those POSIX-based systems such as Kali over there and above me,
Ubuntu. The reason I'm going this way is because earlier when we were using Chisel,
we were using Windows. Now, I also want to show you a POSIX-based method.
In our Ubuntu system, we're going to do the complicated method of making sure that p-tunnel
is running. Now, if p-tunnel is not installed, I have the code below for sudo apt install p-tunnel
just in case you are needing a way to install it. But in the Ubuntu system, we want to sudo
p-tunnel, and it's as simple as that as far as starting up our p-tunnel listener slash server.
Now, inside of our Kali system, we have a long string. Now, these commands I'm going to have
below, but I also want to explain them as well too. I'll zoom in for you real quick. Right there,
you can see sudo p-tunnel dash p. Now, that dash p is going to be our proxy or pivot point,
and in this case, it's going to be Ubuntu. We're going to put in the IP address following that.
In this particular case, we have to have 0.51. Now, I also want to point out that on a POSIX-based
system like Kali, it comes pre-installed with p-tunnel, but you can do a sudo apt install
on the Ubuntu system to install it as well because it's in the repository. That said,
you will need to be able to run the command somehow, some way. So directory traversal,
file inclusion, sending meterpreter over, being able to attack the system back doorway,
and just to get it to run as a pivot. The beautiful thing about this is that you can
leave it running in the background and have it there for yourself however you want to do it,
which is perfect. It's not like Chisel where you have to leave it running and
then end it and reconfigure it for whatever it is you want to do next. It's basically on the
client to figure out how the server is going to be used, and that's what we're taking a look at
here because the listening port is going to be for us, that port 8000. Again, I'm just using
defaults here, something common, something for us. You can change this to anything you want
because when you access it, you'll see here in a second where that port comes into play.
Now, where p-tunnel is really handy-dandy is the fact that you can assign the destination
address, which is dash da, and the destination port dash dp. So in this particular case,
I'm going to have Ubuntu pivot over to 0.13, the BWAP system, and then use port 80 in order to send
that traffic back. And p-tunnel will send all of that traffic from Kali to Ubuntu over the ICMP
protocol, and we're going to prove that here momentarily as well. And when the traffic goes
to Ubuntu, Ubuntu will request it as normal from 0.13 over port 80, HTTP protocol, yada yada. It's
fantastic. And then when it comes back to Ubuntu from BWAP, it'll come from Ubuntu to us on Kali
in ICMP traffic, and then we can do with it what we please or do whatever you want to after that.
So that being said, let's go ahead and zoom out real quick, and I'm going to show you that
when we run this, you see that it just starts up, right? Well, the connection is made, and
what do you do after that? Well, you need to open up a second terminal window
and go over here, and just let's do something like cURL. I have cURL in here as well, too,
just in case, in the code box below. So cURL dash v, the actual website of 127.0.0.1, which is us
because we're proxying through ourselves, proxying over port 8000. And I'm going to zoom in to show
you what I'm talking about right there. So when I run this command, it's going to say cURL myself,
but because we're using port 8000, 8000 is assigned to pTunnel, pTunnel is going to send it
over ICMP to Ubuntu in that whole chain that we just talked about. So let's go ahead and run that,
and you can see there that not only did it run and we got the cURL results, but in Ubuntu,
we got results right there, too. Now, this looks very straightforward and to the point,
and that's because it is. pTunnel is relatively easy to use, and it will run in the background
as well, too. So now that we've got all of our cURL info, and we've seen that we got the site,
let me show you the proof behind this. So I'm going to go stop my Wireshark on this one and
start it up again. Leave that running for just a second. I'm going to go over to Ubuntu and start
the Wireshark up over there as well. Over on Kali, I'm going to go back into the terminal window for
cURL. Sorry, wrong one. Right there, and I'm going to hit up and go to cURL. Now, right here,
you can see that there's a lot of ICMP traffic. Let me zoom in for you and show you what I'm
talking about as I scroll up. And right there, you can see all those ICMP packets. And if I move
over, you can see the ICMP packets in Ubuntu as well. So those ICMP packets, and I'm looking here
on the right side for the Ubuntu, 51 to 53, 53 to 51, and back and forth between Kali and Ubuntu.
Well, right below that, you see TCP 51 to 13, 13 to 51 over TCP, and you see in there port 80 as
well too. So what's happening is, is that the request is going from Kali, as we predicted,
over ICMP to Ubuntu, from Ubuntu to BWAP over HTTP, back to Ubuntu over HTTP, and back to Kali
over ICMP. So right now, we have a surefire way to be able to pivot and change how we make our
request across the network using an ICMP protocol. Why is this important? All excellent questions
that will be answered for you. And that's because ICMP is one of those protocols that you kind of
have to have on your network in order to accomplish certain things, like making sure things are
online. There's not very few, there's not very many networks out there that disable ICMP traffic,
but they do monitor it. Now, one of the things that I want to bring up is, is that while this
is a very cool tunneling technique that is probably the most simplistic that we've used so far,
these ICMP packets can get pretty hefty. The average size of an ICMP packet is around 70
bytes. If you do this in the lab, you will see that ICMP packets get into a couple hundreds,
and that's because it's splitting it up into chunks, yada yada. Well, that does raise some
alarms sometimes if somebody has a firewall or an IDS IPS rule stating about ICMP packets being at a
fixed size or within a certain amount. And there are some IDS IPS heuristic rules out there that
do in fact govern ICMP packet size. Now, that being said, you could always change the client
set, client settings on Kali, for instance, to not go to HTTP. You could pivot to another
POSIX-based system and use SSH. Basically, you would go into your configuration, and we'll
pop back over ever so slightly. Go into our terminal window here, and right here I'll highlight
and then zoom in for us. You can see right there that we have our target being 051. That's where
the ptunnel pivot is. The 8000 is what we're using as a proxy. And then if you wanted to
make your destination address, let's say 0.27, which is, I don't know, Red Hat, and then the
destination port 22, you could very well SSH over to 0.22 port 8000, and that would forward
the SSH request through Ubuntu over ICMP and then to the Red Hat to port 22 and then back the way
it came, just like it did inside the HTTP traffic through ICMP that we just did the example of.
And basically, that closes out everything that we're talking about with tunneling,
and this is going to lead us into our challenge. But I just wanted to give you an alternative way
to tunnel yet again and be able to create even more pivots inside the organization that we're
pen testing against.