{"id":34725,"date":"2019-10-31T22:00:00","date_gmt":"2019-10-31T19:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pishem-reverse-socks5-proxy-na-powershell-chast-1\/"},"modified":"2019-10-31T22:00:00","modified_gmt":"2019-10-31T19:00:00","slug":"pishem-reverse-socks5-proxy-na-powershell-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","title":{"rendered":"Kirjutame Reverse socks5 proxy Powershellis. Osa 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>K\u00e4esolev uurimist\u00f6\u00f6 ja arendustegevuse lugu on jagatud kolme ossa. Osa 1 \u2014 uurimine.<br \/>\nPalju lisan\u00e4itajaid \u2014 veelgi rohkem kasu.<\/p>\n<h3>\u00dclesande seadmine<\/h3>\n<p>\nPentestide ja RedTeam kampaaniate k\u00e4igus ei ole alati v\u00f5imalik kasutada Tellija tavaressursse, nagu VPN, RDP, Citrix jne, et p\u00e4\u00e4seda sises\u00fcsteemi. M\u00f5nes kohas t\u00f6\u00f6tab tavap\u00e4rane VPN MFA kaudu ja teise faktorina kasutatakse riistvara tokenit, teises kohas j\u00e4lgitakse seda rangelt ja meie korraldatud sisenemine VPN-i kaudu on koheselt n\u00e4htav, nagu \u00f6eldud \u2014 k\u00f5igi selle tagaj\u00e4rgedega, kuid m\u00f5nes kohas ei ole selliseid vahendeid lihtsalt olemas. <\/p>\n<p>Sellistes olukordades tuleb pidevalt luua nn 'tagasi tunnelid' \u2014 \u00fchendused sises\u00fcsteemist v\u00e4listesse ressurssidessse v\u00f5i meie kontrolli all olevasse serverisse. Sellise tunneli sees saame juba t\u00f6\u00f6tada Tellijate siseressurssidega.<\/p>\n<p>Tagasiulatuvaid tunnelite mitmekesisus on suur. K\u00f5ige tuntum neist on muidugi Meterpreter. Samuti on suur n\u00f5udlus SSH tunnelite j\u00e4rele, mille abil tagasiviidud pordid on populaarsed h\u00e4kkerite seas. Tagasiulatuva tunnelimise teostamiseks on palju vahendeid, millest paljud on h\u00e4sti uuritud ja dokumenteeritud.<br \/>\nMuidugi ei j\u00e4\u00e4 turvalahenduste arendajad oma kohustuste t\u00e4itmisega k\u00f5rvale ning nad tuvastavad aktiivselt selliseid tegevusi.<br \/>\nN\u00e4iteks tuvastavad kaasaegsed IPS-d, nagu Cisco v\u00f5i Positive Tech, MSF seansid edukalt, ja tagasiulatuvat SSH tunnelit saab tuvastada praktiliselt mis tahes normaalse tulem\u00fc\u00fcriga.<\/p>\n<p>Seega, et j\u00e4\u00e4da m\u00e4rkamatuks heades RedTeam kampaaniates, peame looma tagasiulatuva tunneli ebatavaliste vahenditega ja kohandama meid v\u00f5imalikult l\u00e4hedale v\u00f5rgu tegelikule t\u00f6\u00f6re\u017eiimile.<\/p>\n<p>Proovime leida v\u00f5i leiutada midagi sarnast.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nEnne midagi v\u00e4lja m\u00f5elda, tuleb m\u00f5ista, millist tulemust soovime saavutada ja milliseid funktsioone meie arendus peab t\u00e4itma. Millised on n\u00f5uded tunnelile, et saaksime t\u00f6\u00f6tada maksimaalse varjamatuse re\u017eiimis?<\/p>\n<p>On selge, et igas olukorras v\u00f5ivad need n\u00f5uded erineda, kuid t\u00f6\u00f6praktika p\u00f5hjal v\u00f5ib v\u00e4lja tuua p\u00f5hin\u00f5uded:<\/p>\n<ul>\n<li> t\u00f6\u00f6tamine Windows 7-10 operatsioonis\u00fcsteemidel, kuna enamikus ettev\u00f5ttev\u00f5rgustikes kasutatakse just Windowsit;<\/li>\n<li> klient \u00fchendub serveriga SSL protokolli kaudu, et v\u00e4listada sisemist kuulamist IPS-i vahenditega;<\/li>\n<li> \u00fchendamisel peab klient toetama t\u00f6\u00f6ks l\u00e4bi autentimisega proxy-serveri, kuna paljudes ettev\u00f5tetes toimub internetti p\u00e4\u00e4semine proxy kaudu. Tegelikult ei pruugi kliendi masin sellest isegi midagi teada, kuna proxy t\u00f6\u00f6tatakse v\u00e4lja l\u00e4bipaistvas re\u017eiimis. Kuid selline funktsionaalsus peab olema meie lahenduses olemas;<\/li>\n<li> kliendi osa peab olema kompaktselt kirjutatud ja kantav;<br \/>\nSelge, et kliendi masinasse saab OpenVPN-i installida ja luua t\u00e4isfunktsionaalne tunnel oma serverisse (head seet\u00f5ttu, et OpenVPN-i kliendid oskavad t\u00f6\u00f6tada l\u00e4bi proksi). Kuid esiteks, see ei pruugi alati \u00f5nnestuda, kuna me ei pruugi olla seal kohalike administraatorite, ja teiseks, see tekitab nii palju m\u00fcra, et korralik SIEM v\u00f5i HIPS teatab kohe meile \"kuhu vaja\". Ideaalis peaks meie klient olema nn inline meeskond, nagu on n\u00e4iteks teostatud paljudes bash-shellides, ja k\u00e4ivituma k\u00e4surealt, n\u00e4iteks k\u00e4skude t\u00e4itmisel Wordi makrost.<\/li>\n<li> meie tunnel peaks olema mitme\u00fchenduslik ja toetama mitmeid \u00fchendusi korraga;<\/li>\n<li> kliendi-serveri \u00fchendusel peaks olema mingi autentimine, et tunnel luuakse ainult meie kliendile, mitte k\u00f5igile, kes tulevad meie serverisse antud aadressi ja pordiga. Ideaalis peaks \"kolmandatele kasutajatele\" avanema maandumisleht kassidega v\u00f5i professionaalse temaatikaga, mis on seotud algse domeeniga.<br \/>\nN\u00e4iteks, kui tellijaks on meditsiiniasutus, siis peab infotehnoloogia administraator, kes otsustab kontrollida ressurssi, millele kutsus \u00fcles kliiniku t\u00f6\u00f6taja, n\u00e4gema lehte farmatseutiliste toodete, haiguse kirjelduse vikipeedia v\u00f5i dr Komarovski blogiga jne. <\/li>\n<\/ul>\n<p><\/p>\n<h3>Olemasolevate t\u00f6\u00f6riistade anal\u00fc\u00fcs<\/h3>\n<p>\nEnne oma jalgratta leiutamist on oluline anal\u00fc\u00fcsida olemasolevaid jalgrattaid ja m\u00f5ista, kas see on meile t\u00f5eliselt vajalik ning ilmselt ei ole me ainukesed, kes on m\u00f5elnud sellise funktsionaalse jalgratta vajadusele.<\/p>\n<p>Interneti otsing (googeldame me tundub, et normaalselt) ning ka githubis otsing v\u00f5tmes\u00f5nade \"reverse socks\" j\u00e4rgi ei andnud eriti palju tulemusi. Peamiselt piirduvad k\u00f5ik SSH tunnelite loomisega tagasip\u00f6\u00f6ratud portide l\u00e4biviimisega ja k\u00f5ik, mis sellega seondub. Lisaks SSH tunnelitele v\u00f5ib v\u00e4lja tuua mitmeid lahendusi:<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/klsecservices\/rpivot\">github.com\/klsecservices\/rpivot<\/a><\/noindex><\/b><br \/>\nKauaegu v\u00e4ljat\u00f6\u00f6tatud tagasitunneldamise lahendus Kaspersky Labori meeskonnalt. Nimi viitab selgelt, milleks see skript m\u00f5eldud on. Teostatud Python 2.7, tunnel t\u00f6\u00f6tab selges tekstis (nagu praegu moes on \u2014 tervitused RKN-ile)<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/tonyseek\/rsocks\">github.com\/tonyseek\/rsocks<\/a><\/noindex><\/b><br \/>\nVeel \u00fcks teostus Pythoni keeles, samuti selges tekstis, kuid rohkem v\u00f5imalusi. Kirjutatud moodulina ja pakub API-d lahenduse integreerimiseks oma projektidesse.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/llkat\/rsockstun\">github.com\/llkat\/rsockstun<\/a><\/noindex><\/b><br \/>\n<b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mis-team\/rsockstun\">github.com\/mis-team\/rsockstun<\/a><\/noindex><\/b><br \/>\nEsimene link \u2014 algne versioon tagasitunneldamise teostusest Go keeles (arendaja ei toeta).<br \/>\nTeine link \u2014 meie t\u00e4iustatud versioon koos lisafunktsioonidega, samuti Go keeles. Meie versioonis oleme rakendanud SSL-i, t\u00f6\u00f6tamise l\u00e4bi proxye NTLM-autentimisega, autentimise kliendil, maandumislehe vale parooli korral (\u00f5igemini \u2014 suunamise maandumislehele), mitme l\u00f5ime re\u017eiimi (s.t. tunnelit saavad kasutada mitu inimest samaaegselt), kliendi pingimiss\u00fcsteemi selle kohta \u2014 kas ta on elus v\u00f5i mitte.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jun7th\/tsocks\">github.com\/jun7th\/tsocks<\/a><\/noindex><\/b><br \/>\nMeie \u00abhiina s\u00f5prade\u00bb koostatud tagasi SOCKS Pythonis. Siin on ka valmis binaar (exe), mille on kokku pannud hiinlased ja mis on kasutamiseks valmis. Ainult hiina jumal teab, mis muidu selle binaari sees on peale peamise funktsionaalsuse, seega kasutage seda omal riskil.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/securesocketfunneling\/ssf\">github.com\/securesocketfunneling\/ssf<\/a><\/noindex><\/b><br \/>\nTegemist on \u00fcsna huvitava C++ projektiga tagasi SOCKS-i ja muude otsingute rakendamiseks. Peale tagasi tunneli loomise suudab ta ka porte edastada, luua k\u00e4surea ja nii edasi.<\/p>\n<p><b>MSF meterpreter<\/b><br \/>\nSiin, nagu \u00f6eldakse, kommentaarideta. K\u00f5ik v\u00e4hemalt veidi haritud h\u00e4kkerid tunnevad selle asjaga h\u00e4sti ja m\u00f5istavad, kui kergelt kaitsemeetmed seda avastavad.<\/p>\n<p>K\u00f5ik eelnevalt kirjeldatud t\u00f6\u00f6riistad t\u00f6\u00f6tavad sarnasel tehnoloogial: v\u00f5rgusiseses masinas k\u00e4ivitub eelnevalt ettevalmistatud t\u00e4idetav binaarmoodul, mis loob \u00fchenduse v\u00e4lise serveriga. Serveris k\u00e4ivitub SOCKS4\/5 server, mis aktsepteerib \u00fchendusi ja edastab need kliendile.<\/p>\n<p>K\u00f5ikide \u00fclaltoodud t\u00f6\u00f6riistade puuduseks on see, et kas on vajalik Python v\u00f5i Golangi installatsioon kliendimasinas (kui sageli olete kohanud paigaldatud Pythonit n\u00e4iteks ettev\u00f5tte juhataja v\u00f5i kontorit\u00f6\u00f6tajate masinates?), v\u00f5i tuleb sellele masinale tuua eelnevalt loodud binaar (p\u00f5him\u00f5tteliselt python ja skript \u00fches pakendis) ja k\u00e4ivitada see seal. Ja exe faili allalaadimine ja selle k\u00e4ivitamine on kohaliku viiruset\u00f5rje v\u00f5i HIPS'i jaoks kahtlane signeering.<\/p>\n<p>\u00dcldiselt on j\u00e4reldus iseenesestm\u00f5istetav \u2014 meil on vaja lahendust PowerShellis. N\u00fc\u00fcd v\u00f5ivad meil meid tomatid lendama hakata \u2014 et PowerShell on juba k\u00f5vasti l\u00e4bi k\u00e4idud, seda j\u00e4lgitakse, blokeeritakse jne. Tegelikult ei ole see sugugi igal pool nii. Vastutustundlikult v\u00e4idame. Muide, palju on viise, kuidas blokeeringutest m\u00f6\u00f6da hiilida (siin tuleb j\u00e4lle moes lause tervitustega RKN-le \ud83d\ude42), alates PowerShell.exe lihtsast \u00fcmbernimetamisest cmdd.exe'ks ja l\u00f5petades powerdll ja muuga.<\/p>\n<h3>Alustame leiutamist<\/h3>\n<p>\nSelge on, et k\u00f5igepealt vaatame Google\u2019isse ja... ei leia sellel teemal absoluutselt mitte midagi (kui keegi leidis \u2014 saatke lingid kommentaaridesse). Ainult <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/p3nt4\/Invoke-SocksProxy\">teostamine<\/a><\/noindex> Socks5 PowerShellis, kuid see on tavaline \"otse\" sokk, millel on mitmeid oma puudusi (millest r\u00e4\u00e4gime hiljem). Loomulikult v\u00f5ib selle kergelt tagasi p\u00f6\u00f6rata, kuid see oleks ainult \u00fcheahelaline sokk, mis ei ole just see, mida vajame.<\/p>\n<p>Noh, me ei leidnud midagi valmis, seega peame ikkagi oma ratta leiutama. Meie ratta aluseks saab olema <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mis-team\/rsockstun\">meie arendus<\/a><\/noindex> tagasip\u00f6\u00f6rduv sokk golangis, ning klient selle jaoks teostame PowerShellis.<\/p>\n<p><b>RSocksTun<\/b><br \/>\nNoh, kuidas RSocksTun t\u00f6\u00f6tab?<\/p>\n<p>RSocksTuni (edaspidi \u2013 rs) t\u00f6\u00f6p\u00f5him\u00f5te p\u00f5hineb kahel programmakomponendil \u2013 Yamux ja Socks5 server. Socks5 server on tavaline kohalik socks5, see k\u00e4ivitub kliendil. Ja \u00fchenduste multiplexerimine (kas m\u00e4letate, et r\u00e4\u00e4gime mitme l\u00f5ime kasutamisest?) toimub yamuxi kaudu (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hashicorp\/yamux\/\">veel \u00fcks multiplexer<\/a><\/noindex>). Selline skeem v\u00f5imaldab k\u00e4ivitada mitmeid kliendi sokk5 servereid ja suunata v\u00e4lised \u00fchendused nendesse, edastades need l\u00e4bi \u00fche TCP-\u00fchenduse (peaaegu nagu meterpreter) kliendi ja serveri vahel, rakendades seega mitme l\u00f5ime re\u017eiimi, ilma milleta ei saa me lihtsalt siset\u00f6\u00f6stuses t\u00e4ielikult t\u00f6\u00f6tada.