{"id":34725,"date":"2019-10-31T22:00:00","date_gmt":"2019-10-31T19:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pishem-reverse-socks5-proxy-na-powershell-chast-1\/"},"modified":"2019-10-31T22:00:00","modified_gmt":"2019-10-31T19:00:00","slug":"pishem-reverse-socks5-proxy-na-powershell-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","title":{"rendered":"Creating a Reverse socks5 proxy in PowerShell. Part 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A story about research and development in 3 parts. Part 1 \u2014 the research phase.<br \/>\nThere are many books \u2014 even more usefulness.<\/p>\n<h3>Task Definition<\/h3>\n<p>\nDuring the course of penetration tests and Red Team campaigns, it's not always possible to utilize the standard tools of the clients, such as VPN, RDP, Citrix, etc., as a means to gain access to the internal network. In some cases, the standard VPN operates under MFA with a hardware token as the second factor, in others, it is closely monitored, and our entry via VPN is immediately visible, as they say \u2014 with all the repercussions, and in some instances, such tools simply do not exist. <\/p>\n<p>In such cases, we constantly have to create so-called 'reverse tunnels' \u2014 connections from the internal network to an external resource or a server controlled by us. Inside such a tunnel, we can work with the internal resources of the clients.<\/p>\n<p>There are several varieties of these reverse tunnels. The most well-known is, of course, Meterpreter. SSH tunnels with reverse port forwarding are also quite popular among the hacking community. There are many tools available for implementing reverse tunneling, and many of them are well studied and documented.<br \/>\nOf course, the developers of security solutions do not remain idle and actively detect such actions.<br \/>\nFor instance, MSF sessions are effectively detected by modern IPS systems from Cisco or Positive Tech, and a reverse SSH tunnel can be detected by practically any decent firewall.<\/p>\n<p>Therefore, to remain unnoticed in a quality Red Team campaign \u2014 we need to build a reverse tunnel using non-standard methods and adjust as closely as possible to the actual operational mode of the network.<\/p>\n<p>Let\u2019s try to find or invent something similar.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nBefore inventing something, we need to understand what result we want to achieve, what functions our development should perform. What requirements will there be for the tunnel so that we can operate with maximum stealth?<\/p>\n<p>Clearly, these requirements can vary significantly for each case, but from experience, we can highlight the main ones:<\/p>\n<ul>\n<li> operating on Windows 7-10, as most corporate networks use Windows.<\/li>\n<li> The client connects to the server via SSL to prevent eavesdropping by IPS tools;<\/li>\n<li> When connecting, the client must support operation through an authenticated proxy server, as in many companies, internet access is achieved through a proxy. In fact, the client machine may not even be aware of this, as the proxy operates in transparent mode. However, we must incorporate such functionality;<\/li>\n<li> The client part should be concise and portable;<br \/>\nIt is clear that to work within the customer's network on the client machine, OpenVPN can be installed to establish a full tunnel to its server (especially since OpenVPN clients can work through proxies). But, firstly, it may not always be possible, as we might not be local admins there, and secondly, it will create so much noise that a proper SIEM or HIPS will immediately flag us. Ideally, our client should function as an inline command, similar to how many bash shells are implemented, and be executed via the command line, for example, when executing commands from a Word macro.<\/li>\n<li> Our tunnel must be multithreaded and support multiple connections simultaneously;<\/li>\n<li> The client-server connection must have some form of authorization so that the tunnel is established only for our client, and not for everyone who comes to our server at the specified address and port. Ideally, a landing page featuring cats or a theme professionally related to the origin domain should open for 'external users.'<br \/>\nFor instance, if the customer is a medical organization, the security administrator seeking to check the resource accessed by a clinic employee should see a page featuring pharmaceutical products, a Wikipedia entry on the diagnosis, or a blog by Dr. Komarovsky, etc. <\/li>\n<\/ul>\n<p><\/p>\n<h3>Analysis of existing tools<\/h3>\n<p>\nBefore inventing your own bicycle, it is necessary to analyze existing bicycles and understand whether we truly need it, as we are likely not the only ones who have considered the necessity of such a functional bicycle.