RaspberryPi/Reverse SSH Stunnel - Revision history

Admin: /* Starting Stunnel on Boot */

2016-01-23T06:37:05Z

Starting Stunnel on Boot

← Older revision		Revision as of 06:37, 23 January 2016
Line 19:		Line 19:

	First, we want to make sure stunnel starts at boot.		First, we want to make sure stunnel starts at boot.

			<pre>
			$ /etc/init.d/stunnel4
			</pre>

	==SSH Command==		==SSH Command==

Admin at 03:50, 25 September 2015

2015-09-25T03:50:46Z

← Older revision		Revision as of 03:50, 25 September 2015
Line 168:		Line 168:


	~~[[Category:Networking]]~~		{{SSHFlag}}
	~~[[Category:Raspberry Pi]]~~		{{PiFlag}}
	~~[[Category:Kali]]~~		{{KaliFlag}}
	~~[[Category:SSH]]~~

Admin: /* Test It Out */

2015-08-04T21:47:34Z

Test It Out

← Older revision		Revision as of 21:47, 4 August 2015
Line 160:		Line 160:
	=Test It Out=		=Test It Out=

			First, power down the Pi.

			Now plug in the Pi. Let it go through its boot sequence.

			In the boot sequence, it will start the stunnel and reverse ssh scripts, allowing the reverse SSH tunnel to be made.

Admin: /* Putting It All Together */

2015-08-04T21:41:59Z

Putting It All Together

← Older revision		Revision as of 21:41, 4 August 2015
Line 155:		Line 155:

	This reverse connection is available on the command and control server at port 2201.		This reverse connection is available on the command and control server at port 2201.



			=Test It Out=

Admin: /* Putting It All Together */

2015-08-04T21:41:23Z

Putting It All Together

← Older revision		Revision as of 21:41, 4 August 2015
Line 123:		Line 123:
	start)		start)
	echo "Opening reverse shell"		echo "Opening reverse shell"
	/usr/bin/ssh -R 2201:localhost:22 -p 2200 root@localhost		/usr/bin/ssh -R 2201:localhost:22 -p 2200 root@localhost -f -N
	;;		;;
	stop)		stop)
Line 143:		Line 143:

	<pre>		<pre>
	ssh -R 2201:localhost:22 -p 2200 root@localhost		ssh -R 2201:localhost:22 -p 2200 root@localhost -f -N
	</pre>		</pre>

Line 149:		Line 149:

	This will also create a reverse connection, using the same connection (the reverse connection is maintained, from port 2200, through port 443, through stunnel, through the SSL encryption layer, and out to the command and control server).		This will also create a reverse connection, using the same connection (the reverse connection is maintained, from port 2200, through port 443, through stunnel, through the SSL encryption layer, and out to the command and control server).

			<code>-f</code> runs SSH in the background.

			<code>-N</code> doesn't run any commands on the remote server, it just opens the port.

	This reverse connection is available on the command and control server at port 2201.		This reverse connection is available on the command and control server at port 2201.

Admin: /* The Pieces */

2015-08-04T21:37:49Z

The Pieces

@@ Line 57: / Line 57: @@
 <pre>
-$ ssh -R 2201:localhost:22 -p 2200 root@localhost
+$ ssh -R 2201:localhost:22 -p 443 root@localhost
 </pre>
@@ Line 100: / Line 100: @@
 [[Image:StunnelReverseSSHSuccess2.png|500px]]

Admin: /* SSH Command */

2015-08-04T21:31:43Z

SSH Command

← Older revision		Revision as of 21:31, 4 August 2015
Line 20:		Line 20:
	First, we want to make sure stunnel starts at boot.		First, we want to make sure stunnel starts at boot.

	=SSH Command=		==SSH Command==

			The next piece to determine is the SSH command.

	To SSH from the Raspberry Pi client to the Command and Control server, we must pick a port number for the forward and reverse SSH connections.		To SSH from the Raspberry Pi client to the Command and Control server, we must pick a port number for the forward and reverse SSH connections.

