6 ms·

Multitun – Tunnel arbitrary traffic through an innocuous WebSocket

• pielud 12y ago
  This looks pretty cool, but why not just run sshd on port 80/443 then use corkscrew[1] to tunnel through an http proxy? [1] http://www.agroman.net/corkscrew/ http://www.agroman.net/corkscrew/
  • voltagex_ 12y ago
    Does corkscrew still use HTTP CONNECT? That's often blocked.
    • pielud 12y ago
      Ah yes, looks like it does use CONNECT.
• ryan-c 12y ago
  The use of SHA-2-224 is kinda weird. Based on a quick skim: * no kdf on the password, just SHA-2-224(password) * uses the same key and iv (which always starts as 0) in both directions * uses CFB mode without a MAC, which has malleability issues (IIRC you can flip bits in a ciphertext block, and the same bits will be flipped in the plaintext, but the rest of the stream will be garbage). * the authentication used is pretty sketchy (the key is fixed at 16 bytes and PW_LEN 15, so ljust shouldn't be doing anything): if tmp_data[:len(self.key)].ljust(PW_LEN,'0') != self.key.ljust(PW_LEN, '0'): log.msg("Remote unauthorized", logLevel=logging.INFO) Reminds me of this: https://www.cs.auckland.ac.nz/~pgut001/pubs/linux_vpn.txt https://www.cs.auckland.ac.nz/~pgut001/pubs/linux_vpn.txt
  • rapidally2 12y ago
    The IV doesn't start as zero; it starts as a random number.
    • ryan-c 12y ago
      Oh, you are correct. It's chosen by the client here: https://github.com/covertcodes/multitun/blob/master/multitun.py#L142 https://github.com/covertcodes/multitun/blob/master/multitun...
• V1 12y ago
  To bad that networks/proxies usually block websocket connections causing this solution to fail.