{"id":34725,"date":"2019-10-31T22:00:00","date_gmt":"2019-10-31T19:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pishem-reverse-socks5-proxy-na-powershell-chast-1\/"},"modified":"2019-10-31T22:00:00","modified_gmt":"2019-10-31T19:00:00","slug":"pishem-reverse-socks5-proxy-na-powershell-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","title":{"rendered":"Rakst\u0101m Reverse socks5 proxy uz PowerShell. 1. da\u013ca","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>St\u0101sts par izp\u0113ti un att\u012bst\u012bbu 3 da\u013c\u0101s. 1. da\u013ca \u2014 izp\u0113tes.<br \/>\nBurtu ir daudz \u2014 labuma v\u0113l vair\u0101k.<\/p>\n<h3>Uzdevuma formul\u0113\u0161ana<\/h3>\n<p>\nVeicot pentesta un RedTeam kampa\u0146as, ne vienm\u0113r ir iesp\u0113jams izmantot klientu standarta resursus, piem\u0113ram, VPN, RDP, Citrix utt., k\u0101 piek\u013cuvi iek\u0161\u0113jai t\u012bklam. Da\u017eos gad\u012bjumos standarta VPN darbojas ar MFA, un k\u0101 otro faktoru tiek izmantots aparat\u016bras tokens, citos tiek veikta stingra uzraudz\u012bba, un m\u016bsu piek\u013cuves m\u0113\u0123in\u0101jums uz VPN uzreiz k\u013c\u016bst redzams, k\u0101 saka \u2014 ar vis\u0101m sek\u0101m, bet da\u017eviet \u0161\u0101du l\u012bdzek\u013cu vienk\u0101r\u0161i nav. <\/p>\n<p>T\u0101d\u0101s situ\u0101cij\u0101s nep\u0101rtraukti n\u0101kas veidot t\u0101 sauktos \"atpaka\u013ct\u016bne\u013cus\" \u2014 savienojumus no iek\u0161\u0113j\u0101 t\u012bkla uz \u0101r\u0113jiem resursiem vai serveriem, kurus kontrol\u0113jam m\u0113s. \u0160\u0101 t\u016bra iek\u0161ien\u0113 m\u0113s jau varam str\u0101d\u0101t ar klientu iek\u0161\u0113jiem resursiem.<\/p>\n<p>Past\u0101v vair\u0101kas \u0161\u0101du atpaka\u013ctune\u013cu vari\u0101cijas. Vispaz\u012bstam\u0101kais no tiem, protams, ir Meterpreter. T\u0101pat liela piepras\u012bjuma d\u0113\u013c hakeru vid\u016b ir SSH tune\u013ci ar atpaka\u013cv\u0113rstu portu p\u0101rs\u016bt\u012b\u0161anu. R\u012bku, lai veiktu atpaka\u013ctune\u013co\u0161anu, ir daudz, un daudzi no tiem ir labi izp\u0113t\u012bti un aprakst\u012bti.<br \/>\nProtams, sav\u0101 pus\u0113 aizsardz\u012bbas risin\u0101jumu izstr\u0101d\u0101t\u0101ji nenov\u0113r\u0161 uzman\u012bbu un akt\u012bvi atkl\u0101j \u0161\u0101das darb\u012bbas.<br \/>\nPiem\u0113ram, MSF sesijas veiksm\u012bgi atkl\u0101j m\u016bsdienu IPS no Cisco vai Positive Tech, bet atpaka\u013c SSH tune\u013ca detekt\u0113\u0161ana ir iesp\u0113jama praktiski ar jebkuru norm\u0101lu ugunsm\u016bri.<\/p>\n<p>T\u0101d\u0113j\u0101di, lai paliktu nepaman\u012btiem lab\u0101 RedTeam kampa\u0146\u0101 \u2014 mums ir nepiecie\u0161ams b\u016bv\u0113t atpaka\u013ctune\u013cus ar nestandarta r\u012bkiem un maksim\u0101li piel\u0101goties re\u0101lajai t\u012bkla darb\u012bbai.<\/p>\n<p>M\u0113\u0123in\u0101sim atrast vai izdom\u0101t ko l\u012bdz\u012bgu.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPirms kaut ko izdom\u0101jam, mums j\u0101izprot, k\u0101da rezult\u0101ta m\u0113s v\u0113lamies sasniegt, k\u0101das funkcijas j\u0101veic m\u016bsu izstr\u0101dei. K\u0101di b\u016bs pras\u012bbas tunelim, lai m\u0113s var\u0113tu darboties maksim\u0101l\u0101 slepen\u012bb\u0101?<\/p>\n<p>Ir skaidrs, ka katram gad\u012bjumam \u0161\u0101das pras\u012bbas var at\u0161\u0137irties, bet p\u0113c darba pieredzes var izdal\u012bt galven\u0101s:<\/p>\n<ul>\n<li> darbs uz Windows-7-10 oper\u0113t\u0101jsist\u0113mas. Jo liel\u0101kaj\u0101 da\u013c\u0101 korporat\u012bvo t\u012bklu tiek izmantota tie\u0161i Windows;<\/li>\n<li> Klients izveido savienojumu ar serveri, izmantojot SSL, lai nov\u0113rstu datu noklaus\u012b\u0161anos ar ips pal\u012bdz\u012bbu;<\/li>\n<li> Savienojuma izveidei klientam j\u0101turpina darbs caur autoriz\u0113tu starpserveri, jo daudzas komp\u0101nijas piek\u013c\u016bst internetam caur proxy. Paties\u012bb\u0101 klienta ma\u0161\u012bna par to var neko nezin\u0101t, bet proxy darbojas caur caursp\u012bd\u012bgu re\u017e\u012bmu. Tom\u0113r \u0161\u0101dai funkcionalit\u0101tei mums j\u0101b\u016bt iek\u013cautai;<\/li>\n<li> Klienta da\u013cai j\u0101b\u016bt lakoniskai un p\u0101rn\u0113s\u0101jamai;<br \/>\nAc\u012bmredzot, lai str\u0101d\u0101tu iek\u0161\u0113j\u0101 klienta t\u012bkl\u0101, klienta ma\u0161\u012bn\u0101 var instal\u0113t OpenVPN un izveidot pilnv\u0113rt\u012bgu tuneli uz savu serveri (priec\u0101jamies, ka OpenVPN klienti sp\u0113j darboties caur proxy). Bet, pirmk\u0101rt, tas ne vienm\u0113r izdosies, jo m\u0113s varam neb\u016bt viet\u0113jie administratori, un, otrk\u0101rt, tas rad\u012bs tik daudz troksni, ka k\u0101rt\u012bgs SIEM vai HIPS nekav\u0113joties par to zi\u0146os. Ide\u0101li, m\u016bsu klientam j\u0101b\u016bt t\u0101 sauktajai inline komandai, k\u0101 to \u012bsteno daudzi bash shell; tam j\u0101b\u016bt iesp\u0113jami izpild\u0101mam caur komandrindu, piem\u0113ram, izpildot komandas no Word makro.<\/li>\n<li> M\u016bsu tunelim j\u0101b\u016bt daudzpl\u016bsmam un j\u0101atbalsta vair\u0101ku savienojumu izveide vienlaic\u012bgi;<\/li>\n<li> Savienojumam starp klientu un serveri j\u0101ietver k\u0101da veida autoriz\u0101cija, lai tunelis tiktu izveidots tikai m\u016bsu klientam, nevis visiem, kas piek\u013c\u016bs m\u016bsu serverim nor\u0101d\u012btaj\u0101 adres\u0113 un port\u0101. Ide\u0101l\u0101 gad\u012bjum\u0101 \"tre\u0161\u0101m person\u0101m\" j\u0101atver m\u0113r\u0137lapas ar ka\u0137\u012b\u0161iem vai profesion\u0101lu tematiku, kas saist\u012bta ar izcelsmes dom\u0113nu.<br \/>\nPiem\u0113ram, ja pas\u016bt\u012bt\u0101js ir medic\u012bnas organiz\u0101cija, tad inform\u0101cijas dro\u0161\u012bbas administratoram, kur\u0161 v\u0113l\u0113j\u0101s p\u0101rbaud\u012bt resursu, uz kuru saist\u012bj\u0101s kl\u012bnikas darbinieks, j\u0101atver lapa ar farmaceitiskiem prec\u0113m, Wikipedia ar diagnozes aprakstu vai Dr. Komarovska blogs u.t.t. <\/li>\n<\/ul>\n<p><\/p>\n<h3>Eso\u0161o r\u012bku anal\u012bze<\/h3>\n<p>\nPirms izgudrot savu velosip\u0113du \u2014 j\u0101veic eso\u0161o velosip\u0113du anal\u012bze un j\u0101saprot, vai mums to patie\u0161\u0101m vajag, jo iesp\u0113jams, ka ne tikai m\u0113s esam dom\u0101ju\u0161i par \u0161\u0101du funkcion\u0101lu velosip\u0113du.<\/p>\n<p>Mekl\u0113jot internet\u0101 (m\u0113s ac\u012bmredzot mekl\u0113jam norm\u0101li), k\u0101 ar\u012b mekl\u0113jot GitHub\u0101 ar atsl\u0113gv\u0101rdiem \u201ereverse socks\u201d, netika atrasti daudzi rezult\u0101ti. Liel\u0101koties viss ir saist\u012bts ar SSH tunel\u0113\u0161anu ar reverso portu p\u0101rs\u016bt\u012b\u0161anu un visu, kas ar to saist\u012bts. Papildus SSH tunel\u0113m var izcelt vair\u0101kas risin\u0101jumu iesp\u0113jas:<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/klsecservices\/rpivot\">github.com\/klsecservices\/rpivot<\/a><\/noindex><\/b><br \/>\nVecais revers\u0101 tunel\u0113\u0161anas risin\u0101jums no Kaspersky laboratorijas pui\u0161iem. No nosaukuma skaidri redzams, kam paredz\u0113ts \u0161is skripts. Realiz\u0113ts Python 2.7, tunelis darbojas cleartext re\u017e\u012bm\u0101 (k\u0101 tagad mod\u0113 saka \u2013 sveiki, RKN)<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/tonyseek\/rsocks\">github.com\/tonyseek\/rsocks<\/a><\/noindex><\/b><br \/>\nV\u0113l viena realiz\u0101cija Python\u0101, ar\u012b cleartext, bet ar vair\u0101k iesp\u0113j\u0101m. Uzrakst\u012bts k\u0101 modulis un ir API, lai integr\u0113tu risin\u0101jumu savos projektos.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/llkat\/rsockstun\">github.com\/llkat\/rsockstun<\/a><\/noindex><\/b><br \/>\n<b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mis-team\/rsockstun\">github.com\/mis-team\/rsockstun<\/a><\/noindex><\/b><br \/>\nPirmais saite \u2013 s\u0101kotn\u0113j\u0101 versija revers\u0101 socka realiz\u0101cijai golang\u0101 (to neatbalsta izstr\u0101d\u0101t\u0101js).<br \/>\nOtrais saite \u2013 jau m\u016bsu izstr\u0101d\u0101jums ar papildu funkcij\u0101m, ar\u012b golang\u0101. M\u016bsu versij\u0101 m\u0113s realiz\u0113j\u0101m SSL, darbu caur proksi ar NTLM autoriz\u0101ciju, autoriz\u0101ciju klient\u0101, nos\u016bt\u012b\u0161anas lapu nepareiza parole gad\u012bjum\u0101 (prec\u012bz\u0101k \u2013 p\u0101radres\u0101cija uz nos\u016bt\u012b\u0161anas lapu), daudzuzdevumu re\u017e\u012bmu (t.i., ar tuneli var str\u0101d\u0101t vair\u0101ki cilv\u0113ki vienlaikus), klienta ping sist\u0113mu, lai p\u0101rbaud\u012btu \u2013 vai tas ir dz\u012bvs vai nav.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jun7th\/tsocks\">github.com\/jun7th\/tsocks<\/a><\/noindex><\/b><br \/>\nRevers\u0101 socka realiz\u0101cija no m\u016bsu \u201e\u0137\u012bnie\u0161u draugiem\u201d Python\u0101. Turpat tiem, kas ir slinki un \u201eneievainojami\u201d, ir jau gatavs bin\u0101rais fails (exe), ko sagatavoju\u0161i \u0137\u012bnie\u0161i un ko var izmantot. \u0160aj\u0101 fail\u0101 tikai \u0136\u012bnas dievs zina, kas var\u0113tu b\u016bt v\u0113l kl\u0101t, iz\u0146emot pamata funkcionalit\u0101ti, t\u0101p\u0113c izmantojiet to uz savu risku.