7 ms·
I've used this before and it's great as a "reverse tunnel" when you have a VM in the cloud that does allow configurable port forwarding/firewall rules but need
by MuffinFlavored 3y ago
I've used this before and it's great as a "reverse tunnel" when you have a VM in the cloud that does allow configurable port forwarding/firewall rules but need to connect "peer to peer" to a customer in a workshop who has the typical "my router blocks everything and we aren't going to spend the time supporting every workshop's possible inbound network connection setup".
It helps for "flipping" the "server connects to client".
But... it gets detected as malware really easily haha
- asib 3y ago> But... it gets detected as malware really easily haha It's a common tool in the red teamer's toolbox. Just search "chisel" on https://ippsec.rocks https://ippsec.rocks to see how often it's utilised in a pentest type of scenario.
- mike_d 3y agoIt is used by red teamers because it is used by attackers. https://malpedia.caad.fkie.fraunhofer.de/details/win.chisel https://malpedia.caad.fkie.fraunhofer.de/details/win.chisel
- maxcoder4 3y agoWell it's used by both because it's pretty useful in attack-like situations.
- arcanemachiner 3y agoTomato tomahto
- halJordan 3y agoTomatoe, tomato. The E at the end of the word generally reflects hardening/lengthening the preceding morpheme (rid, ride; cloth, clothe). This is a good example of how language evolves because tomahto has not ever been a correct spelling of tomato, and tomatoe is an incorrect spelling derived from making tomato plural into tomatoes and then (incorrectly) dropping just the s to make tomatoes singular again. A mistake based off of a mistake. So while intelligible if incorrect, who's to say if it's wrong?
- passion__desire 3y agoby that you mean, the traffic is suspicious or the binary?
- magnoliakobus 3y agoBoth the protocol tunneling activity and the binary would likely be flagged by most enterprise security software.
- tsimionescu 3y agoHaving used this as a part of a solution we were delivering to corporate customers, the traffic wasn't causing problems (we were tunneling over secure WebSockets, though, not plain text ones). It's only those overzealous "malware detection" tools that caused us to have to drop it and come up with a different way of encrypting our traffic.
- halJordan 3y agoThe protocol is http(s) so it looks quite generic, are you transiting the GFW? Probably shouldn't be.
- amelius 3y agoThat makes it kinda useless. What we need is a self-updating mechanism. See for instance yt-dlp, which breaks every now and then but a simple update almost always puts you back in action. We need something similar for tunnels.
- Thorrez 3y agoWhat benefit would a self-updating mechanism provide?
- globular-toast 3y agoAssuming they mean a cat and mouse game like ytdl where the software is updated once it starts getting detected by the enemy.
- mr_mitm 3y agoHow will it self update after it's been deleted by the AV? Also, there are many AVs with different detection strategies. It's not always static analysis that can easily be defeated by slightly changing some lines of code.
- globular-toast 3y agoI was thinking more about it being filtered by firewalls.
- Thorrez 3y agoI don't think Chisel has a goal of evading AV detection.
- jpillora 3y agoI was tempted to play the cat and mouse AV detection game though decided against it. It’s open source and with effort, one can make it avoid detection, but I’ll leave that up the reader