SYSADMIN Security Lessons

Covert communications on Linux

SECRET TUNNELS
Moving data to and from Linux systems under the radar. BY KURT SEIFRIED

W
e have all been there: You plug Much like trying to stop a cat from get- through web proxies and their own DNS
in or connect to the wireless ting into a cardboard box, if you try to servers in order to access the Internet.
network, and it doesn’t work prevent geeks from doing something, the
right. Then you try to ssh to your server chances are they will only try that much Tunneling via ICMP
and you get “connection failed.” Trying harder. ICMP is a great protocol for tunneling
to connect to your mail server on port 25 If you can pass any form of data to a data because it’s almost always allowed
using TLS (Transport Layer Security, aka remote system (IPSec, SSH, http, instant (blocking it breaks a great many things)
encryption) leaves you staring at the messages, smoke signals), then you can and can carry a lot of data [1]. An ICMP
banner for the local ISP’s mail proxy, or use that channel to carry anything you packet has 20 bytes of data in the header
you get another failed connection. But want. An ISP can only block or filter so (the usual source, destination, etc.) and
all is not lost – at least you can surf the much traffic before it becomes com- 8 bytes of payload data (type of mes-
web. Unfortunately, every time you mis- pletely unusable. The trick is to find a sage, code, etc.), plus a variable amount
type a URL, you end up at the ISP’s network protocol that is allowed and of other data. The amount of other data
search page, and anything with ques- that is not modified (much) on the fly sent in the ICMP packet is generally only
tionable content, such as hacking, is and that can do this with existing soft- limited by the maximum packet size on
blocked. ware that lets you tunnel data over the a given network (for Ethernet, generally
At this point, you have two choices: top of it. 1,500 bytes), which is usually true for
find a good book to read, or use VPN Fortunately, three basic network proto- most wireless networks too. This means
software to get a connection to a remote cols – ICMP, DNS, and http – are almost that you can send a lot of data over
host by bypassing whatever breakage or always allowed, as well as a wide variety ICMP packets with very little overhead.
filtering is occurring. However, some of of other protocols, such as SSH and in- When it comes to ICMP tunneling soft-
the really evil – or just plain incompetent stant messaging. If you are lucky, you ware, you have a couple of options, but
– ISPs also block common VPN software will be able to use software such as SSH your best bet is Ping Tunnel (Ptunnel)
and SSH in an effort to prevent unfet- with port forwarding or VPN capabilities because it’s the most up to date [2]. In-
tered Internet access through their net- over an allowed port, such as 80 (http). stalling Ptunnel is relatively straightfor-
works. If you are un- ward; RPMs for the second latest release
lucky, the are available courtesy of Dag [3].
ISP will To install and build the source, enter:
force you
rpm -Uvh http://dag.wieers.com/rpm/U
packages/ptunnel/U
ptunnel-0.61-1.rf.src.rpm
cd /usr/src/redhat/
rpmbuild -ba ptunnel.spec

If you want the most recent version of

Ping Tunnel, you’ll need to update the
source RPM or build it from source. To
update the source RPM:

wget http://www.cs.uit.no/~danielsU
/PingTunnel/PingTunnel-0.70.tar.gz
tar -xf PingTunnel-0.70.tar.gz
cd PingTunnel
make
make install

Because building it from source is a two-

line example, I leave updating the source
RPM as an exercise for the reader.

