Remote port forwarding with tcp2tor-proxy
Last updated
Was this helpful?
Last updated
Was this helpful?
We suppose that Victim2 does not have Internet access, so we cannot access Tor directly from it. However, we can use tcp2tor-proxy in order to use Victim1 as a Tor proxy for Victim2.
As shown in the following illustration, the attacker will publish a Hidden Service with a handler. With tcp2tor-proxy, Victim1 will serve a TCP port that routes the traffic directly to the Hidden Service. Then, Victim2 will send a simple reverse shell to Victim1 in order to reach the attacker handler.
Previously, the attacker needs to have a Hidden Service up and running with an associated onion address. Also, the attacker should run a netcat handler for the incoming connections.
As Victim1 is the host we will used as a pivot, we will run tcp2tor-proxy on it:
Now, the pivot is listening TCP traffic on port 60101 so that it will be routed to the Hidden Service the attacker owns.
As the traffic that reach tcp2tor-proxy will be routed to the Hidden Service, Victim2 only needs to send a simple reverse shell to the pivot:
After executing the above command, the attacker will receive the shell:
