{"id":53317,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3-chast-2"},"modified":"2020-02-18T14:01:12","modified_gmt":"2020-02-18T11:01:12","slug":"domen-fronting-na-baze-tls-1-3-chast-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","title":{"rendered":"Dom\u00e9nov\u00e9 frontov\u00e1n\u00ed zalo\u017een\u00e9 na TLS 1.3. \u010c\u00e1st 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00davod<\/h3>\n

\nV prvn\u00ed \u010d\u00e1sti na str\u00e1nk\u00e1ch Maven Apache Project<\/a><\/noindex> jsme poskytli stru\u010dn\u00fd popis mechanismu encrypted SNI (eSNI). Uk\u00e1zali jsme, jak se na jeho z\u00e1klad\u011b d\u00e1 vyhnout detekci modern\u00edmi syst\u00e9mami DPI (na p\u0159\u00edkladu bilyanovsk\u00e9ho DPI a zak\u00e1zan\u00e9ho RKN rutrackeru) a prozkoumali jsme novou variantu domain-frontingu zalo\u017eenou na tomto mechanismu.<\/p>\n

Ve druh\u00e9 \u010d\u00e1sti \u010dl\u00e1nku se zam\u011b\u0159\u00edme na praktick\u00e9 aspekty, kter\u00e9 budou u\u017eite\u010dn\u00e9 specialist\u016fm RedTeam v jejich n\u00e1ro\u010dn\u00e9 pr\u00e1ci. Nakonec na\u0161\u00edm c\u00edlem nen\u00ed p\u0159\u00edstup k zablokovan\u00fdm zdroj\u016fm (na tyto prost\u00e9 \u00fa\u010dely m\u00e1me star\u00fd dobr\u00fd VPN). Na\u0161t\u011bst\u00ed existuje spousta poskytovatel\u016f VPN, jak se \u0159\u00edk\u00e1, na ka\u017edou chu\u0165, barvu a rozpo\u010det.<\/p>\n

Pokus\u00edme se aplikovat mechanismus domain-frontingu na modern\u00ed n\u00e1stroje RedTeam, jako je Cobalt Strike, Empire a dal\u0161\u00ed, a poskytneme jim dal\u0161\u00ed mo\u017enosti mimikry a vyh\u00fdb\u00e1n\u00ed se modern\u00edm filtrovac\u00edm syst\u00e9m\u016fm.
\n<\/a><\/noindex>
\nMinule jsme implementovali mechanismus eSNI do knihovny OpenSSL a \u00fasp\u011b\u0161n\u011b jsme ho pou\u017eili v zn\u00e1m\u00e9m n\u00e1stroji curl. Ale pouze s curlem, jak se \u0159\u00edk\u00e1, se nenasyt\u00edme. Samoz\u0159ejm\u011b bychom r\u00e1di realizovali n\u011bco podobn\u00e9ho v jazyc\u00edch vy\u0161\u0161\u00ed \u00farovn\u011b. Bohu\u017eel, rychl\u00e9 hled\u00e1n\u00ed po splet\u00edch internetu n\u00e1s zklamalo, proto\u017ee podpora mechanismu eSNI je pln\u011b realizov\u00e1na pouze v GOLANG. Tak\u017ee na\u0161e volba nen\u00ed p\u0159\u00edli\u0161 \u0161irok\u00e1: bu\u010f nap\u00ed\u0161eme v \u010dist\u00e9m C nebo C++ s pou\u017eit\u00edm upraven\u00e9 knihovny OpenSSL, nebo pou\u017eijeme samostatn\u00fd fork GOLANG od CloudFlare a pokus\u00edme se portovat na\u0161e n\u00e1stroje tam. V z\u00e1sad\u011b existuje je\u0161t\u011b jedna mo\u017enost, v\u00edce klasick\u00e1, ale z\u00e1rove\u0148 pracn\u00e1 \u2014 implementovat podporu eSNI pro Python. Nakonec Python tak\u00e9 pou\u017e\u00edv\u00e1 OpenSSL pro pr\u00e1ci s https. Ale tuto mo\u017enost nech\u00e1me na v\u00fdvoj n\u011bkomu jin\u00e9mu, a sami se spokoj\u00edme s implementac\u00ed v Go, zejm\u00e9na \u017ee n\u00e1\u0161 obl\u00edben\u00fd Cobalt Strike skv\u011ble pracuje s extern\u00edmi komunika\u010dn\u00edmi kan\u00e1ly (External C2 channel) \u2013 o tom se zm\u00edn\u00edme na konci \u010dl\u00e1nku.<\/p>\n

Zkuste to l\u00e9pe\u2026<\/h3>\n

\nJeden z n\u00e1stroj\u016f realizovan\u00fdch na Go \u2013 n\u00e1\u0161 v\u00fdvoj pro pivoting do s\u00edt\u011b \u2013 tunel rsockstun<\/a><\/noindex>, kter\u00e1, mimochodem, je v sou\u010dasnosti detekov\u00e1na prost\u0159edky spole\u010dnosti Microsoft a Symantec jako velmi \u0161kodliv\u00fd software zam\u011b\u0159en\u00fd na naru\u0161en\u00ed sv\u011btov\u00e9 stability\u2026<\/p>\n

\"Dom\u00e9nov\u00e9
\n
\nBylo by skv\u011bl\u00e9 pou\u017e\u00edt p\u0159edchoz\u00ed v\u00fdvoj i v tomto p\u0159\u00edpad\u011b. Ale tady se objevil mal\u00fd probl\u00e9m. V\u011bc se m\u00e1 tak, \u017ee p\u016fvodn\u011b rsockstun p\u0159edpokl\u00e1d\u00e1 pou\u017eit\u00ed synchronn\u00edho SSL kan\u00e1lu komunikace se serverem. To znamen\u00e1, \u017ee spojen\u00ed se navazuje jednou a existuje po celou dobu provozu tunelov\u00e9ho aplikace. A jak asi ch\u00e1pete, protokol https nen\u00ed \u00fapln\u011b ur\u010den pro tento re\u017eim pr\u00e1ce \u2013 funguje v re\u017eimu po\u017eadavek-odpov\u011b\u010f, kde ka\u017ed\u00fd nov\u00fd http-po\u017eadavek existuje v r\u00e1mci nov\u00e9ho tcp-spojen\u00ed.<\/p>\n

Hlavn\u00ed nev\u00fdhoda takov\u00e9ho sch\u00e9matu spo\u010d\u00edv\u00e1 v tom, \u017ee server nem\u016f\u017ee pos\u00edlat data klientovi, dokud klient neode\u0161le nov\u00fd http-po\u017eadavek. Ale na\u0161t\u011bst\u00ed existuje mnoho variant \u0159e\u0161en\u00ed t\u00e9to problematiky \u2013 streamovac\u00ed p\u0159enos dat prost\u0159ednictv\u00edm http protokolu (nakonec jsme schopni n\u011bjak\u00fdm zp\u016fsobem sledovat na\u0161e obl\u00edben\u00e9 seri\u00e1ly a poslouchat hudbu z port\u00e1l\u016f funguj\u00edc\u00edch na https, a p\u0159enos videa a audia nen\u00ed nic jin\u00e9ho ne\u017e streamovac\u00ed p\u0159enos dat). Jednou z technologi\u00ed pro emulaci plnohodnotn\u00e9ho tcp-spojen\u00ed p\u0159es http protokol jsou technologie webov\u00fdch soket\u016f (WebSockets), jej\u00ed\u017e hlavn\u00edm smyslem je organizovat plnohodnotn\u00e9 s\u00ed\u0165ov\u00e9 spojen\u00ed mezi klientem a webov\u00fdm serverem.<\/p>\n

Na na\u0161e \u0161t\u011bst\u00ed (hur\u00e1!!!) je tato technologie ve v\u0161ech tarifech CloudFlare zapnuta jako v\u00fdchoz\u00ed a skv\u011ble funguje spolu s eSNI. Pr\u00e1v\u011b ji budeme pou\u017e\u00edvat k tomu, abychom nau\u010dili n\u00e1\u0161 tunelov\u00fd program pou\u017e\u00edvat dome\u0148ov\u00fd fronting a skr\u00fdvat se p\u0159ed modern\u00edmi DPI. <\/p>\n

Kr\u00e1tce o WebSockets<\/h3>\n

\nNejd\u0159\u00edve kr\u00e1tce a jednoduch\u00fdmi slovy vysv\u011btl\u00edme webov\u00e9 sokety, abychom m\u011bli v\u0161ichni p\u0159edstavu o tom, s \u010d\u00edm budeme pracovat. <\/p>\n

Technologie webov\u00fdch soket\u016f umo\u017e\u0148uje do\u010dasn\u011b p\u0159epnout z http-spojen\u00ed na standardn\u00ed streamovac\u00ed p\u0159enos dat prost\u0159ednictv\u00edm s\u00ed\u0165ov\u00e9ho soketu, ani\u017e by bylo nutn\u00e9 p\u0159eru\u0161it existuj\u00edc\u00ed tcp-spojen\u00ed. Kdy\u017e chce klient p\u0159epnout na webov\u00fd soket, ve sv\u00e9m http-po\u017eadavku nastav\u00ed n\u011bkolik http-z\u00e1hlav\u00ed. Dv\u011b povinn\u00e1 z\u00e1hlav\u00ed jsou: Connection: Upgrade<\/b><\/i> a Upgrade: websocket<\/b><\/i>. M\u016f\u017ee tak\u00e9 v\u00fdslovn\u011b uv\u00e9st verzi protokolu websocket (Sec-Websockset-Version: 13<\/b><\/i>) a n\u011bco jako base64 identifik\u00e1tor webov\u00e9ho socketu (Sec-WebSocket-Key: DAGDJSiREI3+KjDfwxm1FA==<\/b><\/i>). Server na to odpov\u00edd\u00e1 http-k\u00f3dem 101 Switching Protocols a tak\u00e9 nastavuje hlavi\u010dky Connection, Upgrade<\/b><\/i> a Sec-WebSocket-Accept<\/b><\/i>. Proces p\u0159epnut\u00ed je z\u0159eteln\u011b demonstrov\u00e1n na screenshotu n\u00ed\u017ee:<\/p>\n

\"Dom\u00e9nov\u00e9
\n
\nPot\u00e9 m\u016f\u017eeme pova\u017eovat nastaven\u00ed WebSocket p\u0159ipojen\u00ed za dokon\u010den\u00e9. Jak\u00e1koliv data, a\u0165 u\u017e od klienta, nebo od serveru, nyn\u00ed budou opat\u0159ena nikoliv http, ale WebSocket hlavi\u010dkami (ty za\u010d\u00ednaj\u00ed bajtem 0x82). Nyn\u00ed server nemus\u00ed \u010dekat na \u017e\u00e1dost od klienta, aby p\u0159enesl data, proto\u017ee tcp-p\u0159ipojen\u00ed nen\u00ed p\u0159eru\u0161eno.<\/p>\n

V Go pro pr\u00e1ci s webov\u00fdmi sockety existuje n\u011bkolik knihoven. Nejzn\u00e1m\u011bj\u0161\u00ed z nich jsou Gorilla WebSocket<\/a><\/noindex> a standardn\u00ed WebSocket<\/a><\/noindex>. Vyu\u017eijeme tu posledn\u00ed, proto\u017ee je jednodu\u0161\u0161\u00ed, men\u0161\u00ed a funguje, jak se \u0159\u00edk\u00e1, trochu rychleji.<\/p>\n

V k\u00f3du klienta rsockstun mus\u00edme nahradit vol\u00e1n\u00ed net.dial nebo tls.dial odpov\u00eddaj\u00edc\u00edmi vol\u00e1n\u00edmi WebSocket:<\/p>\n

\"Dom\u00e9nov\u00e9
\n
\n\"Dom\u00e9nov\u00e9
\n
\nChceme, aby klientsk\u00e1 \u010d\u00e1st na\u0161eho tunelovac\u00edho programu byla univerz\u00e1ln\u00ed a schopn\u00e1 pracovat jak p\u0159es p\u0159\u00edm\u00e9 ssl-p\u0159ipojen\u00ed, tak p\u0159es protokol WebSocket. K tomu vytvo\u0159\u00edme samostatnou funkci func connectForWsSocks(address string, proxy string) error {\u2026}<\/b><\/i> podobn\u011b jako connectForSocks()<\/b><\/i> a budeme ji pou\u017e\u00edvat pro pr\u00e1ci s webov\u00fdmi sockety, pokud adresa serveru zadan\u00e1 p\u0159i spu\u0161t\u011bn\u00ed klienta bude za\u010d\u00ednat s ws: nebo wss: (v p\u0159\u00edpad\u011b zabezpe\u010den\u00e9ho WebSocketu).<\/p>\n

Pro serverovou \u010d\u00e1st tunelovac\u00edho programu tak\u00e9 vytvo\u0159\u00edme samostatnou funkci pro pr\u00e1ci s webov\u00fdmi sockety. V n\u00ed bude vytvo\u0159en instance t\u0159\u00eddy http a bude nastavovat zpracovatele http-p\u0159ipojen\u00ed (funkce wsHandler): <\/p>\n

\"Dom\u00e9nov\u00e9
\n
\nA ve\u0161kerou logiku zpracov\u00e1n\u00ed p\u0159ipojen\u00ed (autentizace klienta pomoc\u00ed hesla, z\u0159\u00edzen\u00ed a ukon\u010den\u00ed yamux relace) um\u00edst\u00edme do zpracovatele p\u0159ipojen\u00ed WebSocket:<\/p>\n

\"Dom\u00e9nov\u00e9
\n
\nKompilujeme projekt, spou\u0161t\u00edme serverovou \u010d\u00e1st:<\/p>\n

