Saturday, July 14, 2012

Opening closed ports on NAT device and bypassing stateful firewalls with BeEF

Today's guest post comes from Bart Leppens. Thank you!

In 2010 Samy Kamkar discovered a method that he called "NAT Pinning."  The idea was, an attacker lures a victim to a web page and that web page forces the victim's router or firewall to forward any port number back to the user's machine.  The router, firewall, NAT-device must support connection tracking.  Samy Kamkar has successfully tested this on a Belkin N1 Vision Wireless Router.

Now, IRC NAT Pinning is integrated in BeEF as a module. It requires the victim to use Firefox due to blocked port number 6667 in most other browsers.  In this example, iptables is used to demonstrate how it actually works.

Let's imagine the following network:

And the configuration for iptables on the NAT/firewall:
 
#! /bin/sh

# DEFs
OUTIF=eth0
LANIF=eth1
LAN=192.168.1.0/24

# MODULES
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe iptable_nat

# Cleaning
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

# Kernel vars
echo 1 > /proc/sys/net/ipv4/ip_forward

# Allow unlimited traffic on the loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Set default policies
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP

# Previously initiated and accepted exchanges bypass rule checking
# Allow unlimited outbound traffic
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow inbound traffic on LAN
iptables -A INPUT -i $LANIF -j ACCEPT

# NAT
##########
iptables -t nat -A POSTROUTING -o $OUTIF -j MASQUERADE

# initiated and accepted exchanges from WAN to LAN
iptables --append FORWARD -m state --state ESTABLISHED,RELATED -i $OUTIF -o $LANIF -j ACCEPT

# Allow unlimited outbound traffic from LAN to WAN
iptables --append FORWARD -m state --state NEW,ESTABLISHED,RELATED -o $OUTIF -i $LANIF -j ACCEPT


iptables -A INPUT -j LOG --log-level debug
iptables -A INPUT -j DROP
iptables -A FORWARD -j LOG --log-level debug
iptables -A FORWARD -j DROP


Iptables must accept RELATED inbound connections and the IRC connection tracking modules must be loaded.

Suppose that machine with IP 192.168.1.100 has an Apache-webserver running on port 80 to serve some intranet, and that this site is normally not reachable from the outside (probably the Internet).

When the attack is executed, BeEF creates a temporary socket that listens on port 6667 for incoming TCP connections. The demo used netcat for this "nc -l -p 6667", but thanks to Antisnatchor, this isn't needed anymore!

Once this is done, we must fill in the correct parameters in BeEF and then try if the port has been opened. 

This can be seen on the following video:



The same can be attempted without NAT.  In this case a stateful firewall (e.g. iptables) also needs to accept RELATED inbound connections and the IRC Connection Tracking module must be loaded.


Imagine now that telnetd is running on the victims machine, but it isn't reachable due to the packet filtering of the firewall.  In BeEF, you can do this exactly as shown before. But, in this case, the private IP is the victim's public IP and the private port is the telnet port (probably 23).

If you're using iptables and you want to avoid problems with connection tracking, please refer to the secure use of iptables and connection tracking helpers.  These are the best practices to make use of connection trackers.

89 comments:

  1. I think in the top image the gateway ip's address should be 72.12.13.4, is that correct? at least that's what i see in the video at the end....

    So...You can control the internal ip also on which the forward is done?

    ReplyDelete
  2. Yes, the gateway ip should be 72.12.13.4. My bad!
    The internal IP can be fully controlled and doesn't need to be the victims IP one.

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. Hi,

    I have contributed a script for Nmap a while back that checks for vulnerable firewalls based on Eric Leblond's work on opensvc ( https://home.regit.org/2012/06/opensvp-a-new-tool-to-analyse-the-security-of-firewalls-using-algs/ ). You can find the script here, http://nmap.org/nsedoc/scripts/firewall-bypass.html

    Cheers,
    Hani.

    ReplyDelete
    Replies
    1. That's just fantastic Hani! I'll look at it more in detail.

      Delete
  5. Actually, I have investigated this issue.
    But it's difficult to explain in 2 words.
    Thus, read here - essay writing service.