<\/p>\n<p>Yamux'i t\u00f6\u00f6 seisneb selles, et see loob stream'ide jaoks lisav\u00f5rgutaseme, rakendades selle iga paketi puhul 12-baidise p\u00e4ise kujul. (Siin kasutame me sihilikult s\u00f5na \u00abstream\u00bb, mitte voog, et mitte segadusse ajada lugejat programmilise vooga \u00abthread\u00bb \u2014 seda m\u00f5istet kasutame me samuti k\u00e4esolevas artiklis). Yamux'i p\u00e4ises on salvestatud stream'i number, stream'i loomise\/katkestamise lipud, edastatavate baitide arv ja edastusaken.<\/p>\n<p><img decoding=\"async\" alt=\"Kirjutame Reverse socks5 proxy Powershellis. Osa 1\" src=\"\/wp-content\/uploads\/2019\/05\/3a1bc23bdc90176f7cd37f112a8a1a6c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLisaks stream'i loomise\/katkestamise funktsioonile on yamux'is rakendatud keepalive mehhanism, mis v\u00f5imaldab j\u00e4lgida kehtestatud sidekanali toimivust. Keepalive s\u00f5numite t\u00f6\u00f6 t\u00f5husust seadistatakse Yamux-seanssi loomisel. Tegelikult on seal ainult kaks parameetrit: lubamine\/keelamine ja pakettide saatmise sagedus sekundites. Keepalive s\u00f5numeid v\u00f5ib saata nii yamux-server kui ka yamux-kliend. Kui on saadud keepalive s\u00f5num, peab kaugpool vastama sellele identsete s\u00f5numi identifikaatoritega (praktiliselt - numbriga), mille ta sai. \u00dcldiselt on keepalive sama, mis ping, kuid yamux'i jaoks.<\/p>\n<p>Filip k\u00f5igi mulitplexori t\u00f6\u00f6meetodite kohta: pakettide t\u00fc\u00fcbid, \u00fchenduste seadistamise ja l\u00f5petamise lipud, andmete edastamise mehhanism on kirjeldatud <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hashicorp\/yamux\/blob\/master\/spec.md\">spetsifikatsioonis<\/a><\/noindex> yamuxis. <\/p>\n<h3>Esimese osa j\u00e4reldus<\/h3>\n<p>\nNii et artikli esimeses osas tutvustasime m\u00f5ningaid t\u00f6\u00f6riistu tagas tunneli seadmiseks, vaatasime nende eeliseid ja puudusi, uurisime Yamuxi multiplatvormi t\u00f6\u00f6mehhanismi ning kirjeldasime peamisi n\u00f5udeid uuele powershelli moodulile. J\u00e4rgmisel osal keskendume mooduli arendamisele praktiliselt nullist. J\u00e4tkub. P\u00fcsige lainel \ud83d\ude42<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/453870\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445. \u0427\u0430\u0441\u0442\u044c 1 \u2014 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f. \u0411\u0443\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u043e \u2014 \u043f\u043e\u043b\u044c\u0437\u044b \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435. \u041f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0437\u0430\u0434\u0430\u0447\u0438 \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u043e\u0432 \u0438 RedTeam \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0448\u0442\u0430\u0442\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0417\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a VPN, RDP, Citrix \u0438 \u0442.\u0434. \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u043e\u0434\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0413\u0434\u0435-\u0442\u043e \u0448\u0442\u0430\u0442\u043d\u044b\u0439 VPN \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e MFA [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445. \u0427\u0430\u0441\u0442\u044c 1 \u2014 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f. \u0411\u0443\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u043e \u2014 \u043f\u043e\u043b\u044c\u0437\u044b \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435. \u041f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0437\u0430\u0434\u0430\u0447\u0438 \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u043e\u0432 \u0438 RedTeam \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0448\u0442\u0430\u0442\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0417\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a VPN, RDP, Citrix \u0438 \u0442.