Penetration Testing mailing list archives
RE: Netcat through Squid HTTP Proxy
From: "Todd Towles" <toddtowles () brookshires com>
Date: Tue, 19 Apr 2005 10:59:20 -0500
Joachim, You have your network setup correctly. You have layers of security (not just a all-in-one ISA proxy/firewall). You have a real firewall that blocks all outbound traffic from the client subnet (or however you ware blocking them). This makes all internet bound traffic have to go thru the proxy. Now throw in proxy gateway AV and a IPS system if you have the money. If you have it setup this way and don't have the proxy misconfigured in a huge way, you sound better than a lot of people in the world. Some proxies allow internet people access back into the network, etc. Can you stop a person from setting a server up at their house with TS enabled, or a custom SSL interface...maybe not, but that will try a employee or hacker that is targetting you and has prepared. I have found employees doing SSL webchat, because of the increases traffic to a certain SSL site that was alos owned by the employee. You can't stopped everything, but the less doors you have, the less locks you have to watch. Now keep a eye out on any weird SSL traffic or anything out of the normal...and you are on your way to a better network.
-----Original Message----- From: Rene Amirkhanian [mailto:rene.amirkhanian () nbs-system com] Sent: Tuesday, April 19, 2005 10:47 AM To: 'Henderson, Dennis K.' Cc: Todd Towles; 'Joachim Schipper'; pen-test () securityfocus com Subject: RE: Netcat through Squid HTTP Proxy Out of curiosity, how would one prevent access to a remote ssh server listenning on port 443? That always did the trick for me whenever it's allowed. Rene -----Original Message----- From: Henderson, Dennis K. [mailto:Dennis.Henderson () umb com] Sent: lundi 18 avril 2005 18:28 To: Todd Towles; Joachim Schipper; pen-test () securityfocus com Subject: RE: Netcat through Squid HTTP Proxy It seems like he was looking for information on how to prevent this. You can configure squid to only allow tunneling on certain ports like 443 and 80. You'll have to figure out what your safe ports are to prevent legitimate traffic from being impacted. I usually make sure the usual ports like ssh, telnet, irc are not allowed. Cheers Dennis-----Original Message----- From: Todd Towles [mailto:toddtowles () brookshires com] Sent: Monday, April 18, 2005 8:20 AM To: Joachim Schipper; pen-test () securityfocus com Subject: RE: Netcat through Squid HTTP Proxy There is a POC shell program that uses XML-RPC called Monkey shell (http://www.securiteam.com/tools/6L00F0KBFE.html). It looks like it might require a re-code to be fully used as a pen-test tool. But it something to look at. - You can try HTTPTunnel as well. httptunnel creates a bidirectional virtual data connectiontunnelledin HTTP requests. The HTTP requests can be sent via an HTTPproxy ifso desired. This can be useful for users behind restrictive firewalls. If WWW access is allowed through a HTTP proxy, it's possible to use httptunnel and, say, telnet or PPP to connect to a computer outside the firewall. http://www.nocrew.org/software/httptunnel.html -Todd-----Original Message----- From: Joachim Schipper [mailto:j.schipper () math uu nl] Sent: Sunday, April 17, 2005 10:13 AM To: pen-test () securityfocus com Subject: Re: Netcat through Squid HTTP Proxy On Fri, Apr 15, 2005 at 10:40:31AM -0400, Rod S wrote:Hello, I have a squid proxy server running, caching and filteringweb access.User workstations on my network are only allowed httpaccess throughthis proxy server. The firewall (Cisco PIX) will not letthem connectoutbound to any ports. I've done some testing and was successful in running netcatto connectto a remote server listening with netcat on port 80 and geta commandprompt for an internal machine (which is allowed toconnect to anyoutgoing ports) on that remote server. I'm wondering ifit's possiblefor netcat to connect through our proxy server to a remotemachine andsend a cmd.exe shell in the same way? Any tips onpreventing this orany other information you care to share is appreciated. Thanks! RodDear Rod, if I understand correctly, you can get a shell on a remotemachine andwant to allow a remote machine to get a shell on a localhost. Thiscan be achieved quite easily - search for 'reverse shell'.One examplewhich looks nice is rrs (*nix only) - see freshmeat.net. This one cannot do HTTPproxying, though,so it should be augmented or wrapped in something that can. The Hacker's Choice (www.thc.org) has just run an articleon this,including an example in Perl. If you desire something more Windows-specific, you may want to ask Google, or any shades-of-grey-hat site you can find. ;-) However, simply, yes, this is possible. Quite a few ofthese kinds ofreverse shells rely on HTTP CONNECT, so limiting that mayhelp - butthere are some seriously scary things out there,including reverseshells that communicate over DNS or ICMP (pings etc). A good I(P|D)S may help a little. Locking down the networkfurther mayhelp. However, it is almost impossible to keep a smartattacker in -make sure to keep him out. Joachim
Current thread:
- Netcat through Squid HTTP Proxy Rod S (Apr 17)
- Re: Netcat through Squid HTTP Proxy Joachim Schipper (Apr 17)
- <Possible follow-ups>
- RE: Netcat through Squid HTTP Proxy Todd Towles (Apr 18)
- RE: Netcat through Squid HTTP Proxy Otero, Hernan (EDS) (Apr 19)
- RE: Netcat through Squid HTTP Proxy Henderson, Dennis K. (Apr 19)
- Re: Netcat through Squid HTTP Proxy James Kearney (Apr 19)
- Re: Netcat through Squid HTTP Proxy Chris Kuethe (Apr 19)
- RE: Netcat through Squid HTTP Proxy Todd Towles (Apr 19)
- RE: Netcat through Squid HTTP Proxy JB (Apr 22)
- RE: Netcat through Squid HTTP Proxy Todd Towles (Apr 19)