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/securesocketfunneling\/ssf\">github.com\/securesocketfunneling\/ssf<\/a><\/noindex><\/b><br \/>\nPietiekami interesants projekts C++ revers\u0101 socka realiz\u0101cijai un ne tikai. Papildus reversajam tunelim tas var veikt portu p\u0101rs\u016bt\u012b\u0161anu, komandu \u0161ell izveidi utt.<\/p>\n<p><b>MSF meterpreter<\/b><br \/>\n\u0160eit, k\u0101 saka, bez koment\u0101riem. Visi kaut cik izgl\u012btoti hakeri lieliski paz\u012bst \u0161o lietu un saprot, cik viegli to atkl\u0101j dro\u0161\u012bbas l\u012bdzek\u013ci.<\/p>\n<p>Visi iepriek\u0161min\u0113tie r\u012bki darbojas l\u012bdz\u012bg\u0101 tehnolo\u0123ij\u0101: iek\u0161\u0113j\u0101 t\u012bkla ma\u0161\u012bn\u0101 tiek palaists iepriek\u0161 sagatavots izpild\u0101ms bin\u0101rais modulis, kas izveido savienojumu ar \u0101r\u0113jo serveri. Server\u012b tiek palaists SOCKS4\/5 serveris, kas pie\u0146em savienojumus un tos p\u0101rs\u016bta uz klientu.<\/p>\n<p>Visu iepriek\u0161 uzskait\u012bto r\u012bku tr\u016bkums ir tas, ka vai nu klienta ma\u0161\u012bn\u0101 ir j\u0101b\u016bt instal\u0113tam Python vai Golang (cik bie\u017ei j\u016bs esat sastapu\u0161i uzst\u0101d\u012btu Python uz uz\u0146\u0113muma direktora vai biroja darbinieku datoriem?), vai nu uz \u0161o datoru j\u0101nes iepriek\u0161 sagatavots bin\u0101rs (faktiski python un skripts vien\u0101 flakon\u0101) un j\u0101palai\u017e \u0161is bin\u0101rs tur. Un .exe fails ar sekojo\u0161u palai\u0161anu \u2014 tas ir v\u0113l viens paraugs viet\u0113j\u0101 antiv\u012brusa vai HIPS.<\/p>\n<p>Kopum\u0101 secin\u0101jums ir ac\u012bmredzams \u2014 mums ir vajadz\u012bgs risin\u0101jums uz PowerShell. Tagad m\u016bs apm\u0113t\u0101s ar tom\u0101tiem \u2014 jo PowerShell ir jau viss novecojis, to uzrauga, blo\u0137\u0113 utt. Paties\u012bb\u0101 \u2014 tas ne visur t\u0101 ir. Atbild\u012bgi pazi\u0146ojam. Starp citu, past\u0101v daudz veidu, k\u0101 apiet blok\u0101des (atkal mode fr\u0101ze par sveicienu RKN \ud83d\ude42), s\u0101kot no primit\u012bvas p\u0101rd\u0113v\u0113\u0161anas powershell.exe -&gt; cmdd.exe un beidzot ar powerdll utt.<\/p>\n<h3>S\u0101kam izdom\u0101t<\/h3>\n<p>\nSaprotams, ka vispirms m\u0113s mekl\u0113sim Google un... neatrad\u012bsim absol\u016bti neko \u0161aj\u0101 t\u0113m\u0101 (ja k\u0101ds ir atradis \u2014 l\u016bdzu, dalieties ar saites koment\u0101ros). Ir tikai <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/p3nt4\/Invoke-SocksProxy\">realiz\u0101cija<\/a><\/noindex> Socks5 uz PowerShell, bet tas ir parasts \u201etie\u0161ais\u201d socks, kam ir vair\u0101kas ierobe\u017eojumus (par tiem run\u0101sim v\u0113l\u0101k). Protams, ir iesp\u0113jams viegli p\u0101rv\u0113rst to atpaka\u013c, bet tas b\u016bs tikai vienu pavedienu socks, kas mums nav glu\u017ei tas, kas nepiecie\u0161ams.<\/p>\n<p>T\u0101tad, m\u0113s neatrad\u0101m neko gatavu, t\u0101p\u0113c mums tom\u0113r b\u016bs j\u0101izdom\u0101 sava velosip\u0113ds. M\u016bsu velosip\u0113da pamats b\u016bs <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mis-team\/rsockstun\">m\u016bsu izstr\u0101de<\/a><\/noindex> atpaka\u013cejo\u0161ais socks uz golang, un klientu realiz\u0113sim uz PowerShell.<\/p>\n<p><b>RSocksTun<\/b><br \/>\nT\u0101tad, k\u0101d\u0101 veid\u0101 darbojas rsockstun?<\/p>\n<p>RSocksTun pamats (turpm\u0101k tekst\u0101 \u2014 rs) ir divi programmat\u016bras komponenti \u2014 Yamux un Socks5 serveris. Socks5 serveris ir parasts lok\u0101lais socks5, tas tiek palaists uz klienta. Savienojumu multiplik\u0101cija uz to (vai atceraties par daudzthreads?) tiek nodro\u0161in\u0101ta ar yamux (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hashicorp\/yamux\/\">v\u0113l viens multiplexer<\/a><\/noindex>). \u0160\u0101da sh\u0113ma \u013cauj palaist vair\u0101kus klienta socks5 serverus un izplat\u012bt \u0101r\u0113j\u0101s savienojumus uz tiem, p\u0101rs\u016btot tos caur vienu TCP savienojumu (gandr\u012bz k\u0101 meterpreter) no klienta uz serveri, t\u0101d\u0113j\u0101di \u012bstenojot daudzpl\u016bsmu re\u017e\u012bmu, bez kura m\u0113s vienk\u0101r\u0161i nevar\u0113sim piln\u012bb\u0101 str\u0101d\u0101t iek\u0161\u0113j\u0101 t\u012bkl\u0101.<\/p>\n<p>Yamux darb\u012bbas b\u016bt\u012bba ir t\u0101da, ka tas ievie\u0161 papildu t\u012bkla pl\u016bsmu l\u012bmeni, realiz\u0113jot to k\u0101 12 baitus lielu virsrakstu katram paket\u0113. (\u0160eit m\u0113s apzin\u0101ti izmantojam v\u0101rdu \u00abpl\u016bsma\u00bb, nevis \u00abpl\u016bst\u00bb, lai nesajauktu las\u012bt\u0101ju ar programmatisko pl\u016bsmu \u00abthread\u00bb \u2014 \u0161o j\u0113dzienu m\u0113s t\u0101pat izmantosim \u0161aj\u0101 rakst\u0101). Yamux virsrakst\u0101 ir iek\u013cauts pl\u016bsmas numurs, karogi pl\u016bsmas uzst\u0101d\u012b\u0161anai\/izbeig\u0161anai, p\u0101rvedamo baitus skaits, p\u0101rs\u016bt\u012b\u0161anas loga lielums.<\/p>\n<p><img decoding=\"async\" alt=\"Rakst\u0101m Reverse socks5 proxy uz PowerShell. 1. da\u013ca\" src=\"\/wp-content\/uploads\/2019\/05\/3a1bc23bdc90176f7cd37f112a8a1a6c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPapildus pl\u016bsmas uzst\u0101d\u012b\u0161anai\/izbeig\u0161anai yamux ir realiz\u0113ts keepalive meh\u0101nisms, kas \u013cauj uzraudz\u012bt izveidot\u0101 sakaru kan\u0101la atbilst\u012bbu. Keepalive zi\u0146ojumu darb\u012bba tiek konfigur\u0113ta Yamux sesijas izveid\u0113. Paties\u012bb\u0101 no iestat\u012bjumiem tur ir tikai \u2014 divi parametri: enable\/disable un paketu nos\u016bt\u012b\u0161anas bie\u017eums sekund\u0113s. Keepalive zi\u0146ojumus var nos\u016bt\u012bt gan yamux serveris, gan yamux klients. Sa\u0146emot keepalive zi\u0146ojumu, att\u0101lajai pusei j\u0101atbild ar tie\u0161i t\u0101da pa\u0161a identit\u0101tes numura (faktiski \u2014 skait\u013ca) s\u016bt\u012b\u0161anu, kuru t\u0101 sa\u0146\u0113ma. Kopum\u0101, keepalive \u2014 tas pats ping, tikai yamux.<\/p>\n<p>Detaliz\u0113ta inform\u0101cija par multiplexora darb\u012bbu: paketes veidi, savienojumu uzst\u0101d\u012b\u0161anas un izbeig\u0161anas karogi, datu p\u0101rs\u016bt\u012b\u0161anas meh\u0101nisms ir aprakst\u012bta <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hashicorp\/yamux\/blob\/master\/spec.md\">specifik\u0101ciju<\/a><\/noindex> k yamux. <\/p>\n<h3>Secin\u0101jums pirmajai da\u013cai<\/h3>\n<p>\nT\u0101tad, pirmaj\u0101 raksta da\u013c\u0101 m\u0113s iepazin\u0101mies ar da\u017eiem instrumentiem, k\u0101 organiz\u0113t atgriezeniskos tunelus, apskat\u012bj\u0101m to priek\u0161roc\u012bbas un tr\u016bkumus, izp\u0113t\u012bj\u0101m Yamux multiplexora darb\u012bbas meh\u0101nismu un aprakst\u012bj\u0101m pamata pras\u012bbas jaunizveidotajam PowerShell modulim. N\u0101kamaj\u0101 da\u013c\u0101 m\u0113s nodosimies pa\u0161a modu\u013ca izstr\u0101dei, faktiski, no nulles. Turpin\u0101jums sekos. Nepalaidiet gar\u0101m \ud83d\ude42<br \/>\n<br \/>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/453870\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445. \u0427\u0430\u0441\u0442\u044c 1 \u2014 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f. \u0411\u0443\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u043e \u2014 \u043f\u043e\u043b\u044c\u0437\u044b \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435. \u041f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0437\u0430\u0434\u0430\u0447\u0438 \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u043e\u0432 \u0438 RedTeam \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0448\u0442\u0430\u0442\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0417\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a VPN, RDP, Citrix \u0438 \u0442.\u0434. \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u043e\u0434\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0413\u0434\u0435-\u0442\u043e \u0448\u0442\u0430\u0442\u043d\u044b\u0439 VPN \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e MFA [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0438\u0448\u0435\u043c Reverse socks5 proxy \u043d\u0430 powershell.\u0427\u0430\u0441\u0442\u044c 1 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rakst\u0101m Reverse socks5 proxy uz PowerShell. Da\u013ca 1 | ProHoster","description":"St\u0101sts par izp\u0113ti un izstr\u0101di 3 da\u013c\u0101s.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0438\u0448\u0435\u043c Reverse socks5 proxy \u043d\u0430 powershell.\u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:00+00:00","article:modified_time":"2019-10-31T19:00:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:23:33","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:32","updated":"2026-01-21 20:23:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/34725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=34725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/34725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/26164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=34725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=34725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=34725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}