\u0434. \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u043e\u0434\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0413\u0434\u0435-\u0442\u043e \u0448\u0442\u0430\u0442\u043d\u044b\u0439 VPN \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e MFA\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0438\u0448\u0435\u043c Reverse socks5 proxy \u043d\u0430 powershell.\u0427\u0430\u0441\u0442\u044c 1 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445. \u0427\u0430\u0441\u0442\u044c 1 \u2014 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f. \u0411\u0443\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u043e \u2014 \u043f\u043e\u043b\u044c\u0437\u044b \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435. \u041f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0437\u0430\u0434\u0430\u0447\u0438 \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u043e\u0432 \u0438 RedTeam \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0448\u0442\u0430\u0442\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0417\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a VPN, RDP, Citrix \u0438 \u0442.\u0434. \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u043e\u0434\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0413\u0434\u0435-\u0442\u043e \u0448\u0442\u0430\u0442\u043d\u044b\u0439 VPN \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e MFA\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kirjutame Reverse socks5 proksi powershellis. Osa 1 | ProHoster","description":"Jutt uurimisest ja arendamisest 3 osas. Osa 1 \u2014 uurimisosa. T\u00e4hti on palju \u2014 kasu veelgi rohkem. \u00dclesande seadmine. Pentestide ja RedTeam kampaaniate k\u00e4igus ei ole alati v\u00f5imalik kasutada tellijate standardvahendeid, nagu VPN, RDP, Citrix jne, et siseneda sisev\u00f5rku. Kohati t\u00f6\u00f6tab standardne VPN MFA kaudu","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0438\u0448\u0435\u043c Reverse socks5 proxy \u043d\u0430 powershell.\u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445. \u0427\u0430\u0441\u0442\u044c 1 \u2014 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f. \u0411\u0443\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u043e \u2014 \u043f\u043e\u043b\u044c\u0437\u044b \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435. \u041f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0437\u0430\u0434\u0430\u0447\u0438 \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u043e\u0432 \u0438 RedTeam \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0448\u0442\u0430\u0442\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0417\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a VPN, RDP, Citrix \u0438 \u0442.\u0434. \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u043e\u0434\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0413\u0434\u0435-\u0442\u043e \u0448\u0442\u0430\u0442\u043d\u044b\u0439 VPN \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e MFA","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:00+00:00","article:modified_time":"2019-10-31T19:00:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:23:33","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:32","updated":"2026-01-21 20:23:33"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=34725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/26164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=34725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=34725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=34725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}