Chaining through proxies

-
Proxies, whilst being useless against a determined attacked, provide a generic level of security against stupid malware. An in-line IPS is able to stop known malware, leaving the proxy to provide a layer of security through obscurity- Internet access being unavailable through the default gateway.

Broadly the ones I've had to deal with fall into two different categories:
  • Forefront Threat Management Gateway
  • Something that smells like squid.
If you're up against the former, the conversation pretty much ends here: you're going to be using cntlm. Cntlm is fantastic at being a proxy chain to deal with most unix tools not understanding how to auth against NTLM based stuff. Even when they're NTLM-aware, Microsoft has a habit of changing the spec without telling anyone. A particular change from ISA 2006 to Forefront TMG broke a number of open-source apps (anything libcurl based, I'm looking at you) that were previously NTLM auth compatible. This left me in a bit of a rut when trying to get OpenVPN's proxy mode through a TMG server. Cntlm to the rescue.

The second you'll come up against is something squid-based. Recently I came up against something that was using basic-auth but seemingly incompatible with the usual
export HTTP_PROXY=http://user:pass@mylittleproxy.contoso.com:8080
Polipo to the rescue. This tiny little tool is fantastic- blisteringly fast, IPv6 compatible, and deals with most rubbish regarding weird auth schemes that are basic (different realms and trying to shoehorn that into an existing app). The config is stupidly easy and it supports SOCKS.




Alma Mater (notes):

In trying to get this to work I tried using fiddler, burp and squid on windows.

Squid is a huge fuck-around for a quick and dirty "give me internet access" - it's not designed to be quick or easy in implementation. There are some proxy chaining features (cache_peer), but it's largely designed to deal with an upstream proxy of say an ISP rather than an enterprise's authenticated one. I found that even passing the right credentials it has issues authenticating.

Burp works, but weird stuff starts happening when you are trying to connect to SSL services through it. Even with SSL bypass enabled, NSS knew something was up and terminated the connection (this is something I'll write about later- it's not the first time I've encountered it). When tunneling HTTP in bypass mode, burp is stupidly slow and seriously not designed to even be a quick and easy proxy. I got a max of around 60kb/s.

I couldn't even get Fiddler to accept remote connections, but even if I did, I think I'd face similar issues to burp (performance, the fact it's designed to fuck with SSL means it cant help itself but screw around with frames).

In a later post I'll cover off a few of the tools I've used to prevent IPS' identifying your proxy'd traffic.

Comments

Post a Comment

Popular posts from this blog

2020 Hack-A-Sat DEFCON Space Security Challenge CTF Qualifiers 2020 - Part 1

-
Image
Preface This year the US Air Force teamed up with DoD's Digital Service and DEFCON's Aerospace village to build a CTF - the first of it's kind - to hack satellites. I joined with some colleagues and their CTF team to get our numbers around half a dozen. We missed the top ten by ~50 points, which was disappointing, but shows the quality of the teams we were up against and that the tournament attracted. Since joining a Bay Area tech company, I haven't found much time or mental space for CTFs or bug bounties. But aerospace has a special place in my heart, and with numerous commercial launch companies massively driving down the costs to get satellites up, understanding the frameworks, communication protocols, physics, tools, history etc. is going to be super important. Before I get to the goods, a hat tip to the USAF & DoD for getting behind this. Satellites are going to become increasingly important in our day-to-day lives, and investing in bringing the security commun
Read more

Man-in-the-middling SSL / TLS on Windows

-
"Is there a lock in the URL bar?" Funny how the proliferation of commercial CA's led to this question to become the hallmark of Internet security circa 2001. I'll keep that rant for another day. Thumbs up to EFF and Mozilla for finally doing something about it . When debugging issues with network connections or reverse engineering products, you might find the need to take the gloves off and find out exactly what an application is doing on the wire. You'll need a man in the middle. ( instantcsi ) Providing the application you're targeting uses a web protocol, you'll be in with some luck- there are heaps of web debugging proxies and tools you can use on any platforms. If you have physical access to the network (i.e. a non-corporate environment), or you have a Linux machine on the network that IT security approve of- the conversation effectively ends here: Use MITMproxy . Unfortunately I don't have either physical access or a Linux machine o
Read more

2021 Hack-A-Sat DEFCON Space Security Challenge CTF Qualifiers Writeup - Linky

-
Image
Linky was an RF math problem, introducing the link-budget algorithm and getting contestants to calculate missing parameters for the operation of the radio link. Years have passed since our satellite was designed, and the Systems Engineers didn't do a great job with the documentation. Partial information was left behind in the user documentation and we don't know what power level we should configure the Telemetry transmitter to ensure we have 10 dB of Eb/No margin over the minimum required for BER (4.4 dB) . Upon connecting to the target port and presenting token, you're presented with a TUI of sorts: _ _ _ | | (_)_ __ | | ___ _ | | | | '_ \| |/ / | | | | |___| | | | | <| |_| | |_____|_|_| |_|_|\_\\__, | |___/ .-. (;;;) \_| \ _.--l--._ . \ | `. .` `.\ | .` `. .` `\ | .` `. / __ \.|.` __ \/ | ''--._ \V _.--'' | | _ (") _ |
Read more