.\\\/rsockstun \u2013listen ws:127.0.0.1:8080 \u2013pass P@ssw0rd<\/code><\/pre>\n
\nA pot\u00e9 klientskou \u010d\u00e1st:<\/p>\n
.\\\/rsockstun -connect ws:127.0.0.1:8080 \u2013pass P@ssw0rd<\/code><\/pre>\n
\nA zkontrolujeme funk\u010dnost na lok\u00e1ln\u00edm hostu:<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\n\"Dom\u00e9nov\u00e9
\n<\/p>\n
P\u0159ejdeme k domain-frontingu<\/h3>\n
\nS webov\u00fdmi sockety jsme zd\u00e1 se vy\u0159e\u0161ili. Nyn\u00ed se poj\u010fme p\u0159echodn\u011b zam\u011b\u0159it na eSNI a domain-fronting. Jak ji\u017e bylo zm\u00edn\u011bno d\u0159\u00edve, pro pr\u00e1ci s DoH a eSNI pot\u0159ebujeme vz\u00edt speci\u00e1ln\u00ed v\u011btev golangu od spole\u010dnosti CloudFlare<\/a><\/noindex>. Pot\u0159ebujeme v\u011btev s podporou eSNI (pwu\/esni).<\/p>\n
Klonujeme ji k sob\u011b lok\u00e1ln\u011b nebo st\u00e1hneme a rozbal\u00edme odpov\u00eddaj\u00edc\u00ed zip:<\/p>\n
git clone -b pwu\/esni https:\/\/github.com\/cloudflare\/tls-tris.git<\/code><\/pre>\n
\nPot\u00e9 je nutn\u00e9 zkop\u00edrovat adres\u00e1\u0159 GOROOT, nahradit odpov\u00eddaj\u00edc\u00ed soubory z naklonovan\u00e9 v\u011btve a nastavit jej jako prim\u00e1rn\u00ed. Abychom uvolnili v\u00fdvoj\u00e1\u0159e od t\u00e9to starosti, kluci z CloudFlare p\u0159ipravili speci\u00e1ln\u00ed skript \u2013 _dev\/go.sh. Sta\u010d\u00ed jej spustit. Skript spolu s makefile si v\u0161e ud\u011bl\u00e1 s\u00e1m. Pro zaj\u00edmavost \u2013 m\u016f\u017eete nakouknout dovnit\u0159 makefile pro podrobnosti.<\/p>\n
Po proveden\u00ed skriptu, p\u0159i kompilaci projektu, budeme muset jako GOROOT uv\u00e9st lok\u00e1ln\u00ed adres\u00e1\u0159 p\u0159ipraven\u00fd skriptem. V na\u0161em p\u0159\u00edpad\u011b to vypad\u00e1 takto:<\/p>\n
GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" go build \u2026.<\/code><\/pre>\n
\nD\u00e1le je nutn\u00e9 implementovat v tunelu funkci pro dotazov\u00e1n\u00ed a parsov\u00e1n\u00ed ve\u0159ejn\u00fdch eSNI kl\u00ed\u010d\u016f pro po\u017eadovanou dom\u00e9nu. V na\u0161em p\u0159\u00edpad\u011b to budou ve\u0159ejn\u00e9 eSNI kl\u00ed\u010de z front-end server\u016f CloudFlare. K tomu vytvo\u0159\u00edme t\u0159i funkce:<\/p>\n
func makeDoTQuery(dnsName string) ([]byte, error) \nfunc parseTXTResponse(buf []byte, wantName string) (string, error) \nfunc QueryESNIKeysForHost(hostname string) ([]byte, error)<\/code><\/pre>\n
\nN\u00e1zvy funkc\u00ed v podstat\u011b hovo\u0159\u00ed samy za sebe. Obsah vezmeme z souboru esni_query.go, kter\u00fd je sou\u010d\u00e1st\u00ed tls-tris. Prvn\u00ed funkce vytv\u00e1\u0159\u00ed s\u00ed\u0165ov\u00fd paket s dotazem na DNS server CloudFlare, pou\u017e\u00edvaj\u00edc\u00ed protokol DoH (DNS-over-HTTPS), druh\u00e1 parsuje v\u00fdsledky dotazu a z\u00edsk\u00e1v\u00e1 hodnoty ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f dom\u00e9ny, a t\u0159et\u00ed funguje jako kontejner pro prvn\u00ed dv\u011b.<\/p>\n