    ReplyDelete
  6. Looking for a decent paper writing service? Wanna save your time? Try out this service, guys!

    ReplyDelete
  7. I Studied in my university life at CiscoPacket and now i have find something new for you and that is Research Paper Help Online which is best for all student

    ReplyDelete
  8. This article is very nice as well as very informative. I have known very important things over here. I want to thank you for this informative read net worth

    ReplyDelete
  9. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  10. All Online Assignment help is a web portal where students get help in making assignments for all the subjects, with the help of our experts. You will get 100% plagiarism free assignment. Expert’s consultation is also available for students. If they have any query they can contact with our experts anytime.

    ReplyDelete
  11. Acquire custom essay help via one of the experts of the MyAssignmenthelp which offers affordable writers assistance and essay writing service online in the UK.We have team of essay writer in UK who offer quality & timely essay help & essay writing service UK at affordable prices,Get the fullest satisfaction and discounts from our writing assistance!

    ReplyDelete
  12. My Assignment Services, is well-known for its 24-hour online Assignment Help on the WhatsApp platform. Students can reach out to us with their queries at any point of the day or night and get the most effective solutions for them. University assessments have to follow specific referencing and citation styles like Harvard, APA, Chicago and MLA. Also, they should be referenced only from credible academic sources. Our best online academic help experts talk about how to select and evaluate the right academic sources, which will help you clear all your academic-related doubts. Assignment Service by My Assignment Services has been trusted by millions of students worldwide for over a decade. We have been providing complete academic assistance to students struggling with their college and university tasks. We have a team of dedicated subject matter experts who maintain a 100% record of submitting orders well before the deadline. This also gives the students some time to review them and ask for revisions, if needed. You can trust our academic ghostwriters completely to get best quality write-ups including case studies, research proposals, dissertations and Assignment Help Melbourne, and more.

    ReplyDelete
  13. Sample Assignment provides an all-year long assignment help Adelaide While providing the academic aid, we foresee ourselves to be known as the chosen one academic consultants like Nursing, IT, Law, Marketing, Economics, Accounting, Statistics, etc. are some of the subjects to name that we cater to the Australian students in. We were recently recognised as the most reliable and dependable statistics assignment help service, and also voted as the Numero Uno assignment provider for the past two years. The academic assignment maker have been using their past experience and knowledge in order to supply the students with HD grade assignments including dissertations, essays, thesis, reports, journals, reflections, case study analysis, etc. There are many companies in the industry which functioning at skyrocketed prices. Be it accounting assignment help, marketing assignment help, java assignment help, taxation assignment help; we proffer our expert guidance in all of the assignments.

    ReplyDelete
  14. My Dissertation Services is well-known for its 24-hour online Dissertation Help provide. Students can reach out to us with their queries at any point of the day or night and get the most effective solutions for them. We provide the best dissertation service.

    ReplyDelete
  15. Amazing blog with the latest information. Your blog helps me to improve myself in many ways. Looking forward for more like this.
    AllAssignmenthelp.com reviews

    ReplyDelete
  16. Thank you for sharing this information, I will apply it now
    angry birds 2

    ReplyDelete
  17. The article is easy to understand, detailed and meticulous! I had a lot of harvest after watching this article from you! I found it interesting, your article gave me a new perspective! I have read many other articles on the same topic, but your article convinced me

    fnaf

    ReplyDelete
  18. All You Need To Know About cdr reports As Engineering Students

    ReplyDelete
  19. Our academic writers at assignment studio can help you with your constitutional law assignments. As they not only have studied the same but they have the industry experience as well.
    For further information & queries, Visit our website constitutional law assignment help

    ReplyDelete
  20. Assignment studio not only offers students with a complete assignment work that is done from the scratch by the writers but also offers professional advice to the students who are stuck in the middle of their assignment work. We make sure that the student would get the best advice possible for their assignments. Furthermore, the Assignment studio also makes sure that the students get the quality of assignment that they desire for. Any changes in the assignments that the student desired are done without any charge.
    For further information & queries, Visit our website http://assignmentstudio.net/online-assignment-help/

    ReplyDelete
  21. Amazing Article ! I have bookmarked this article page as i received good information from this. www.appslure.com

    ReplyDelete
  22. Buy online co ord set collections from Indianochre.com. There is a large variety available to choose from. Various latest prints and designs that will suit your personality better.
    Online Women Clothing Delhi
    Womens Jackets Collection

    ReplyDelete
  23. Need Academic Assignment Help?
    Get Assignment Help from Australia's No.1 Assignment Help Service.
    For further information & queries, visit our website academic help

    ReplyDelete
  24. Assignment Studio is a well reputed name in the market, its been around for over seven years and have helped over thousands of students with their essays, case studies, dissertation, reports and other university assignments. Our work speak for itself, we get most of our work through word of mouth and referrals, because we delivery quality work on time. If you are after an assignment for yourself, get in touch now and get one of our professional essay writers to help you.
    For further information queries visit our website essay help

    ReplyDelete
  25. All clients seeking assistance with our Term Paper Writing Help Services services are assured 24/7 access to the customer service department which addresses all the issues they may have on the Cheap Online Assignment Services being completed.

    ReplyDelete
  26. All material used to manufacture eyeshadow boxes at wholesale and for packaging of your eyeshadows is 100% recyclable and eco-friendly. Our custom packaging boxes are famous for catering to all sorts of orders in the fastest turnaround time. Place your orders today and take advantage of free doorstep delivery. You can also save costs by ordering bulk quantities and availing special discounts.

    ReplyDelete
  27. Your blog is filled with unique good articles! I was impressed how well you express your thoughts.
    Top 10 Samsung Smart TV Apps

    ReplyDelete
  28. Online Assignment Help
    There are various websites in Australia that proclaim to provide best essay writing services in the country. These websites also proclaim that they have the best professional writers, who can do this job with perfection but generally that’s not the case.

    ReplyDelete
  29. The education provided by Australian institutes is highly valued and recognized globally. There are more than 200, 000 international students who have preferred to Study in Australia.

    ReplyDelete
  30. This comment has been removed by the author.

    ReplyDelete
  31. It is a great article. You will surely like this also because it is a great stuff
    Potty Racers

    ReplyDelete
  32. Research Papers Writing Services should strive to ensure that all essays meets the pukka standards of the examining bodies. Consider hiring quality but also Qualified Research Paper Writers which are advantageous in terms of ensuring you get only top-quality grades on your Online Research Paper Writing Service.

    ReplyDelete
  33. Thanks for sharing information with us to get any kind of medical help you can visit out site name myfloridagreen.com.Or if you want to get medical marijuana card sarasota we can also assist you with this.

    ReplyDelete
  34. kepuasan dalam bercinta bisa didapatkan pasangan dengan cara melakukan foreplay terlebih dahulu diawal hubungan untuk meningkatkan semangat wanita dalam bercinta dengan mengadopsi cialis asli 80 mg cod di jakarta pusat sebagai obat untuk pembangkit libido pria. read more . tak heran jika pasutri membutuhkan kepuasan dalam berhubungan agar bisa terciptanya suatu hubungan yang romantis. cialis asli 80 mg dapat memberikan kepuasan yang anda dambakan bersama pasangan ketika sedang bercinta. bagi anda yang ingin mencapai klimaks bisa mengonsumsi cialis 80 mg original agar istri anda bisa selalu merasakan kepuasan dalam bercinta dengan anda. obat kuat cialis termasuk salah satu obat untuk pembangkit semangat pria saat diranjang agar selalu tampil perkasa bersama pasangan. vimax oil juga bagus untuk pria yang ingin memperbaiki alat vital agar istri bisa lebih senang dengan ukuran yang besar dan panjang klik selengkapnya .

    ReplyDelete
  35. This comment has been removed by the author.

    ReplyDelete

  36. ยิงปลาออนไลน์ แจกโบนัสมากมาย slot online
    https://www.live22easy.com/

    ReplyDelete
  37. We install new air conditioning,Commercial kitchen hood installation Los Angeles, warming and ventilation equipment just as business kitchen exhaust systems including exhaust oil conduits, make-up air systems and bog coolers. We install refrigeration equipment including stroll in coolers, stroll in coolers and ice machines.

