Saturday, July 14, 2012

Opening closed ports on NAT device and bypassing stateful firewalls with BeEF

Today's guest post comes from Bart Leppens. Thank you!

In 2010 Samy Kamkar discovered a method that he called "NAT Pinning."  The idea was, an attacker lures a victim to a web page and that web page forces the victim's router or firewall to forward any port number back to the user's machine.  The router, firewall, NAT-device must support connection tracking.  Samy Kamkar has successfully tested this on a Belkin N1 Vision Wireless Router.

Now, IRC NAT Pinning is integrated in BeEF as a module. It requires the victim to use Firefox due to blocked port number 6667 in most other browsers.  In this example, iptables is used to demonstrate how it actually works.

Let's imagine the following network:

And the configuration for iptables on the NAT/firewall:
 
#! /bin/sh

# DEFs
OUTIF=eth0
LANIF=eth1
LAN=192.168.1.0/24

# MODULES
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe iptable_nat

# Cleaning
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

# Kernel vars
echo 1 > /proc/sys/net/ipv4/ip_forward

# Allow unlimited traffic on the loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Set default policies
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP

# Previously initiated and accepted exchanges bypass rule checking
# Allow unlimited outbound traffic
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow inbound traffic on LAN
iptables -A INPUT -i $LANIF -j ACCEPT

# NAT
##########
iptables -t nat -A POSTROUTING -o $OUTIF -j MASQUERADE

# initiated and accepted exchanges from WAN to LAN
iptables --append FORWARD -m state --state ESTABLISHED,RELATED -i $OUTIF -o $LANIF -j ACCEPT

# Allow unlimited outbound traffic from LAN to WAN
iptables --append FORWARD -m state --state NEW,ESTABLISHED,RELATED -o $OUTIF -i $LANIF -j ACCEPT


iptables -A INPUT -j LOG --log-level debug
iptables -A INPUT -j DROP
iptables -A FORWARD -j LOG --log-level debug
iptables -A FORWARD -j DROP


Iptables must accept RELATED inbound connections and the IRC connection tracking modules must be loaded.

Suppose that machine with IP 192.168.1.100 has an Apache-webserver running on port 80 to serve some intranet, and that this site is normally not reachable from the outside (probably the Internet).

When the attack is executed, BeEF creates a temporary socket that listens on port 6667 for incoming TCP connections. The demo used netcat for this "nc -l -p 6667", but thanks to Antisnatchor, this isn't needed anymore!

Once this is done, we must fill in the correct parameters in BeEF and then try if the port has been opened. 

This can be seen on the following video:



The same can be attempted without NAT.  In this case a stateful firewall (e.g. iptables) also needs to accept RELATED inbound connections and the IRC Connection Tracking module must be loaded.


Imagine now that telnetd is running on the victims machine, but it isn't reachable due to the packet filtering of the firewall.  In BeEF, you can do this exactly as shown before. But, in this case, the private IP is the victim's public IP and the private port is the telnet port (probably 23).

If you're using iptables and you want to avoid problems with connection tracking, please refer to the secure use of iptables and connection tracking helpers.  These are the best practices to make use of connection trackers.

54 comments:

  1. I think in the top image the gateway ip's address should be 72.12.13.4, is that correct? at least that's what i see in the video at the end....

    So...You can control the internal ip also on which the forward is done?

    ReplyDelete
  2. Yes, the gateway ip should be 72.12.13.4. My bad!
    The internal IP can be fully controlled and doesn't need to be the victims IP one.

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. Hi,

    I have contributed a script for Nmap a while back that checks for vulnerable firewalls based on Eric Leblond's work on opensvc ( https://home.regit.org/2012/06/opensvp-a-new-tool-to-analyse-the-security-of-firewalls-using-algs/ ). You can find the script here, http://nmap.org/nsedoc/scripts/firewall-bypass.html

    Cheers,
    Hani.

    ReplyDelete
    Replies
    1. That's just fantastic Hani! I'll look at it more in detail.

      Delete
  5. Actually, I have investigated this issue.
    But it's difficult to explain in 2 words.
    Thus, read here - essay writing service.

    ReplyDelete
  6. Looking for a decent paper writing service? Wanna save your time? Try out this service, guys!

    ReplyDelete
  7. I Studied in my university life at CiscoPacket and now i have find something new for you and that is Research Paper Help Online which is best for all student

    ReplyDelete
  8. This article is very nice as well as very informative. I have known very important things over here. I want to thank you for this informative read net worth

    ReplyDelete
  9. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  10. All Online Assignment help is a web portal where students get help in making assignments for all the subjects, with the help of our experts. You will get 100% plagiarism free assignment. Expert’s consultation is also available for students. If they have any query they can contact with our experts anytime.

    ReplyDelete
  11. Acquire custom essay help via one of the experts of the MyAssignmenthelp which offers affordable writers assistance and essay writing service online in the UK.We have team of essay writer in UK who offer quality & timely essay help & essay writing service UK at affordable prices,Get the fullest satisfaction and discounts from our writing assistance!

    ReplyDelete
  12. My Assignment Services, is well-known for its 24-hour online Assignment Help on the WhatsApp platform. Students can reach out to us with their queries at any point of the day or night and get the most effective solutions for them. University assessments have to follow specific referencing and citation styles like Harvard, APA, Chicago and MLA. Also, they should be referenced only from credible academic sources. Our best online academic help experts talk about how to select and evaluate the right academic sources, which will help you clear all your academic-related doubts. Assignment Service by My Assignment Services has been trusted by millions of students worldwide for over a decade. We have been providing complete academic assistance to students struggling with their college and university tasks. We have a team of dedicated subject matter experts who maintain a 100% record of submitting orders well before the deadline. This also gives the students some time to review them and ask for revisions, if needed. You can trust our academic ghostwriters completely to get best quality write-ups including case studies, research proposals, dissertations and Assignment Help Melbourne, and more.

    ReplyDelete
  13. Sample Assignment provides an all-year long assignment help Adelaide While providing the academic aid, we foresee ourselves to be known as the chosen one academic consultants like Nursing, IT, Law, Marketing, Economics, Accounting, Statistics, etc. are some of the subjects to name that we cater to the Australian students in. We were recently recognised as the most reliable and dependable statistics assignment help service, and also voted as the Numero Uno assignment provider for the past two years. The academic assignment maker have been using their past experience and knowledge in order to supply the students with HD grade assignments including dissertations, essays, thesis, reports, journals, reflections, case study analysis, etc. There are many companies in the industry which functioning at skyrocketed prices. Be it accounting assignment help, marketing assignment help, java assignment help, taxation assignment help; we proffer our expert guidance in all of the assignments.

    ReplyDelete
  14. My Dissertation Services is well-known for its 24-hour online Dissertation Help provide. Students can reach out to us with their queries at any point of the day or night and get the most effective solutions for them. We provide the best dissertation service.

    ReplyDelete
  15. Amazing blog with the latest information. Your blog helps me to improve myself in many ways. Looking forward for more like this.
    AllAssignmenthelp.com reviews

    ReplyDelete
  16. Thank you for sharing this information, I will apply it now
    angry birds 2

    ReplyDelete
  17. The article is easy to understand, detailed and meticulous! I had a lot of harvest after watching this article from you! I found it interesting, your article gave me a new perspective! I have read many other articles on the same topic, but your article convinced me

    fnaf

    ReplyDelete
  18. All You Need To Know About cdr reports As Engineering Students

    ReplyDelete
  19. Our academic writers at assignment studio can help you with your constitutional law assignments. As they not only have studied the same but they have the industry experience as well.
    For further information & queries, Visit our website constitutional law assignment help

