Reverse RDP Proxying with Chisel
It is relatively easy to set up a reverse tunnel with
“autorouting” features included in frameworks
like Metasploit or Cobalt Strike.
However, in some cases we may need to rely on a standalone application
when using products like PowerShell Empire or Covenant.
The traditional tool of choice for this is the command-line version of putty
called plink.
However, we’ll leverage Chisel, which is a more modern tool.
Chisel is an open-source tunneling software written in Golang.
It works by setting up a TCP tunnel
and performing data transfers over HTTP, while securing it with SSH.
Chisel contains both client
and server components and creates a SOCKS-compliant proxy.
We can compile the chisel executables ourselves but to do that,
we must first install Golang on our Kali machine with apt.
Next, we’ll clone the chisel project from GitHub.
We need to compile two components of the application.
The first is the server, which will run on our Kali machine
and the other is the client which will run on Windows.
While each component contains the same functionality,
we must compile one executable for each platform.
We can compile chisel on Kali with the go build command.
With the Linux version compiled we’ll turn to the Windows version.
We can cross-compile chisel for other operating systems
and architectures with the Golang compiler.
We’ll first specify a 64-bit Windows executable
with the env environment variable command.
We’ll then set GOOS and GOARCH to “windows” and “amd64” respectively.
Next, we’ll run go build,
specifying the output file name and,
linker arguments which will strip debugging information
from the resulting binary.
Now we can use chisel to set up the reverse tunnel.
Let’s configure the server first.
We’ll start chisel in server mode,
specify the listen port with -p,
and socks5 to specify the SOCKS proxy mode.
Next, we’ll configure a SOCKS proxy server with the Kali SSH server.
To ease the configuration, we’ll first enable password authentication
by uncommenting the appropriate line in the sshd_config file.
After the SSH service is started,
we’ll connect to it with ssh
and supply -N to ensure commands are not executed but merely forwarded,
and -D to configure a SOCKS proxy.
As subarguments, we must specify the IP and port to configure the SOCKS proxy.
Finally, we’ll SSH to the localhost.
Now that the Kali server is configured, we’ll shift our focus to the chisel client
on the Windows 10 target.
First, we’ll transfer the compiled Windows version of chisel
to the Windows 10 client machine through the existing reverse shell.
After transferring the file, we can run it as a client,
providing the IP address and port of the server instance of chisel
and the socks option.
Great, chisel established a connection to our server instance.
Finally, with the tunnel created we can open an RDP session
to the Windows 10 client with proxychains.
Setting up a reverse tunnel is a lot more work than simply using a built-in feature
but it’s still possible and through it, we can obtain GUI access with RDP
in a way that is otherwise not meant to be possible.
In the next section, we’ll demonstrate an RDP technique that requires neither a GUI
nor a reverse tunnel.