5 ms·
Chisel: A fast TCP/UDP tunnel over HTTP
- MuffinFlavored 3y agoI've used this before and it's great as a "reverse tunnel" when you have a VM in the cloud that does allow configurable port forwarding/firewall rules but need to connect "peer to peer" to a customer in a workshop who has the typical "my router blocks everything and we aren't going to spend the time supporting every workshop's possible inbound network connection setup". It helps for "flipping" the "server connects to client". But... it gets detected as malware really easily haha
- asib 3y ago> But... it gets detected as malware really easily haha It's a common tool in the red teamer's toolbox. Just search "chisel" on https://ippsec.rocks https://ippsec.rocks to see how often it's utilised in a pentest type of scenario.
- mike_d 3y agoIt is used by red teamers because it is used by attackers. https://malpedia.caad.fkie.fraunhofer.de/details/win.chisel https://malpedia.caad.fkie.fraunhofer.de/details/win.chisel
- maxcoder4 3y agoWell it's used by both because it's pretty useful in attack-like situations.
- arcanemachiner 3y agoTomato tomahto
- halJordan 3y agoTomatoe, tomato. The E at the end of the word generally reflects hardening/lengthening the preceding morpheme (rid, ride; cloth, clothe). This is a good example of how language evolves because tomahto has not ever been a correct spelling of tomato, and tomatoe is an incorrect spelling derived from making tomato plural into tomatoes and then (incorrectly) dropping just the s to make tomatoes singular again. A mistake based off of a mistake. So while intelligible if incorrect, who's to say if it's wrong?
- passion__desire 3y agoby that you mean, the traffic is suspicious or the binary?
- magnoliakobus 3y agoBoth the protocol tunneling activity and the binary would likely be flagged by most enterprise security software.
- tsimionescu 3y agoHaving used this as a part of a solution we were delivering to corporate customers, the traffic wasn't causing problems (we were tunneling over secure WebSockets, though, not plain text ones). It's only those overzealous "malware detection" tools that caused us to have to drop it and come up with a different way of encrypting our traffic.
- halJordan 3y agoThe protocol is http(s) so it looks quite generic, are you transiting the GFW? Probably shouldn't be.
- amelius 3y agoThat makes it kinda useless. What we need is a self-updating mechanism. See for instance yt-dlp, which breaks every now and then but a simple update almost always puts you back in action. We need something similar for tunnels.
- Thorrez 3y agoWhat benefit would a self-updating mechanism provide?
- globular-toast 3y agoAssuming they mean a cat and mouse game like ytdl where the software is updated once it starts getting detected by the enemy.
- mr_mitm 3y agoHow will it self update after it's been deleted by the AV? Also, there are many AVs with different detection strategies. It's not always static analysis that can easily be defeated by slightly changing some lines of code.
- globular-toast 3y agoI was thinking more about it being filtered by firewalls.
- Thorrez 3y agoI don't think Chisel has a goal of evading AV detection.
- jpillora 3y agoI was tempted to play the cat and mouse AV detection game though decided against it. It’s open source and with effort, one can make it avoid detection, but I’ll leave that up the reader
- deleted 3y ago[deleted]
- dang 3y agoRelated: Chisel – A fast TCP tunnel over HTTP - https://news.ycombinator.com/item?id=13353457 https://news.ycombinator.com/item?id=13353457 - Jan 2017 (38 comments)
- mattmerr 3y agoI am curious to see benchmark results for the same use cases but with 10ms and 100ms latency added between the client and server. It looks like the bench currently just stays within the same machine. I do not often operate below application layer, but as I understand it both the HTTP and SSH layers would add back-and-forths from client to server that UDP does not perform. Would UDP over HTTP over SSH have a slowdown steeply (but linearly?) correlated with the ping to the server? And (>linear) increased effects on packet loss? Crowbar seems to only do HTTP, so saves some considerable amount of backs-and-forths... but doesn't have the benefit from websockets...
- jpillora 3y agoYou’re right, that’d be a better test - and I think the gap between chisel and crowbar would grow even more. Chisel is effectively doing ssh tunnelling, with extra layers. Performance is lost in packet wrapping/unwrapping, reduced MTU but it shouldn’t result in more round trips
- lxgr 3y agoHow does this compare to something like MASQUE (i.e. TCP, UDP, or even IP proxied over HTTP/3, /2 or /1)? Does this just predate it and it's basically the same principle?
- niux 3y agoHow does this compare to Tailscale/Headscale?
- killingtime74 3y agoTailscale is Wireguard this is HTTP. Different protocol?
- lxgr 3y agoTailscale does actually support Wireguard packet forwarding over HTTP (a custom addition to the protocol; standard Wireguard only runs on UDP) for tricky NAT traversal use cases, but that's only used in pretty gnarly situations. Otherwise, it's a regular VPN, i.e. encapsulated and encrypted IP over UDP. https://tailscale.com/blog/how-tailscale-works#encrypted-tcp-relays-derp https://tailscale.com/blog/how-tailscale-works#encrypted-tcp...
- killingtime74 3y agoVery interesting! Always wondered what the value add was and this is one of them
- lxgr 3y agoYes, reliable NAT and firewall traversal is basically the make-or-break feature for "P2P"/mesh VPNs. And Tailscale is doing a great job at trying to only resort to relaying when there's really no other choice, both because it improves latency and saves them bandwidth on their relays. It's very similar to VoIP and videocalls (1:1; conferencing usually performs better with SFUs) in that regard.
