WEBVTT

00:00:01.940 --> 00:00:04.520
Now let's talk about our second scenario here.

00:00:04.520 --> 00:00:09.200
Again, you're a red team specialist trying to attack the Globomantics company.

00:00:09.200 --> 00:00:11.150
And note here the IPs.

00:00:11.640 --> 00:00:19.260
The DMZ sever IP is an external IP, 3.96.201.184.

00:00:20.140 --> 00:00:28.150
And the internal database server is an internal IP, which is 172.31.100.56.

00:00:29.040 --> 00:00:33.090
And this means that we can only access the DMZ server since

00:00:33.090 --> 00:00:35.250
it's the only server with an external IP.

00:00:37.040 --> 00:00:38.570
So here, in this scenario,

00:00:38.580 --> 00:00:40.930
you poked around a little bit and you were able to

00:00:40.930 --> 00:00:42.950
compromise the server in the DMZ.

00:00:44.240 --> 00:00:44.630
Now,

00:00:44.640 --> 00:00:49.310
what we have to do is use the ProxyChains to tunnel our traffic and

00:00:49.310 --> 00:00:51.350
reach the other servers in the internal network.

00:00:52.140 --> 00:00:54.750
So, if you're ready, let's go back to our lab environment.

00:00:58.440 --> 00:00:58.810
Awesome!

00:00:58.810 --> 00:01:00.450
We're back to our lab environment.

00:01:00.840 --> 00:01:04.739
As mentioned in the slides, because the DMZ server has an external IP,

00:01:04.750 --> 00:01:06.660
we do have access to the server.

00:01:07.240 --> 00:01:11.050
For example, if you try to ssh into that server, it works fine.

00:01:12.240 --> 00:01:17.760
However, if we try to ssh into the internal server, it simply doesn't work.

00:01:17.760 --> 00:01:20.860
As you can see, the ssh client hangs,

00:01:21.240 --> 00:01:24.210
and that's because it cannot connect to that IP.

00:01:24.210 --> 00:01:29.160
Again, remember, that IP is an internal IP and is not available externally.

00:01:30.240 --> 00:01:34.770
So, what we can do is tunnel our traffic through the server in the DMZ.

00:01:34.770 --> 00:01:36.940
And in here, in this demo,

00:01:36.950 --> 00:01:40.750
we're assuming that you already have some kind of access to the DMZ server.

00:01:41.340 --> 00:01:45.660
So the easiest way to create a secure tunnel is using the SSH tool.

00:01:46.740 --> 00:01:49.780
The idea here is creating an SSH tunnel between my

00:01:49.780 --> 00:01:53.940
attacker machine and the DMZ server and then tunneling all

00:01:53.940 --> 00:01:56.100
the traffic through this tunnel.

00:01:56.100 --> 00:02:00.160
To create this SSH tunnel, I'll use this command here,

00:02:01.140 --> 00:02:04.060
ssh, then ‑D,

00:02:04.640 --> 00:02:08.150
which is to indicate that I want to create a dynamic port forwarding,

00:02:09.340 --> 00:02:12.850
then deporting a local machine that I'll use for my tunnel,

00:02:13.740 --> 00:02:17.250
and then the username and the server IP of the DMZ server.

00:02:18.340 --> 00:02:18.910
And again,

00:02:18.920 --> 00:02:22.120
what this will do is create an encrypted tunnel between my

00:02:22.120 --> 00:02:24.360
attacker machine and the DMZ server.

00:02:24.840 --> 00:02:30.360
And then create a SOCKS proxy on the port 1122, as they specify in the command.

00:02:31.540 --> 00:02:33.170
With this SOCKS proxy open,

00:02:33.180 --> 00:02:37.750
I can then use ProxyChains to tunnel all the traffic through the DMZ IP.

00:02:38.640 --> 00:02:39.260
Perfect.

00:02:39.270 --> 00:02:43.950
So, let's just press Enter, and this will prompt the password for my SSH session.

00:02:44.940 --> 00:02:47.960
Once I type it, I will get a normal SSH session.

00:02:48.440 --> 00:02:50.810
But because I used the flag ‑D,

00:02:50.810 --> 00:02:56.560
the SSH tool also creates a SOCKS proxy that runs on the port 1122.

00:02:57.640 --> 00:03:00.230
Also, really important, note that in here,

00:03:00.240 --> 00:03:02.460
I don't need root access to the victim machine.

00:03:03.140 --> 00:03:05.010
Even if you have a regular user account,

00:03:05.020 --> 00:03:07.360
you can route your traffic using this technique.

00:03:09.040 --> 00:03:10.460
So to use ProxyChains,

00:03:10.470 --> 00:03:13.440
we need to edit its configuration file and set up

00:03:13.440 --> 00:03:15.270
the proxy that we just created.