    ReplyDelete
  20. Assignment studio not only offers students with a complete assignment work that is done from the scratch by the writers but also offers professional advice to the students who are stuck in the middle of their assignment work. We make sure that the student would get the best advice possible for their assignments. Furthermore, the Assignment studio also makes sure that the students get the quality of assignment that they desire for. Any changes in the assignments that the student desired are done without any charge.
    For further information & queries, Visit our website http://assignmentstudio.net/online-assignment-help/

    ReplyDelete
  21. Amazing Article ! I have bookmarked this article page as i received good information from this. www.appslure.com

    ReplyDelete
  22. Buy online co ord set collections from Indianochre.com. There is a large variety available to choose from. Various latest prints and designs that will suit your personality better.
    Online Women Clothing Delhi
    Womens Jackets Collection

    ReplyDelete
  23. Need Academic Assignment Help?
    Get Assignment Help from Australia's No.1 Assignment Help Service.
    For further information & queries, visit our website academic help

    ReplyDelete
  24. Assignment Studio is a well reputed name in the market, its been around for over seven years and have helped over thousands of students with their essays, case studies, dissertation, reports and other university assignments. Our work speak for itself, we get most of our work through word of mouth and referrals, because we delivery quality work on time. If you are after an assignment for yourself, get in touch now and get one of our professional essay writers to help you.
    For further information queries visit our website essay help

    ReplyDelete
  25. All clients seeking assistance with our Term Paper Writing Help Services services are assured 24/7 access to the customer service department which addresses all the issues they may have on the Cheap Online Assignment Services being completed.

    ReplyDelete
  26. All material used to manufacture eyeshadow boxes at wholesale and for packaging of your eyeshadows is 100% recyclable and eco-friendly. Our custom packaging boxes are famous for catering to all sorts of orders in the fastest turnaround time. Place your orders today and take advantage of free doorstep delivery. You can also save costs by ordering bulk quantities and availing special discounts.

    ReplyDelete
  27. Your blog is filled with unique good articles! I was impressed how well you express your thoughts.
    Top 10 Samsung Smart TV Apps

    ReplyDelete
  28. Online Assignment Help
    There are various websites in Australia that proclaim to provide best essay writing services in the country. These websites also proclaim that they have the best professional writers, who can do this job with perfection but generally that’s not the case.

    ReplyDelete
  29. The education provided by Australian institutes is highly valued and recognized globally. There are more than 200, 000 international students who have preferred to Study in Australia.

    ReplyDelete
  30. Thanks for explanning the different kind of ip with their details.Appericiate that and looking ahead that kind of stuf.
    Cardboard boxes with handle
    Empty Cigarette boxes

    ReplyDelete
  31. It is a great article. You will surely like this also because it is a great stuff
    Potty Racers

    ReplyDelete
  32. Research Papers Writing Services should strive to ensure that all essays meets the pukka standards of the examining bodies. Consider hiring quality but also Qualified Research Paper Writers which are advantageous in terms of ensuring you get only top-quality grades on your Online Research Paper Writing Service.

    ReplyDelete
  33. Thanks for sharing information with us to get any kind of medical help you can visit out site name myfloridagreen.com.Or if you want to get medical marijuana card sarasota we can also assist you with this.

    ReplyDelete
  34. kepuasan dalam bercinta bisa didapatkan pasangan dengan cara melakukan foreplay terlebih dahulu diawal hubungan untuk meningkatkan semangat wanita dalam bercinta dengan mengadopsi cialis asli 80 mg cod di jakarta pusat sebagai obat untuk pembangkit libido pria. read more . tak heran jika pasutri membutuhkan kepuasan dalam berhubungan agar bisa terciptanya suatu hubungan yang romantis. cialis asli 80 mg dapat memberikan kepuasan yang anda dambakan bersama pasangan ketika sedang bercinta. bagi anda yang ingin mencapai klimaks bisa mengonsumsi cialis 80 mg original agar istri anda bisa selalu merasakan kepuasan dalam bercinta dengan anda. obat kuat cialis termasuk salah satu obat untuk pembangkit semangat pria saat diranjang agar selalu tampil perkasa bersama pasangan. vimax oil juga bagus untuk pria yang ingin memperbaiki alat vital agar istri bisa lebih senang dengan ukuran yang besar dan panjang klik selengkapnya .

