WEBVTT 00:00:01.740 --> 00:00:02.260 Hey there. 00:00:02.270 --> 00:00:05.370 Welcome to the course Defense Evasion with ProxyChains. 00:00:05.370 --> 00:00:06.570 In here, 00:00:06.580 --> 00:00:10.130 you'll learn how to bypass network defense systems using 00:00:10.130 --> 00:00:12.150 one of the most famous red team tools. 00:00:13.540 --> 00:00:14.920 So imagine that. 00:00:14.920 --> 00:00:16.870 Imagine that you're a red team specialist, 00:00:16.880 --> 00:00:19.210 and you're trying to attack the Bank ABC. 00:00:20.840 --> 00:00:24.610 As you can see in this diagram, the network of the bank is fairly secure. 00:00:24.610 --> 00:00:27.360 It has a firewall protecting the servers in the DMZ, 00:00:27.360 --> 00:00:31.250 and it has network segregation to ensure that it cannot get into 00:00:31.250 --> 00:00:33.650 the internal network from outside of the company. 00:00:34.840 --> 00:00:36.350 So during your engagement, 00:00:36.360 --> 00:00:40.110 you find a way to compromise one of the servers in the DMZ. 00:00:40.110 --> 00:00:42.290 For example, you find a vulnerability, 00:00:42.290 --> 00:00:45.760 and you're able to exploit and get a shell to the DMZ server. 00:00:46.840 --> 00:00:47.880 Now think about that. 00:00:47.890 --> 00:00:50.350 How can you go even further into the network? 00:00:52.640 --> 00:00:55.770 If you try to access any internal server from the outside, 00:00:55.780 --> 00:00:58.060 your traffic will be blocked by the firewall. 00:00:58.440 --> 00:01:00.750 So then we have to think about something else. 00:01:02.240 --> 00:01:05.390 And here is where ProxyChains can help you. 00:01:05.390 --> 00:01:06.890 With ProxyChains, 00:01:06.900 --> 00:01:10.050 we can tunnel our traffic through the compromised server and 00:01:10.060 --> 00:01:12.360 reach other servers in the internal network. 00:01:13.540 --> 00:01:14.050 With that, 00:01:14.050 --> 00:01:17.710 we can then compromise other servers and use ProxyChains 00:01:17.710 --> 00:01:20.360 again to go even further into the network. 00:01:21.540 --> 00:01:22.260 Pretty cool, right? 00:01:22.740 --> 00:01:25.530 That's why ProxyChains is one of the most used tools by 00:01:25.530 --> 00:01:27.450 attackers and red team specialists. 00:01:28.040 --> 00:01:32.360 It allows you to bypass firewalls and other network perimeter defense tools. 00:01:34.840 --> 00:01:39.160 The ProxyChains tool is useful not only for defense evasion, we can 00:01:39.160 --> 00:01:42.360 actually use across several phases of a red team exercise. 00:01:44.240 --> 00:01:47.280 This tool was originally created by N3E7CR34TUR3. 00:01:47.280 --> 00:01:50.250 And since then, it's had several major contributors. 00:01:50.940 --> 00:01:54.620 If you're into red team tools, you should definitely check their GitHub, 00:01:54.630 --> 00:01:56.760 and you'll find tons of cool scripts in there. 00:01:58.140 --> 00:01:58.870 Basically, 00:01:58.880 --> 00:02:02.600 ProxyChains is a tool that forces any TCP connection 00:02:02.600 --> 00:02:04.950 from application to go through a proxy. 00:02:06.040 --> 00:02:09.550 The ProxyChains is actually really famous because people use it 00:02:09.560 --> 00:02:12.780 with the TOR service to an anonymize traffic. 00:02:12.780 --> 00:02:14.980 But as you will see in this course, 00:02:14.990 --> 00:02:19.550 we can use ProxyChains to bypass firewalls and network defense devices. 00:02:22.640 --> 00:02:25.710 What I love about ProxyChains is that it's open source, 00:02:25.770 --> 00:02:28.860 meaning that we can download the code, use it for free, 00:02:28.860 --> 00:02:31.060 and even customize the code if you want. 00:02:31.940 --> 00:02:34.550 You can find the source code at this GitHub page. 00:02:35.840 --> 00:02:39.780 ProxyChains is one of the most well‑known tools for traffic redirection, 00:02:39.780 --> 00:02:44.560 meaning that with ProxyChains, we can redirect the TCP packets from any tool, 00:02:44.940 --> 00:02:49.160 like and Nmap, theHarvester, SSH, and etc. 00:02:50.440 --> 00:02:54.060 And this can be really interesting to provide traffic anonymization. 00:02:55.040 --> 00:02:58.320 For example, if I want to run an Nmap scan against the server, 00:02:58.330 --> 00:03:00.490 but I want to hide my real IP address, 00:03:00.490 --> 00:03:03.800 I can use ProxyChains to reroute the traffic 00:03:03.810 --> 00:03:05.360 through some proxies on the internet. 00:03:06.340 --> 00:03:08.600 Also, as we discussed in the beginning of this course, 00:03:09.140 --> 00:03:12.550 ProxyChains can be used to bypass defense mechanisms. 00:03:12.940 --> 00:03:16.620 For example, if I'm able to get initial access to one server in a company, 00:03:16.620 --> 00:03:20.230 then I can use ProxyChains to access other internal servers 00:03:20.230 --> 00:03:22.160 that are not exposed to the internet. 00:03:25.240 --> 00:03:27.970 If you're familiar with the red team kill chain methodology, 00:03:27.980 --> 00:03:30.850 we can use the ProxyChains tool anywhere from the recon 00:03:30.850 --> 00:03:33.060 phase all the way to the action phase. 00:03:33.840 --> 00:03:37.980 Any time we need to redirect traffic, the ProxyChains can be used. 00:03:37.980 --> 00:03:43.610 However, in this course, we'll focus on the lateral movement and evading phases, 00:03:43.610 --> 00:03:46.940 meaning that we'll use ProxyChains to move from one machine to 00:03:46.940 --> 00:03:51.010 another one and evade any defense tools. 00:03:51.010 --> 00:03:54.870 Also, if you're familiar with the MITRE ATT&CK framework, 00:03:54.870 --> 00:03:58.360 we can map this course to the defense evasion phase. 00:03:59.640 --> 00:04:02.140 In this phase, we focus on one main technique, 00:04:02.140 --> 00:04:04.460 which is network boundary bridging. 00:04:06.840 --> 00:04:08.360 So let's talk about our demos. 00:04:08.840 --> 00:04:12.650 If you want to follow the demos of this course, you need two things. 00:04:12.650 --> 00:04:16.860 First and most important, you need an attacker machine. 00:04:16.860 --> 00:04:18.070 In here, 00:04:18.079 --> 00:04:21.390 I'm using a Kali Linux virtual machine because it 00:04:21.390 --> 00:04:23.930 already comes with ProxyChains installed. 00:04:23.930 --> 00:04:27.940 But, you can actually use ProxyChains in any Linux distribution. 00:04:27.940 --> 00:04:32.180 The installation process is really simple. 00:04:32.190 --> 00:04:37.440 Also, you need a victim machine so then you can practice the attacks. 00:04:37.440 --> 00:04:38.170 In my case, 00:04:38.170 --> 00:04:42.480 I have one server in the DMZ that I can exploit and one server in the 00:04:42.480 --> 00:04:45.850 internal network that only communicates with the DMZ server. 00:04:45.850 --> 00:04:51.260 In my case, both servers are Linux, but it could be any kind of victim computer.