jm33-m0 / emp3r0r

Linux/Windows post-exploitation framework made by linux user
https://infosec.exchange/@jm33
MIT License
1.25k stars 235 forks source link

How to open a reverse proxy on the client ? #190

Closed zqd233 closed 1 year ago

zqd233 commented 1 year ago

just like frp, set up socks5 port on cc reverse_proxy module really confused me I dont know how to set it up

thanks for answer

jm33-m0 commented 1 year ago

I believe the module you want is run_proxy or port_fwd. reverse_proxy is used to bring hosts from internal network to CC, you can type ls_modules to view the description, sorry for the confusion.

zqd233 commented 1 year ago

thanks for answer

here is my emp3r0r.json { "cc_port": "8443", "proxy_port": "11597", "http_listner_port": "35836", "shadowsocks_password": "xxxxxxx", "shadowsocks_port": "443", "kcp_port": "62024", "use_shadowsocks": true, "use_kcp": false, "reverse_proxy_port": "11598", "sshd_port": "52286", "broadcast_port": "10496", "broadcast_interval_min": 30, "broadcast_interval_max": 0, "ccip": "VPSIP", "pid_file": "/tmp/ssh-bbUtWnYqp/nwF", "cc_indicator": "", "indicator_wait_min": 30, "indicator_wait_max": 0, "indicator_text": "", "ca": "-----BEGIN CERTIFICATE----- MIIBajCCARCgAwIBAgIBATAKBggqhkjOPQQDAjASMRAwDgYDVQQKEwdBY21lIENv MB4XDTIzMDQxMjA2NDUyMFoXDTMzMDQwOTA2NDUyMFowEjEQMA4GA1UEChMHQWNt ZSBDbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLEJXWVwgXRMr48BQ0MX/UIr I4FvV0kYCxdZCXHdWuDNdDPe2htMtjgUdVIdev4tQ5NeaXQ74PJ8AMZY1zWaj/Oj VzBVMA4GA1UdDwEB/wQEAwICpDATBgNVHSUEKBggrBgEFBQcDATAPBgNVHRMB Af8EBTADAQH/MB0GA1UdDgQWBBRbtC45J66x5nLlkjyYRHjPiCkc1TAKBggqhkjO PQQDAgNIADBFAiEA5xKbqwQXcAe5Q7KFoWRPjSlD0iV0R81t+wxX5ifaxcMCIGW8 rJpsGLxtXuVckQXu98EWIdX1wi3elRqNkI8ijs2M -----END CERTIFICATE----- ", "agent_proxy": "", "cdn_proxy": "", "doh_server": "", "socket": "/tmp/ssh-bbUtWnYqp/fYnrvNu", "agent_root": "/tmp/ssh-bbUtWnYqp", "utils_path": "/tmp/ssh-bbUtWnYqp/QhAEObNHNlhzn", "agent_uuid": "324ea4ca-0a6c-41c3-8294-e4d5b97e107d", "agent_tag": "", "timeout": 11735 }

I just tried run_proxy, I set port to 9999, then run this module, I got this +--------+----------------------+
| OPTION | VALUE |
+--------+----------------------+
| module | run_proxy |
+--------+----------------------+
| target | test\root_560 |
| | 0045ee0af |
+--------+----------------------+
| port | 9999 |
+--------+----------------------+
| status | on |
+--------+----------------------+
2023/04/13 01:25:31 Command "!port_fwd 127.0.0.1:11597 f0e47f26-5813-44e5-925b-7d27aef079d0 on" took 1.736864ms
2023/04/13 01:25:32 portFwdHandler: closed portFwd connection from VPSIP:50992 2023/04/13 01:25:33 PortFwd session (Agent Proxy:
9999 (Local) -> 127.0.0.1:11597 (Agent)) has finished:
9999 -> 127.0.0.1:11597
f0e47f26-5813-44e5-925b-7d27aef079d0
2023/04/13 01:25:33 Command "!port_fwd 127.0.0.1:11597 f0e47f26-5813-44e5-925b-7d27aef079d0_40966 on" took 3.341461ms
2023/04/13 01:25:33 Unknown ID: f0e47f26-5813-44e5-925b-7d27aef079d0

my question is what is the "Unknown ID" mean ? I checked local port 9999 on cc that do not open

what is the difference between proxy_port in emp3r0r.json and port in run_proxy?

jm33-m0 commented 1 year ago

Thanks for sharing this information. According to the log, run_proxy failed to open the port mapping session, and proxy_port in emp3r0r.json has nothing to do with this feature, generally its value doesn't need to be modified. I will test this feature later and give you my result.

jm33-m0 commented 1 year ago

Tested on local VM, looks ok. image

zqd233 commented 1 year ago

Here is my test environment CentOS Linux release 7.9.2009 (Core) Linux guest 3.10.0-1160.83.1.el7.x86_64 #1 SMP Wed Jan 25 16:41:43 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

just test again, still got the same error

Capture

jm33-m0 commented 1 year ago

Let's move this to a new issue #192

jm33-m0 commented 1 year ago

Further discussion should be put in #192, this issue is considered solved.