<\/p>\n<p>Searching the internet (we seem to do it quite well) and looking on GitHub with the keywords \"reverse socks\" didn't yield many results. Mostly, everything boils down to building SSH tunnels with reverse port forwarding and everything related to that. In addition to SSH tunnels, there are several solutions worth noting:<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/klsecservices\/rpivot\">github.com\/klsecservices\/rpivot<\/a><\/noindex><\/b><br \/>\nAn old implementation of a reverse tunnel from the Kaspersky Lab team. The script's purpose is clear from its name. It is implemented in Python 2.7, and the tunnel operates in cleartext mode (as is popular to say now \u2014 greetings to the Russian Federal Service for Surveillance of Communications, Information Technology and Mass Media).<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/tonyseek\/rsocks\">github.com\/tonyseek\/rsocks<\/a><\/noindex><\/b><br \/>\nAnother Python implementation, also in cleartext, but with more capabilities. It is written as a module and has an API for integrating the solution into your projects.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/llkat\/rsockstun\">github.com\/llkat\/rsockstun<\/a><\/noindex><\/b><br \/>\n<b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mis-team\/rsockstun\">github.com\/mis-team\/rsockstun<\/a><\/noindex><\/b><br \/>\nThe first link is the original version of the reverse socks implementation in Golang (not supported by the developer).<br \/>\nThe second link is our enhancement with additional features, also in Golang. In our version, we implemented SSL, proxy support with NTLM authentication, client authorization, a landing page for incorrect passwords (rather, a redirect to the landing page), multi-threading (i.e., multiple users can work with the tunnel simultaneously), and a system to ping the client to check if it is alive or not.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jun7th\/tsocks\">github.com\/jun7th\/tsocks<\/a><\/noindex><\/b><br \/>\nA reverse socks implementation from our \"Chinese friends\" in Python. For the lazy and the \"immortal,\" there's also a ready-to-use binary (exe) compiled by the Chinese. Here, only the Chinese god knows what else might be in this binary besides the main functionality, so use it at your own risk.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/securesocketfunneling\/ssf\">github.com\/securesocketfunneling\/ssf<\/a><\/noindex><\/b><br \/>\nA rather interesting project in C++ for implementing reverse socks and more. Besides reverse tunneling, it can do port forwarding, shell execution, etc.<\/p>\n<p><b>MSF meterpreter<\/b><br \/>\nAs they say, no comments needed. Any reasonably educated hacker is well acquainted with this tool and understands how easily it can be detected by security measures.<\/p>\n<p>All of the tools described above operate on similar technology: a pre-prepared executable binary module is launched on a machine within the network, establishing a connection with an external server. A SOCKS4\/5 server runs on the server, accepting connections and relaying them to the client.<\/p>\n<p>The drawback of all the aforementioned tools is that either Python or Golang must be installed on the client machine (how often do you encounter Python installed on the machines of, say, a company director or office workers?), or a precompiled binary (essentially Python and the script in one package) must be transferred to that machine and executed there. Loading an exe and then running it poses a significant signature for local antivirus or HIPS.<\/p>\n<p>Overall, the conclusion is obvious\u2014we need a solution in PowerShell. At this point, we might get tomatoes thrown at us for saying that PowerShell is already outdated, monitored, blocked, etc. In reality, this is not the case everywhere. We affirm this responsibly. By the way, there are countless ways to bypass blocks (again, a popular phrase greeting the RKN \ud83d\ude42), from simply renaming powershell.exe to cmdd.exe to techniques like powerdll.<\/p>\n<h3>Let's start inventing.<\/h3>\n<p>\nIt's clear that first, we will look on Google and\u2026 find absolutely nothing on this topic (if anyone has found something\u2014please share links in the comments). There is only <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/p3nt4\/Invoke-SocksProxy\">implementation<\/a><\/noindex> Socks5 in PowerShell, but this is just a standard \"direct\" SOCKS, which has its own set of drawbacks (we'll discuss those later). Of course, with a simple trick, we can turn it into a reverse proxy, but it would only be a single-threaded SOCKS, which isn't quite what we need.<\/p>\n<p>So, we found nothing ready-made, hence we will have to invent our own bicycle. The basis of our bicycle will be <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mis-team\/rsockstun\">our development<\/a><\/noindex> of a reverse SOCKS in Golang, and we will implement the client for it in PowerShell.<\/p>\n<p><b>RSocksTun<\/b><br \/>\nSo, how does rsockstun work?<\/p>\n<p>The operation of RsocksTun (hereinafter referred to as rs) is based on two software components\u2014Yamux and a SOCKS5 server. The SOCKS5 server is a standard local SOCKS5, which runs on the client. Connection multiplexing to it (remember about multithreading?) is handled using Yamux (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hashicorp\/yamux\/\">yet another multiplexer<\/a><\/noindex>). This scheme allows you to run multiple client SOCKS5 servers and distribute external connections to them, routing them through a single TCP connection (almost like in meterpreter) from the client to the server, thus implementing a multithreaded mode without which we simply cannot operate effectively within the internal network.<\/p>\n<p>The essence of Yamux's operation lies in the introduction of an additional network layer of streams, implemented as a 12-byte header for each packet. (Here we deliberately use the word 'stream' and not ' \u043f\u043e\u0442\u043e\u043a\u0430' to avoid confusing the reader with the programming term 'thread' \u2014 this concept will also be used in this article.) Inside the Yamux header, there are the stream number, flags for establishing\/terminating the stream, the number of bytes transmitted, and the size of the transmission window.<\/p>\n<p><img decoding=\"async\" alt=\"Creating a Reverse socks5 proxy in PowerShell. Part 1\" src=\"\/wp-content\/uploads\/2019\/05\/3a1bc23bdc90176f7cd37f112a8a1a6c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIn addition to establishing\/terminating streams, Yamux has a keepalive mechanism that allows monitoring the functionality of an established communication channel. The operation of the keepalive messages mechanism is configured when creating a Yamux session. Actually, there are only two settings: enable\/disable and the frequency of sending packets in seconds. Keepalive messages can be sent by either the Yamux server or the Yamux client. Upon receiving a keepalive message, the remote side must respond with a packet containing the exact same message identifier (essentially a number) that it received. In general, keepalive is similar to a ping, but for Yamux.<\/p>\n<p>Detailed techniques for the operation of the multiplexer: types of packets, flags for establishing and terminating connections, and the data transfer mechanism are described in <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hashicorp\/yamux\/blob\/master\/spec.md\">the specification<\/a><\/noindex> the Yamux documentation. <\/p>\n<h3>Conclusion to the first part<\/h3>\n<p>\nSo, in the first part of the article, we familiarized ourselves with some tools for organizing reverse tunnels, looked at their advantages and disadvantages, studied the operation of the Yamux multiplexer mechanism, and outlined the main requirements for the newly created PowerShell module. In the next part, we will focus on developing the module itself, practically from scratch. Stay tuned \ud83d\ude42<br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/453870\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445. \u0427\u0430\u0441\u0442\u044c 1 \u2014 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f. \u0411\u0443\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u043e \u2014 \u043f\u043e\u043b\u044c\u0437\u044b \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435. \u041f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0437\u0430\u0434\u0430\u0447\u0438 \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u043e\u0432 \u0438 RedTeam \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0448\u0442\u0430\u0442\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0417\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a VPN, RDP, Citrix \u0438 \u0442.\u0434. \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u043e\u0434\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0413\u0434\u0435-\u0442\u043e \u0448\u0442\u0430\u0442\u043d\u044b\u0439 VPN \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e MFA [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0438\u0448\u0435\u043c Reverse socks5 proxy \u043d\u0430 powershell.\u0427\u0430\u0441\u0442\u044c 1 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Writing a Reverse SOCKS5 Proxy in PowerShell. Part 1 | ProHoster","description":"A three-part story about research and development.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0438\u0448\u0435\u043c Reverse socks5 proxy \u043d\u0430 powershell.\u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:00+00:00","article:modified_time":"2019-10-31T19:00:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:23:33","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:32","updated":"2026-01-21 20:23:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/34725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=34725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/34725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/26164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=34725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=34725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=34725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}