D\u00e1le p\u0159id\u00e1v\u00e1me do na\u0161\u00ed nov\u011b vytvo\u0159en\u00e9 funkce p\u0159ipojen\u00ed webov\u00e9ho socketu connectForWsSocks<\/b><\/i> funkcionalitu pro dotazov\u00e1n\u00ed eSNI kl\u00ed\u010d\u016f pro dom\u00e9nu. Tam, kde funguje serverov\u00e1 \u010d\u00e1st, nastavujeme parametry TLS a tak\u00e9 stanovujeme jm\u00e9no fiktivn\u00ed \"dom\u00e9ny kryt\u00ed\":<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nJe t\u0159eba poznamenat, \u017ee p\u016fvodn\u011b nebyla v\u011btev tls-tris navr\u017eena pro pou\u017eit\u00ed s dom\u00e9nov\u00fdm frontingem. Proto nebylo v\u011bnov\u00e1no pozornost fiktivn\u00edmu jm\u00e9nu serveru (v r\u00e1mci klientsk\u00e9ho hello paketu se p\u0159ed\u00e1v\u00e1 pr\u00e1zdn\u00e9 pole serverName). Abychom to opravili, budeme muset p\u0159idat do struktury TlsConfig odpov\u00eddaj\u00edc\u00ed pole FakeServerName. Standardn\u00ed pole ServerName struktury nem\u016f\u017eeme pou\u017e\u00edt, proto\u017ee jej pou\u017e\u00edvaj\u00ed intern\u00ed mechanismy tls, a pokud se bude li\u0161it od p\u016fvodn\u00edho, tls handshake skon\u010d\u00ed chybou. Popis struktury TlsConfig je obsa\u017een v souboru tls\/common.go<\/b> \u2013 ten je t\u0159eba opravit:<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\n\"Dom\u00e9nov\u00e9
\n
\nD\u00e1le budeme muset prov\u00e9st zm\u011bny v souboru tls\/handshake_client.go<\/b>, aby pou\u017e\u00edt na\u0161e pole FakeServerName p\u0159i vytv\u00e1\u0159en\u00ed TLS handshake:<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nT\u00edmto jsme hotovi! M\u016f\u017eete zkompilovat projekt a zkontrolovat jeho funk\u010dnost. Ale ne\u017e za\u010dnete s kontrolou, je pot\u0159eba nastavit \u00fa\u010det na CloudFlare. Abych to \u0159ekl jinak \u2013 jednodu\u0161e vytvo\u0159te \u00fa\u010det na CloudFlare a p\u0159ipojte k n\u011bmu svou dom\u00e9nu. V\u0161echny funkce souvisej\u00edc\u00ed s DoH, WebSocket a ESNI jsou ve v\u00fdchoz\u00edm nastaven\u00ed na CloudFlare povoleny. Jakmile se DNS z\u00e1znamy aktualizuj\u00ed \u2013 m\u016f\u017eete zkontrolovat funk\u010dnost dom\u00e9ny proveden\u00edm dotazu na eSNI kl\u00ed\u010de:<\/p>\n
dig +short txt _esni.df13tester.info <\/code><\/pre>\n
\n\"Dom\u00e9nov\u00e9
\n
\nPokud vid\u00edte n\u011bco podobn\u00e9ho pro svou dom\u00e9nu \u2013 znamen\u00e1 to, \u017ee v\u0161echno funguje a m\u016f\u017eete p\u0159ej\u00edt k testov\u00e1n\u00ed.<\/p>\n
Spou\u0161t\u00edme Ubuntu VPS, nap\u0159\u00edklad na DigitalOcean. P. S. V na\u0161em p\u0159\u00edpad\u011b se uk\u00e1zalo, \u017ee pr\u00e1v\u011b p\u0159id\u011blen\u00e1 IP adresa VPS od poskytovatele se nach\u00e1z\u00ed na blacklistu RKN. Tak se nedivte, pokud se v\u00e1m stane n\u011bco podobn\u00e9ho. Museli jsme pou\u017e\u00edt VPN, abychom se dostali na sv\u016fj VPS.<\/p>\n
Kop\u00edrujeme na VPS ji\u017e zkompilovan\u00fd rsockstun (v tom je mimochodem dal\u0161\u00ed v\u00fdhoda Golangu \u2013 m\u016f\u017eete zkompilovat projekt u sebe a spustit jej na libovoln\u00e9m Linuxu, sta\u010d\u00ed dodr\u017eet architekturu syst\u00e9mu) a spou\u0161t\u00edme serverovou \u010d\u00e1st:<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nA pot\u00e9 klientskou \u010d\u00e1st:<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nJak vid\u00edme, klient se \u00fasp\u011b\u0161n\u011b p\u0159ipojil k serveru p\u0159es frontendov\u00fd server CloudFlare pomoc\u00ed WebSocketu. Pro ov\u011b\u0159en\u00ed, \u017ee tunel funguje skute\u010dn\u011b jako tunel, m\u016f\u017eete prov\u00e9st curl dotaz p\u0159es m\u00edstn\u00ed socks5, otev\u0159en\u00fd na serveru:<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nNyn\u00ed se pod\u00edvejme, co DPI vid\u00ed v kan\u00e1lu komunikace:<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nNejprve tunelovac\u00ed klient, pomoc\u00ed mechanismu DoH, se obrac\u00ed na DNS server CloudFlare pro eSNI kl\u00ed\u010de c\u00edlov\u00e9 dom\u00e9ny (pakety \u010d. 1-19), a pot\u00e9 se obrac\u00ed na frontendov\u00fd server a navazuje TLS spojen\u00ed, p\u0159i\u010dem\u017e se schov\u00e1v\u00e1 za dom\u00e9nou www.google.com<\/a><\/noindex> (to je v\u00fdchoz\u00ed hodnota, kdy\u017e p\u0159i spu\u0161t\u011bn\u00ed klienta nen\u00ed zad\u00e1na fiktivn\u00ed dom\u00e9na). Pro ur\u010den\u00ed sv\u00e9 fiktivn\u00ed dom\u00e9ny je nutn\u00e9 pou\u017e\u00edt parametr -fronfDomain:<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\n\"Dom\u00e9nov\u00e9
\n
\nNyn\u00ed je\u0161t\u011b jedna v\u011bc. Ve v\u00fdchoz\u00edm nastaven\u00ed m\u00e1 \u00fa\u010det na CloudFlare nastaven re\u017eim Flexible SSL. To znamen\u00e1, \u017ee https dotazy na frontendov\u00e9 servery CloudFlare od klient\u016f budou p\u0159esm\u011brov\u00e1ny v ne\u0161ifrovan\u00e9 (http) podob\u011b na n\u00e1\u0161 server. Pr\u00e1v\u011b proto jsme spou\u0161t\u011bli serverovou \u010d\u00e1st tunelovac\u00edho syst\u00e9mu v non-ssl re\u017eimu (-listen ws:0.0.0.0), a ne (-listen wss:0.0.0.0).<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nPro p\u0159epnut\u00ed do re\u017eimu pln\u00e9ho \u0161ifrov\u00e1n\u00ed je pot\u0159eba vybrat Full<\/b>, nebo Full (strict)<\/b> v p\u0159\u00edpad\u011b existence platn\u00e9ho certifik\u00e1tu na serveru. Po p\u0159epnut\u00ed re\u017eimu budeme moci p\u0159ij\u00edmat p\u0159ipojen\u00ed od CloudFlare pomoc\u00ed protokolu https. Nezapome\u0148te vygenerovat self-signed certifik\u00e1t pro serverovou \u010d\u00e1st tunelova\u010de.<\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nPozorn\u00fd \u010dten\u00e1\u0159 se m\u016f\u017ee zeptat: \u201eA co klient na Windows? V\u017edy\u0165 hlavn\u00edm pou\u017eit\u00edm tunelova\u010de je zbudov\u00e1n\u00ed backconnectu z firemn\u00edch po\u010d\u00edta\u010d\u016f a server\u016f, a tam v\u011bt\u0161inou b\u011b\u017e\u00ed Windows. Jak mohu zkompilovat tunelova\u010d pro Windows, kdy\u017e m\u00e1m specifick\u00fd stack TLS?\u201c A nyn\u00ed si p\u0159edstavme dal\u0161\u00ed vychyt\u00e1vku, kter\u00e1 ukazuje, jak snadno se to d\u011bl\u00e1 v Golangu. Kompilujeme pro Windows p\u0159\u00edmo z Kali, jednodu\u0161e p\u0159id\u00e1n\u00edm parametru GOOS=windows:<\/p>\n
GOARCH=amd64 GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" GOOS=windows go build -ldflags=\"-s -w\"<\/code><\/pre>\n
\nNebo 32bitovou variantu:<\/p>\n
GOARCH=386 GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" GOOS=windows go build -ldflags=\"-s -w\"<\/code><\/pre>\n
\nHotovo! A \u017e\u00e1dn\u00e9 dal\u0161\u00ed komplikace nejsou pot\u0159eba. Opravu to funguje! <\/p>\n
\"Dom\u00e9nov\u00e9
\n
\nKompila\u010dn\u00ed flagem \u2013w a \u2013s slou\u017e\u00ed k odstran\u011bn\u00ed zbyte\u010dn\u00e9ho balastu z spustiteln\u00e9ho souboru, \u010d\u00edm\u017e ho zmen\u0161\u00edme o p\u00e1r megabyt\u016f. Dodate\u010dn\u011b ho lze pot\u00e9 zabalit pomoc\u00ed UPX, aby se je\u0161t\u011b zmen\u0161ila velikost.<\/p>\n
Na z\u00e1v\u011br<\/h3>\n