Admin: /* Stunnel */

2015-08-04T21:31:28Z

Stunnel

← Older revision		Revision as of 21:31, 4 August 2015
Line 14:		Line 14:
	* reverse ssh command to be modified		* reverse ssh command to be modified

	=~~Stunnel~~=		=The Pieces=

	~~To get stunnel to start~~ on ~~startup:~~		==Starting Stunnel on Boot==

			First, we want to make sure stunnel starts at boot.

	=SSH Command=		=SSH Command=

Admin at 21:30, 4 August 2015

2015-08-04T21:30:23Z

← Older revision		Revision as of 21:30, 4 August 2015
Line 17:		Line 17:

	To get stunnel to start on startup:		To get stunnel to start on startup:


			=SSH Command=

			To SSH from the Raspberry Pi client to the Command and Control server, we must pick a port number for the forward and reverse SSH connections.

			Everything involved with the SSH connection will be carried over the SSL connection, so regardless of what ports we choose for the forward and reverse SSH connections, they'll all be on the local machine - all the traffic will still travel over the SSL connection on the HTTPS port (443).

			First, our configuration file on the Command and Control server:

			<pre>
			output = /var/log/stunnel4/stunnel.log
			cert=/etc/ssl/stunnel.pem
			key=/etc/ssl/stunnel.pem
			pid=/var/run/stunnel.pid
			client=yes
			[ssh]
			accept = 443
			connect = 127.0.0.1:22
			</pre>

			Next, our configuration on the Raspberry Pi client:

			<pre>
			output = /var/log/stunnel4/stunnel.log
			cert=/etc/stunnel/stunnel.pem
			key=/etc/stunnel/stunnel.pem
			pid=/var/run/stunnel4/stunnel.pid
			client=yes
			[ssh]
			accept = 2200
			connect = 10.0.0.19:443
			</pre>

			This makes our final SSH command look like:

			<pre>
			$ ssh -R 2201:localhost:22 -p 2200 root@localhost
			</pre>

			This creates a forward connection on the Raspberry Pi port 2200, and a reverse connection on the Command and Control server on port 2201.

			When we run this from the Raspberry Pi, we should get a command prompt at the Command and Control server:

			<pre>
			root@kali-pi:/etc/stunnel# ssh -R 2201:localhost:22 -p 2200 root@localhost
			Linux kronos 3.18.0-kali3-amd64 #1 SMP Debian 3.18.6-1~kali2 (2015-03-02) x86_64

			The programs included with the Kali GNU/Linux system are free software;
			the exact distribution terms for each program are described in the
			individual files in /usr/share/doc/*/copyright.

			Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
			permitted by applicable law.
			Last login: Tue Aug 4 14:28:39 2015 from localhost
			Cannot open display "default display"
			root@kronos:~#
			</pre>

			[[Image:StunnelReverseSSHSuccess.png\|500px]]


			And now we can also do the reverse. Once that SSH connection is open, we can also SSH to the Raspberry Pi from the command and control server:

			<pre>
			root@kronos:~# ssh -p 2201 root@localhost
			Linux kali-pi 3.12.36 #1 PREEMPT Fri Apr 10 23:27:49 CDT 2015 armv6l

			The programs included with the Kali GNU/Linux system are free software;
			the exact distribution terms for each program are described in the
			individual files in /usr/share/doc/*/copyright.

			Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
			permitted by applicable law.
			Last login: Tue Aug 4 21:19:20 2015 from localhost
			root@kali-pi:~#
			</pre>

			[[Image:StunnelReverseSSHSuccess2.png\|500px]]



			[[Category:Networking]]
			[[Category:Raspberry Pi]]
			[[Category:Kali]]
			[[Category:SSH]]

Admin: /* What We Will Do */

2015-08-04T21:02:02Z

What We Will Do

← Older revision		Revision as of 21:02, 4 August 2015
Line 13:		Line 13:
	* stunnel service to start on startup		* stunnel service to start on startup
	* reverse ssh command to be modified		* reverse ssh command to be modified

			=Stunnel=

			To get stunnel to start on startup: