Our challenge was to be able to run nmap and scan three ports on our Ubuntu target which is 0.51
and also bypass the ping verification and just assume that the target is already up.
In order to do that, let's go ahead and swap over to our lab here real quick. We want to start up
our Chisel server first. Again, all the commands are listed earlier in this skill and I'm going
to go ahead and do sudo chisel server-p8000. Now depending on the firewall configuration inside
of our pin testing or our organization's network for our target, we would need to know if 8000
is open or not. So this is where our initial sweeps of reconnaissance come into play because
it could be that port 8000 is not open and we have to use something completely different.
Based on that availability that you find in your early stages of reconnaissance,
that's where that port would actually go in at. So we would go ahead and for the sake of argument
just say 8000 is open for our testing environment and open up our listener there. That again comes
back with http 0 0 0 0 8000 and that 0 0 is us here. Now on our client we're going to go say
chisel exe client 0.53 which is the Kali system of report 8000 reference our SOCKS which we know
is SOCKS 5. And once we do this we have a two-way communication open up and you can see here that
our SOCKS and I want to explain this a little bit further too so that way you also know some of the
changes you need to make if you need to make any. For instance, when we reference SOCKS inside of
our comp file for proxy chains we're saying that SOCKS is going to be on 1080. Now you could say
our semicolon port number and use that one. Again this is based on the availability of ports
that you find from your reconnaissance inside of your early testing of the organization's network.
So it may not be SOCKS it may be something else it could be even port 80 or 443 to kind of mask
everything within the organization that's up to you and the organization's firewall. But SOCKS 5
is defaulted to 1080 and that's why we had to go into the proxy comps to say open up 1080 for SOCKS
5. And you can see that on that last line there I'll zoom out real quick and highlight that for you
come back over to my Kali system and then highlight right here is where I'm looking at
and then as I zoom in you can see proxy reference or R. I'm saying reference for R it's just a
quirk for me 127.0.0.1 which is us over port 1080 which is going to be the actual proxy. Now
CHISL is connected over 8000 so if you're on the security side of things and you're monitoring all
this this is you're looking for actually two separate connections. Now one of them is consistent
and one of them's not. The consistent one is 8000 because that's how CHISL is talking back and forth
and the inconsistent one is the actual SOCKS connection where we're pushing all of our
traffic through the proxy itself. Again just different things to keep in mind. So now that
we have those two going we can swap over to our second terminal and run proxy chains. And for this
I will have the command below because remember we're skipping the ping verification because of
where it sits in the OSI model. We want to keep everything above the board if you will so that
way when this goes through all the traffic that's coming from this NMAP will be forced through our
target which is the pivot point of 0.13 that BWAP system running the client and then go over to port
IP 51. So we say pseudo proxy chains NMAP-P the ports that we're wanting to test
208443-P uppercase P and lowercase n and then the actual 0.51. And when we run this
after we type in our pseudo password we can come back and see that this did run through proxy chains
because of the feedback that we're getting and that we did get a scan report over 0.51
saying that 22 is up 80 is up 443 is closed. So now you're getting more details about the
actual target systems and you could run this against a subnet or a predefined list of IP
addresses. But one thing to lastly keep in mind when you're doing this is that just because you're
using a proxy does not mean that you have to be completely loud in your NMAP scans. Timing and
making sure that you're being discreet is also key to this because no matter what kind of proxy
you're running through if you run an NMAP scan that is just quick and just hit hit hit hit hit
on all these ports with no break in between it's going to set off some alarm bells and regardless
of whether that NMAP sweep is coming from internal or external to the network trusted or untrusted
it's going to raise the same type of alarm bells generally and that's a generally I'd like for you
to keep in mind too because IDS and IPS systems are configured to look for things like this.
So you would have to adjust your timing on this using the dash t flag in order to either speed
it up or preferably not speed it up and slow it down completely and make it run as slow as you
can or as quickly as you can without getting caught. So tune down a lot and best practice for
me is in my experience has been that you run it as slow as you can without running it slow first
speed up turn slightly turn up the volume to something that you know that won't get caught
and then that way you kind of have an assessment of where what the tuning is on those IDS IPS
systems especially when you're conducting proxy because what can happen is is that you set off
enough alarm bells to where they start digging into this and seeing a couple of things. Number
one that they block the IP address of that server or client that you're pivoting through so in this
case dot 13 and then they start digging into the network logs and other logs on dot 13 and find out
where it's actually coming from for realsies. Now am I saying have a pivot to the pivot before you
actually get to 13? I mean is that in the scope of your rules of engagement for your pen test? If it
is by all means if it's not then it's something to consider not doing because it can be frowned upon
in some places illegal and as always you need to have permission for not only the actual pen test
itself but the pin the pivoting that you're doing to be able to get there because if you are pivoting
before you actually get to your pen testing organization's network is it allowed that the
pivot that you're using is allowed to be a part of the actual pen test and I know that may seem
a little off and not right but that is a concern for some pen testers out there. For instance if
you're in the DOD you don't want Chinese IP addresses coming in and conducting pen test.
Maybe you do maybe you don't depends on the type of scenario that you're playing but these are just
different things to consider and closing out some of the other tools that we have inside of our
tunneling repertoire and I'm sure that as the course continues you will see here some of these
referenced and also pick up on the fact that this is a technique that you might want to use before
some of the other stuff that we covered and I hope this has been informative for you and I'd
like to thank you for viewing.