    ReplyDelete
  35. They are unparalleled from so many aspects and always beat other boxes in terms of high quality and their capacity to provide best Blank Cigarette Boxes

    ReplyDelete

  36. ยิงปลาออนไลน์ แจกโบนัสมากมาย slot online
    https://www.live22easy.com/

    ReplyDelete
  37. We install new air conditioning,Commercial kitchen hood installation Los Angeles, warming and ventilation equipment just as business kitchen exhaust systems including exhaust oil conduits, make-up air systems and bog coolers. We install refrigeration equipment including stroll in coolers, stroll in coolers and ice machines.

    ReplyDelete
  38. Your blog is really imformative for us, for more work you can check it out for free mykfcexperience

    ReplyDelete

  39. نجار بالرياض نجار بالرياض
    تركيب ستائر بالرياض تركيب ستائر بالرياض
    تنظيف مكيفات بالرياض تنظيف مكيفات بالرياض
    شركة تنظيف افران الغاز بالرياض شركة تنظيف افران الغاز بالرياض
    تركيب اثاث ايكيا بالرياض تركيب اثاث ايكيا بالرياض
    تركيب مكيفات بالرياض تركيب مكيفات بالرياض

    ReplyDelete
  40. Data Dynamics was established to provide cost-effective strategic IT consulting services to organizations. Since our birth, our goal has been to partner with our clients and help them achieve competitive advantage in the market place. We pride ourselves in being vendor agnostic and technology neutral. To us it’s all about business with technology being a means to an end. Being the most trusted advisor, we help our clientele overcome challenges, mitigate risks, and identify and capitalize on opportunities.
    software development company in USA

    ReplyDelete
  41. I loved the way you discuss the topic great work thanks for the share Your informative post best hd video downloader.

    ReplyDelete
  42. I really loved reading your blog. It was very well authored and easy to understand. Your blog put really very helpful information. Thank you for sharing superb information…
    Custom Packaging Boxes

    ReplyDelete
  43. The most challenging thing in student life is when you run out of money and you have to hire writing service like cost accounting assignment help. Keeping this situation in mind our Academic Writing Experts provides the best assignment help service at most affordable price in Australia.

    ReplyDelete
  44. Assignment help Australia offers attractive deals for students looking for quality assignment help from Aussie writers. We have a resourceful team of experienced and subject-specific assignment tutors, dedicated to assist students with the authentic academic support. Our team is available 24x7 to help students on a plethora of case studies, assignments, essays, coursework and more.

    ReplyDelete
  45. While mapping out firewall rules can be valuable, bypassing rules is often the primary goal.

    apk

    ReplyDelete
  46. Custom bath bombs have gained popularity due to customer's modern choice and fierce competition. Bath bomb packaging designed with ravishing designs give a charismatic look to the product. The uniqueness of the custom bath bomb box will not only give a subtle look to your product but will also get you maximum market share. custom boxes wholesale are for their product's success therefore they spend their hard earned income to design a unique box.

    ReplyDelete
  47. It is a great article. You will surely like this also because it is a great stuff site

    ReplyDelete
  48. When it comes to your academic dreams and grades we try to give our best by supporting you in completing your college assignments.
    Our administrative experts work dedicatedly and passionately to provide top quality essay writing help to the students. Meticulous paper structures,
    subject matter relevance, free from grammatical errors are main characteristics that our highly experienced and talented writers endeavor for.
    Still drowning in the worry to complete your college assignments?

    Assignment helpers Online

    ReplyDelete
  49. We always want to ensure that we fully participate through our packaging and Blank Cigarette Boxes towards improving our environment.

    ReplyDelete