- jpillora 3y agoTailscale is a virtual network device (works on L3, tun not tap device) whereas chisel just listens on ports (works on L4)
- nurettin 3y agoI've used both chisel and frp to tunnel connections, then ended up using good old autossh. Just nothing beats it when you need a ubiquitous tool to provide a near permanent tunnel that will keep the connection up and use standard encryption.
- nier 3y agoIn my experience SSH traffic is blocked quite regularly by corporate firewalls.
- veganjay 3y agoChisel is a handy red-team tool. I learned about it training for the OSCP (Offsec Certified Professional). It comes in handy under certain situations. Another tool I recommend is Ligolo-ng [1]. You set up a network interface and use "ip route" to send traffic through it. In a way, it "feels like a VPN". [1] https://github.com/nicocha30/ligolo-ng https://github.com/nicocha30/ligolo-ng
- spxneo 3y agois it possible to turn this into an executable that can run cross-platform ?
- jpillora 3y agoThat’s exactly what it is, see releases
- TZubiri 3y agoI feel afraid to ask, but considering HTTP is transmitted over TCP, why would you tunnel TCP back again? Actually, nvm I don't need to know, you can keep your cursed ourobouros protocol to yourself.
- mordechai9000 3y agoYes, it can cause a problem called TCP Meltdown where the inner TCP and the outer TCP both try resending data and the connection degrades significantly. I think you can work around it, somewhat, by tweaking the TCP timing. But generally it's best to use UDP for the outer protocol when you're tunneling TCP
- Thorrez 3y agoI don't think that's the case here. I think it's just tunneling the data, not the full TCP packets.
- mordechai9000 3y agoI was not aware, thanks.
- jpillora 3y agoCorrect, it’s equivalent to ssh tunneling except there’s some HTTP/websocket wrappers around it
- Thorrez 3y agoI don't think it's tunneling the full TCP packets. I think it's extracting the data stream from the incoming TCP stream, tunneling that data, and creating a new TCP stream to the destination on the other end of the tunnel. So basically the same as ssh -L or ssh -R .
- globular-toast 3y agoIt's for getting arbitrary traffic out of corporate firewalls by disguising it as regular HTTP traffic.
- jpillora 3y agoHey all, I’m the author of chisel. Feel free to send any questions my way
- lyu07282 3y agoNot really a question, but just wanted to say I appreciate your work it is a great piece of software thank you for open sourcing it!
- debarshri 3y agoI have been using the TCP proxy project you have on github. Thank you for open sourcing. Can I get in touch with you in any way? We have some interesting problems, would love to hear your thoughts.
- huhtenberg 3y agoWhat a lovely euphemism for "can we get some free support for our edge case".
- debarshri 3y agoPlease don't jump to conclusions. I would really encourage you to not respond If you do not understand how long term relationship and trust are built in tech or any other business. Please don't be a troll.
- huhtenberg 3y agoHaving been on the receiving end of similarly phrased requests, I can assure you that was nowhere close to trolling. The fact that the OP is not easy to reach is not an oversight on their end. Take a hint and go through channels that they left open, i.e. issues on GH. If your request has merit, you will hear back.
- debarshri 3y agoThank you. Your suggestion is helpful. Will do that.
- 090rf 3y ago[flagged]
- teaearlgraycold 3y agoTo the person running the botnet for this "campaign" - please take a look in the mirror. Who do you want to be?
- shawnz 3y agoWhy not just use an HTTP CONNECT proxy?
- lxgr 3y agoThat doesn't give you full IP tunneling, only a TCP socket connection, which might or might not be enough for what you're trying to do. I could also imagine that many corporate firewalls know HTTP CONNECT and filter it.
- shawnz 3y agoWith CONNECT-UDP you also get UDP, just like this, and over HTTPS it's not going to be filterable, right?
- lxgr 3y agoYeah, I suspect it's pretty similar using HTTP/2 when considering all of these new proxy modes; I've been wondering as well if there are any other differences or if it just predates the specification of that (and UDP over HTTP). With HTTP/1, I don't think there is a way to multiplex multiple TCP or UDP bindings over a single connection – maybe this supports it? The diagram seems to suggest it, and e.g. SSH does too (and is equivalent to CONNECT proxying over HTTP/2 in that sense).
- kbolino 3y agoLarge enterprise firewalls generally do not allow true end-to-end HTTPS. The firewall masquerades as the destination sites using custom certificates, issued on-the-fly under a custom root CA controlled by the firewall, which is pre-installed on every device approved for use in the enterprise. Certain sites (e.g. banks) and certain users (e.g. C-suite) may be exempt from this by policy, but the default policy is to MITM all connections.
- FrostKiwi 3y agoUsing Proxytunnel [1] to do specifically this, in an environment where a packet inspecting proxy prevents SSH traffic. It supports connecting over HTTPs, so the traffic doesn't look fishy with the setup of: SSH Client -> HTTPs Encryption -> Corporate Packet Sniffing Proxy -> Your Server -> HTTPs Decryption -> SSHD Server Looking forward to explore chisel as well. [1] https://github.com/proxytunnel/proxytunnel https://github.com/proxytunnel/proxytunnel
- snitty 3y agoThis has got to be at least the third FOSS project I've seen called Chisel or some homophone thereof.
- remram 3y agoSeems to be the exact opposite of https://github.com/fatedier/frp https://github.com/fatedier/frp which is a reverse tunnel over a variety of protocols (including HTTP).
- _8j50 3y agoIt's a great post-exploit tool as well hacking but these days it gets blocked/detected a lot. Where ssh traffic isn't blocked, the builtin win10+ openssh client's dynamic reverse proxy works ok too.
- gitinit 3y ago[dead]