    ReplyDelete
  38. Your blog is really imformative for us, for more work you can check it out for free mykfcexperience

    ReplyDelete

  39. نجار بالرياض نجار بالرياض
    تركيب ستائر بالرياض تركيب ستائر بالرياض
    تنظيف مكيفات بالرياض تنظيف مكيفات بالرياض
    شركة تنظيف افران الغاز بالرياض شركة تنظيف افران الغاز بالرياض
    تركيب اثاث ايكيا بالرياض تركيب اثاث ايكيا بالرياض
    تركيب مكيفات بالرياض تركيب مكيفات بالرياض

    ReplyDelete
  40. Data Dynamics was established to provide cost-effective strategic IT consulting services to organizations. Since our birth, our goal has been to partner with our clients and help them achieve competitive advantage in the market place. We pride ourselves in being vendor agnostic and technology neutral. To us it’s all about business with technology being a means to an end. Being the most trusted advisor, we help our clientele overcome challenges, mitigate risks, and identify and capitalize on opportunities.
    software development company in USA

    ReplyDelete
  41. I loved the way you discuss the topic great work thanks for the share Your informative post best hd video downloader.

    ReplyDelete
  42. I really loved reading your blog. It was very well authored and easy to understand. Your blog put really very helpful information. Thank you for sharing superb information…
    Custom Packaging Boxes

    ReplyDelete
  43. The most challenging thing in student life is when you run out of money and you have to hire writing service like cost accounting assignment help. Keeping this situation in mind our Academic Writing Experts provides the best assignment help service at most affordable price in Australia.

    ReplyDelete
  44. Assignment help Australia offers attractive deals for students looking for quality assignment help from Aussie writers. We have a resourceful team of experienced and subject-specific assignment tutors, dedicated to assist students with the authentic academic support. Our team is available 24x7 to help students on a plethora of case studies, assignments, essays, coursework and more.

    ReplyDelete
  45. While mapping out firewall rules can be valuable, bypassing rules is often the primary goal.

    apk

    ReplyDelete
  46. Custom bath bombs have gained popularity due to customer's modern choice and fierce competition. Bath bomb packaging designed with ravishing designs give a charismatic look to the product. The uniqueness of the custom bath bomb box will not only give a subtle look to your product but will also get you maximum market share. custom boxes wholesale are for their product's success therefore they spend their hard earned income to design a unique box.

    ReplyDelete
  47. It is a great article. You will surely like this also because it is a great stuff site

    ReplyDelete
  48. When it comes to your academic dreams and grades we try to give our best by supporting you in completing your college assignments.
    Our administrative experts work dedicatedly and passionately to provide top quality essay writing help to the students. Meticulous paper structures,
    subject matter relevance, free from grammatical errors are main characteristics that our highly experienced and talented writers endeavor for.
    Still drowning in the worry to complete your college assignments?

    Assignment helpers Online

    ReplyDelete
  49. This comment has been removed by the author.

    ReplyDelete
  50. airgunmaniac 2020 air rifle reviews. We help you choose the most suitable air gun for your needs and budget.

    ReplyDelete
  51. Nursing subject is considered as a least field which requires academic assignment writing skills yet it demands significant amount of academic comprehensive works with short deadlines.
    It becomes a difficult task for students especially with nursing as it is a more practical subject than theory.
    And if you are searching for a reliable site amidst so many swarming on the internet then Unique Submission assignment writing services is the one you have been looking for.

    Get help for Nursing Assignments


    ReplyDelete
  52. Most of the students are fascinated with opting Law as a career. A good academic record leads to a good placement also. Unique Submission law assignment writing help services are here to take off the burden of multiple assignment writing topics from your shoulders. Here our law subject expert writers will ensure to get you peerless outcomes with their law assignments help on the comprehensive writing academic field.

    Law assignment writing help


    ReplyDelete
  53. Opting Operations management as a career has been a popular choice in management students. Unique Submission endeavors to yield best assignment on operation

    management service to the students seeking to become operations manager. As completing academic assignments become tiresome for students they are in

    continuous search for help.

