WEBVTT 00:00:00.540 --> 00:00:01.740 In this demonstration, 00:00:01.750 --> 00:00:06.450 we will look at how we can proxy traffic using an http_hop listener. 00:00:06.450 --> 00:00:09.960 Before we dive into the demo, let's revisit our diagram. 00:00:10.740 --> 00:00:13.020 Since we have already exploited the web server, 00:00:13.180 --> 00:00:17.550 we will create a new listener, which uses the http_hop functionality of Empire, 00:00:18.140 --> 00:00:22.550 and we will proxy traffic from the IT admin to the web server 00:00:22.940 --> 00:00:25.430 and from the web server to our listener, 00:00:25.710 --> 00:00:27.050 which resides on the internet. 00:00:27.500 --> 00:00:30.250 This will enable us to hide the traffic and evade 00:00:30.250 --> 00:00:34.300 detection since it will look as if the IT administrator is 00:00:34.300 --> 00:00:36.240 communicating with the web server. 00:00:36.240 --> 00:00:37.250 Let's dive in. 00:00:39.940 --> 00:00:44.050 We'll kick this demo off by creating an http_hop listener. 00:00:45.440 --> 00:00:46.140 In essence, 00:00:46.140 --> 00:00:50.100 what a hop listener does is it gives you the ability to use another 00:00:50.100 --> 00:00:53.960 server as a jump server back to your attacking machine. 00:00:54.890 --> 00:00:56.720 This is good to evade detection, 00:00:56.790 --> 00:01:01.060 and you can leverage this if you own a web server that your 00:01:01.060 --> 00:01:05.010 target is currently communicating to, as we have in our diagram. 00:01:05.010 --> 00:01:08.070 We will create this using Starkiller. 00:01:08.190 --> 00:01:11.160 The first thing we need to do is go ahead and create a listener. 00:01:11.540 --> 00:01:14.550 I will click on Listeners and CREATE LISTENER, 00:01:14.550 --> 00:01:17.120 and under the Type, I'm going to drop this down, 00:01:17.130 --> 00:01:19.340 and I'm going to choose http_hop. 00:01:19.390 --> 00:01:23.080 I can give it a descriptive name, but I will leave this as it is for now. 00:01:23.640 --> 00:01:26.900 And under Host, this is where I will define the web server. 00:01:27.100 --> 00:01:29.940 Now, remember, this web server I already own, 00:01:29.940 --> 00:01:33.870 so it will be easy to use as a hop or a jump server. 00:01:34.240 --> 00:01:36.230 I will leave the Port as port 80. 00:01:36.620 --> 00:01:38.770 The Launcher, I will use a powershell launcher, 00:01:39.840 --> 00:01:44.070 and I will define the output folder where the HTTP files will be dropped. 00:01:44.440 --> 00:01:46.460 Next, we have the RedirectListener. 00:01:46.470 --> 00:01:49.030 Now your RedirectListener is the listener that you 00:01:49.030 --> 00:01:51.370 want to use for the redirection. 00:01:51.840 --> 00:01:55.200 Since I already have a normal standard HTTP listener set up, 00:01:55.210 --> 00:01:57.170 I'm going to leave this as is. 00:01:57.460 --> 00:02:01.120 And under Optional Fields, I'm going to leave the defaults in place. 00:02:01.120 --> 00:02:04.470 I will click on SUBMIT, and if I go back to Listeners, 00:02:04.840 --> 00:02:07.150 I can see now that my listener is being created. 00:02:07.540 --> 00:02:11.650 Next, I need to set up a stager that's going to use this listener. 00:02:12.440 --> 00:02:18.310 So I'll click on Stagers, GENERATE STAGER, and I want to use a normal Windows 00:02:18.310 --> 00:02:22.750 VBS stager. Under my Listener, I'm going to select http_hop. 00:02:23.500 --> 00:02:28.040 I'll leave the Language as powershell. In Optional Fields, I'm just going to 00:02:28.040 --> 00:02:31.750 adjust the output file directory, and I'll click on SUBMIT, 00:02:32.440 --> 00:02:34.660 and this will create the launcher for me. 00:02:35.040 --> 00:02:40.760 Now, all I need to do is load this launcher on the target, and I 00:02:40.760 --> 00:02:43.770 need to copy the http_hop files to the web server. 00:02:44.240 --> 00:02:46.370 Let's take a look at the files that were created. 00:02:46.740 --> 00:02:50.150 I'll navigate to my File System under my home directory. 00:02:50.640 --> 00:02:51.700 I have the directory, 00:02:51.700 --> 00:02:56.670 which is called http_hop. Within http_hop, I have a number of files. 00:02:57.140 --> 00:03:02.120 In essence, what I need to do is I need to copy these files to the web server. 00:03:02.460 --> 00:03:05.490 I'll just navigate back, and you'll notice that we have the 00:03:05.490 --> 00:03:08.510 launcher that we've created with Starkiller. I've quickly 00:03:08.510 --> 00:03:11.560 switched to the Ubuntu machine, which is running the web server, 00:03:11.940 --> 00:03:14.890 and you'll notice that I have copied those files that was 00:03:14.890 --> 00:03:17.460 generated by the http_hop listener. 00:03:17.940 --> 00:03:21.060 Now what I will do is I will execute the launch on the target machine. 00:03:22.140 --> 00:03:24.390 Alright, so I've executed both launches, 00:03:24.510 --> 00:03:27.350 including the one which was set up for the http_hop 00:03:27.350 --> 00:03:29.510 listener Let's take a look at the agents, 00:03:29.520 --> 00:03:31.050 which shows up on Starkiller, 00:03:31.840 --> 00:03:34.780 and you'll see that I've got two agents that are reporting. 00:03:34.850 --> 00:03:36.740 These essentially are the same agents, 00:03:36.750 --> 00:03:39.920 but the IP addresses that they are coming from would be different. 00:03:40.240 --> 00:03:41.860 Let's take a look at the first agent. 00:03:42.640 --> 00:03:47.040 I'll issue the command sysinfo, and you'll notice the response here that 00:03:47.040 --> 00:03:52.150 the traffic is coming in via the 192.168.94.154 listener. 00:03:52.840 --> 00:03:56.950 Now I'll switch back to the second agent and issue the same command. 00:03:57.440 --> 00:04:03.190 In here, you'll see that the traffic is coming in via the 192.168.94.140 00:04:03.190 --> 00:04:07.610 listener. I'll jump back to the web server and issue the command ifconfig, 00:04:07.620 --> 00:04:13.990 and you'll see that the web server has an address of 192.168.94.154. And 00:04:13.990 --> 00:04:15.660 I've switched back to my Kali machine. 00:04:16.149 --> 00:04:18.829 So this shows me, now, that I've got two agents 00:04:18.829 --> 00:04:20.339 established from the same machine, 00:04:20.750 --> 00:04:24.080 the one is coming directly from the machine to my HTTP 00:04:24.080 --> 00:04:27.910 listener, and the other one is coming to my machine via the 00:04:27.910 --> 00:04:30.770 web server using the http_hop listener. 00:04:31.240 --> 00:04:35.260 This is a good technique to use if you want to evade detection and if you 00:04:35.260 --> 00:04:40.340 want to proxy or use various servers for jump hosts as you perform command 00:04:40.340 --> 00:04:43.000 and control capabilities on target machines.