\nV \u010dl\u00e1nku jsme na p\u0159\u00edkladu tunelova\u010de napsan\u00e9ho v Golangu n\u00e1zorn\u011b uk\u00e1zali pou\u017eit\u00ed nov\u00e9 technologie domain-fronting, kter\u00e1 vych\u00e1z\u00ed z fascinuj\u00edc\u00ed rysy protokolu TLS 1.3. Podobn\u00fdm zp\u016fsobem lze p\u0159izp\u016fsobit existuj\u00edc\u00ed n\u00e1stroje napsan\u00e9 v Golangu tak, aby pracovaly s servery CloudFlare, nap\u0159\u00edklad. Merlin<\/a><\/noindex> \u2014 zn\u00e1m\u00fd C2, nebo p\u0159inutit CobaltStrike Beacon vyu\u017e\u00edt eSNI domain-fronting p\u0159i pr\u00e1ci s Teamserver p\u0159es External C2 Channel<\/a><\/noindex>, implementovan\u00fd v Golangu, nebo tak\u00e9 ve standardn\u00edm C++ s pou\u017eit\u00edm upraven\u00e9 verze OpenSSL, o kter\u00e9 jsme hovo\u0159ili v p\u0159edchoz\u00ed \u010d\u00e1sti \u010dl\u00e1nku. V podstat\u011b, fantazii se meze nekladou.<\/p>\n
P\u0159\u00edklad s tunelova\u010dem a CloudFlare je p\u0159edstaven jako koncept a v tuto chv\u00edli je obt\u00ed\u017en\u00e9 \u0159\u00edci, jak\u00e9 budou dalekos\u00e1hl\u00e9 vyhl\u00eddky tohoto typu domain-frontingu. V sou\u010dasnosti je podpora eSNI zavedena pouze u CloudFlare a teoreticky by nic nem\u011blo br\u00e1nit jejich vypnut\u00ed tohoto typu frontingu a nap\u0159\u00edklad ukon\u010den\u00ed tls-p\u0159ipojen\u00ed p\u0159i nesouladu SNI a eSNI. Budoucnost uk\u00e1\u017ee. Ale prozat\u00edm se perspektiva pr\u00e1ce \"pod hlavi\u010dkou kremlin.ru\" zd\u00e1 b\u00fdt velmi l\u00e1kav\u00e1. Co \u0159\u00edk\u00e1te?<\/p>\n
Aktualizovan\u00fd k\u00f3d tunelov\u00e9ho programu, jako\u017e i zkompilovan\u00e9 spustiteln\u00e9 exe soubory jsou um\u00edst\u011bny v samostatn\u00e9 v\u011btvi projektu na github<\/a><\/noindex>. O v\u0161ech mo\u017en\u00fdch probl\u00e9mech tunelov\u00e9ho programu je nejlep\u0161\u00ed ps\u00e1t issue na str\u00e1nce projektu na GitHubu.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043c\u044b \u0434\u0430\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 encrypted SNI (eSNI). \u041f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043d\u0430 \u0435\u0433\u043e \u043e\u0441\u043d\u043e\u0432\u0435 \u043c\u043e\u0436\u043d\u043e \u0443\u043a\u043b\u043e\u043d\u044f\u0442\u044c\u0441\u044f \u043e\u0442 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438 DPI-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 (\u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0431\u0438\u043b\u0430\u0439\u043d\u043e\u0432\u0441\u043a\u043e\u0433\u043e DPI \u0438 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0420\u041a\u041d \u0440\u0443\u0442\u0440\u0435\u043a\u0435\u0440\u0430), \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0434\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430. \u0412\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0432\u0435\u0449\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53317","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dom\u00e9nov\u00e9 frontov\u00e1n\u00ed na b\u00e1zi TLS 1.3. \u010c\u00e1st 2 | ProHoster","description":"\u00davod V prvn\u00ed \u010d\u00e1sti \u010dl\u00e1nku jsme poskytli stru\u010dn\u00fd popis mechanismu encrypted SNI (eSNI).","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3. \u0427\u0430\u0441\u0442\u044c 2 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043c\u044b \u0434\u0430\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 encrypted SNI (eSNI).","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53317","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=53317"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53317\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=53317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=53317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=53317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}