    Operations Assignment writing services


    ReplyDelete
  54. I do accept as true with all the ideas you’ve offered in your post. They are very convincing and can definitely work. Assignment Editing Services

    ReplyDelete
  55. We at Indias Fastest News We try To provide the true side of the news, facts which are happening all over the globe

    IFN Website

    ReplyDelete
  56. If you want to stay updates with the latest technology related news we write different articles which includes Full Comparison | Specifications |Reviews. Do Check The website

    For All latest Technology related news

    ReplyDelete
  57. This comment has been removed by the author.

    ReplyDelete
  58. In 2015 I was forced into retirement because of back problems and keeping busy is important. Its been a great journey of rediscovery. I’ve been a creative person my entire life, a welder fitter, small engine mechanic, started several businesses, very entrepreneurial, good work ethic, good values and motivated, very mechanically inclined, always learning, and my thirst for learning new things is so very strong. I am involved with amazing artist groups Like Artisan Northwest, (Thunder Bay) and South Niagara Artists and Wood Creations, Wood Turning Artist, Wood Turning Services, Wood Turning Ontario

    ReplyDelete
  59. Finally, you need to make sure that you use the product in the right way and that you follow the directions closely. Failure to do so could result in an infection or even cause you to become ill. The best option would be to use alcohol disinfectant spray to drive the best results with the least risk.Our services are sanitizing services, sanitizing companies, disinfecting services, house sanitizing services, disinfect cleaning services and chicago commercial cleaning services.

    ReplyDelete
  60. Hi, this is a wonderful piece of writing. I want to say that a nursing professional portfolio is a must-have document for every nurse. It contains everything a nurse needs in their career. The idea is to collect everything and have it in one place to easily trace them whenever you need them. There are nursing students who finding compiling the documents and putting them in one place difficult and opt to look for help in a platform like Nursing Professional Portfolio Writing Help . Luckily, we are always here to help.

    ReplyDelete
  61. It is very informative post thanks for sharing the information.
    rigid apparel boxes

    ReplyDelete
  62. Such a great post I like it very much to keep it up.
    bakery boxes wholesale

    ReplyDelete
  63. great post. helpful.

    we are providing high quality of custom boxes in all over the world with free shipping.
    shower bomb boxesshower bomb boxes
    custom burger boxescustom burger boxes
    custom bakery boxescustom bakery boxes.
    every kind of custom boxes we are providing.

    ReplyDelete
  64. Assignment Help
    Order Assignment help Secure Highest Grades at a lowest price.service provided by MyAssignmenthelp.com.au 500+ PhD writers.100% Original Research. 24x7 online help.There are many assignment Help service providers out there in the market but are those service providers Australian , U.k And U.s.a based companies
    Assignment Help

    ReplyDelete
  65. Bath Bomb Boxes are uncommon endowments so their packaging ought to likewise be novel and imaginative.bath bomb boxes are a perfect method.

    ReplyDelete
  66. GBWhatsApp by HeyMods is not available on play store but you can install its apk by downloading from the button above GB Whatsapp Since Whatsapp doesn’t allow anybody to develop mod of their application.

    ReplyDelete
  67. OREO TV MOD APK (Premium) is an application that allows users to watch TV shows anywhere with just a smartphone.

    ReplyDelete
  68. This is such a great resource that you are providing and you give it away for free. I love seeing blog that understand the value of providing a quality resource for free. Keep up the good work - COC MOD and GBWhatsapp

    ReplyDelete
  69. Thanks for sharing a piece of knowledgeable information with us, I got some valuable information in your article. It was awesome to read it. keep sharing great content with us.
    diary with power bank

    ReplyDelete
  70. I really appreciate the kind of topics you post here. Thanks for sharing a piece of great information that is actually helpful. Good day! https://kinemastermods.com/kinemaster-for-pc/

    ReplyDelete
  71. Thanks for the detailed article on this topic. I would like to see more such awesome articles from you. Download GBWhatsApp APK

    ReplyDelete