00:03:15.270 --> 00:03:23.170
For that, let's just use sudo vim and then /etc/proxychains4.conf.

00:03:23.170 --> 00:03:28.650
At the end of this file, I will comment this line here.

00:03:28.660 --> 00:03:30.060
That is for the Tor proxy.

00:03:30.060 --> 00:03:31.660
We don't need that anymore.

00:03:32.740 --> 00:03:36.160
And then, I will add one line here for our SSH proxy.

00:03:37.240 --> 00:03:42.150
For that, I will type socks5 since the SSH used this protocol,

00:03:43.140 --> 00:03:46.600
and then press Tab twice, and my loopback IP.

00:03:48.040 --> 00:03:51.930
Then, after that, I'll have to put the port of my SSH tunnel,

00:03:51.940 --> 00:03:55.820
which is 1122, and that's it.

00:03:55.820 --> 00:03:56.460
That's done.

00:03:56.840 --> 00:03:59.440
All I have to do now is save and close this file,

00:03:59.800 --> 00:04:01.760
and then we are ready to use ProxyChains.

00:04:03.240 --> 00:04:07.950
So just as a test, let me try to SSH into the internal server using ProxyChains.

00:04:08.840 --> 00:04:09.360
For that,

00:04:09.370 --> 00:04:13.170
I'll type proxychains and then the exact same SSH

00:04:13.170 --> 00:04:15.060
commands that I tried to run before.

00:04:16.040 --> 00:04:18.740
Remember, in here, we're using the internal IP,

00:04:18.800 --> 00:04:20.360
which is not available externally.

00:04:22.040 --> 00:04:27.030
Once I press Enter, my SSH connection will be tunneled through the DMZ server.

00:04:27.030 --> 00:04:29.260
And take a look, it works now.

00:04:29.260 --> 00:04:32.260
We're able to reach the SSH of the internal server.

00:04:33.140 --> 00:04:35.390
And just to confirm that this is an internal machine,

00:04:35.390 --> 00:04:37.760
take a look at the IP address that we have here.

00:04:38.440 --> 00:04:41.260
It is the internal IP address that is not available externally.

00:04:42.040 --> 00:04:42.850
Pretty cool, right?

00:04:44.440 --> 00:04:47.080
But you might be thinking, wait, Ricardo,

00:04:47.090 --> 00:04:50.160
if I already have SSH access to the DMZ server,

00:04:50.160 --> 00:04:53.060
couldn't I simply use the terminal of the DMZ server

00:04:53.060 --> 00:04:54.260
to access the internal server?

00:04:55.340 --> 00:04:56.760
Yes, for SSH,

00:04:56.770 --> 00:05:00.860
you could simply log into the DMZ server and then SSH into the internal server.

00:05:01.740 --> 00:05:04.560
But with ProxyChains, you can do way more than that.

00:05:05.340 --> 00:05:09.360
For example, let's say you want to do a port scan against the internal server.

00:05:10.140 --> 00:05:13.480
You really don't want to install Nmap on the DMZ server.

00:05:13.480 --> 00:05:16.730
Instead, you can just type in your attacker machine,

00:05:16.730 --> 00:05:21.700
proxychains, and then the same nmap to scan the internal server.

00:05:21.700 --> 00:05:26.850
And simple as that, I can easily scan the internal server through the DMZ server.

00:05:29.040 --> 00:05:32.740
And take a look at this, the internal server has the port 80 open,

00:05:33.010 --> 00:05:34.460
which is probably a web server.

00:05:35.540 --> 00:05:36.110
Normally,

00:05:36.120 --> 00:05:38.600
you wouldn't be able to access this web page via

00:05:38.600 --> 00:05:41.690
the terminal or via the internet, but remember,

00:05:41.690 --> 00:05:42.710
we have ProxyChains.

00:05:42.710 --> 00:05:46.760
So you can just type proxychains and then firefox.

00:05:48.140 --> 00:05:51.860
Now, all our traffic from Firefox goes through the DMZ server.

00:05:52.340 --> 00:05:54.820
So if you want to access that internal web page,

00:05:54.820 --> 00:06:00.890
we can simply type http and then the internal IP that we want to access.

00:06:00.890 --> 00:06:05.910
And take a look, we just got access to the internal Globomantics HR server.

00:06:05.910 --> 00:06:06.460
In here,

00:06:06.460 --> 00:06:09.790
we just bypass all the firewalls and directly connect it to

00:06:09.790 --> 00:06:12.830
the internal web page from the internet.

00:06:12.830 --> 00:06:13.440
And from here,

00:06:13.440 --> 00:06:16.030
you can try to exploit this web page and go even

00:06:16.030 --> 00:06:18.600
further on your red team exercise.

00:06:18.600 --> 00:06:19.830
And in my opinion,

00:06:19.830 --> 00:06:23.360
that's why ProxyChains is one of the most used tools by red team specialists.