64 ISSUE 104 JULY 2009

 Security Lessons SYSADMIN

will be modified is less. As with the

Listing 1: Proxytunnel ICMP tunneling software, you can either
01 Host proxytunnel.example.org
build Proxytunnel from source or you
02 ProtocolKeepAlives 30
can download a source (or binary) RPM
03 ProxyCommand /path/to/proxytunnel -p proxy.customer.com:8080 -u [8] [9].
user -s password -d proxytunnel.example.org:443
To use Proxytunnel, simply run it on
your server either as a standalone dae-
Running Ptunnel isn’t much more dif- a payment gateway. To do this, they an- mon or from inetd, and on the client
ficult. On the server side (the proxy), swer any DNS query with the IP address side, add it as a ProxyCommand to your
you simply run Ptunnel with an optional of the payment gateway. Other ISPs will OpenSSH client (Listing 1).
network device (-c) and a password (-x). simply use a transparent web proxy to As you can see, are a variety of op-
On the client side, you specify the ad- intercept any WWW requests and redi- tions are available for tunneling network
dress of the proxy server, the local port rect them to their payment gateway (in traffic over networks, depending on pro-
to listen on, and the remote address and this case, you can probably tunnel your tocol availability. A little bit of setup in
port to which you want to connect. The traffic over DNS). advance can save you a lot of trouble
following example assumes that a proxy DNS offers several advantages over when you’re stuck on someone else’s
server at ptunnel.example.org is con- ICMP. Although blocking ICMP does broken, filtered, or otherwise not-work-
nected to the Internet via eth0, with a cause problems, it can be done. On the ing network. n
Squid proxy running on the server squid. other hand, blocking DNS breaks every-
example.org on port 3128 and using the thing. Although Ping Tunnel 0.70 now INFO
password blahblah to secure the connec- supports transmission of data over port
[1] Project Loki – ICMP Tunneling:
tion: 53 UDP, it doesn’t actually send valid http://www.phrack.org/issues.html?
DNS packets, so you can’t pass this traf- issue=49&id=6#article
Server: fic through DNS servers. For this, you
[2] Ping Tunnel (Ptunnel): http://www.
./ptunnel -c eth0 -x blahblah must have a direct connection to your cs.uit.no/~daniels/PingTunnel/
Client: proxy server, in which case, you can
[3] Ping Tunnel RPM: http://dag.wieers.
./ptunnel -p ptunnel.example.org U simply use OpenVPN or OpenSSH over
com/rpm/packages/ptunnel/
-lp 3128 -da squid.example.org U port 53.
[4] OzymanDNS:
-dp 3128 -x blahblah For an actual proxy that encapsulates
http://www.doxpara.com/?p=51
the data in valid DNS packets, you have
[5] OzymanDNS HOWTO: http://www.
Now just point your local web browser a couple of options: OzymanDNS [4][5]
dnstunnel.de/
at localhost port 3128 as a web proxy, and NSTX [6]. Unfortunately, the NSTX
and your http traffic will be converted to project hasn’t updated their source code [6] NSTX: http://savannah.nongnu.org/
projects/nstx/
ICMP traffic and then sent to ptunnel.ex- since 2002, and you will have to use CVS
ample.org. There, it is unpacked and to download it because the source pack- [7] Tunneling SSH over http(s):
ages seem to be gone. Additionally, be- http://dag.wieers.com/howto/
sent on to the squid.example.org web
ssh-http-tunneling/
proxy server and then sent to the Inter- cause of several design issues, NSTX is
net at large. The squid server can be run quite slow. With no updates since its ini- [8] Proxytunnel:
http://proxytunnel.sourceforge.net/
locally on the same server running Ptun- tial release, OzymanDNS is also some-
nel, which will allow you to bypass any what out of date. [9] Proxytunnel RPM: http://dag.wieers.
filtering and most network breakage com/rpm/packages/proxytunnel/
completely. Tunneling via Http [10] SSH Port Forwarding article:
Your final option is to tunnel traffic over http://magazine.redhat.com/2007/11/
Tunneling via DNS http or https [7]. Chances are pretty 06/ssh-port-forwarding/
Although it is not quite as reliable as good that any network you are on will [11] OpenSSH Layer 3 VPN:
ICMP, DNS is another protocol that can allow outgoing https connections. Https http://www.debian-administration.
be used to tunnel data. Some ISPs redi- is better than http because https en- org/article/Setting_up_a_Layer_3_
tunneling_VPN_with_using_
rect unregistered or unknown systems to crypts traffic, so the chance that the data
OpenSSH

SSH Port Forwarding and VPN Capabilities

Virtually all systems have an SSH server, ing set to yes in sshd_config). Kurt Seifried is an
THE AUTHOR

and SSH clients are easy to come by [10]. Information Secu-

ssh -L 8080:www.example.org:80 user@ rity Consultant spe-
If you can establish a direct TCP connec-
ssh-server
tion to port 80, you can simply run an SSH cializing in Linux
server on port 80 (ListenAddress 10.2.3.4: Another option with SSH is to use its VPN and networks since
80 in sshd_config, but make sure you also capabilities. The advantage of this is that 1996. He often won-
define Port 22 if you also want it to accept you can easily route all your traffic over ders how it is that technology works
connections on port 22 as usual) and en- the connection (Instant Messenger, BitTor- on a large scale but often fails on a
able port forwarding (AllowTcpForward- rent, etc.) [11]. small scale.

JULY 2009 ISSUE 104 65