{"id":34725,"date":"2019-10-31T22:00:00","date_gmt":"2019-10-31T19:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pishem-reverse-socks5-proxy-na-powershell-chast-1\/"},"modified":"2019-10-31T22:00:00","modified_gmt":"2019-10-31T19:00:00","slug":"pishem-reverse-socks5-proxy-na-powershell-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","title":{"rendered":"Shkruajm\u00eb Reverse socks5 proxy n\u00eb PowerShell. Pjesa 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Historia e hulumtimit dhe zhvillimit n\u00eb 3 pjes\u00eb. Pjesa 1 \u2014 hulumtimi.<br \/>\nKa shum\u00eb burime \u2014 ka akoma m\u00eb shum\u00eb p\u00ebrfitime.<\/p>\n<h3>Formulimi i detyr\u00ebs<\/h3>\n<p>\nGjat\u00eb zhvillimit t\u00eb testeve t\u00eb penetrimit dhe fushatave RedTeam, shpesh nuk mund t\u00eb shfryt\u00ebzojm\u00eb mjetet standarde t\u00eb Klient\u00ebve, si VPN, RDP, Citrix etj., si nj\u00eb mjet p\u00ebr t\u00eb hyr\u00eb n\u00eb rrjetin e brendsh\u00ebm. Disa her\u00eb, VPN standardi punon me MFA dhe si faktor t\u00eb dyt\u00eb p\u00ebrdoret nj\u00eb token fizik, her\u00eb t\u00eb tjera ai monitorohet ashp\u00ebr dhe hyrja jon\u00eb p\u00ebrmes VPN menj\u00ebher\u00eb b\u00ebhet e dukshme, si\u00e7 thon\u00eb \u2014 me t\u00eb gjitha pasojat, nd\u00ebrsa her\u00eb t\u00eb tjera t\u00eb tilla mjete thjesht nuk ekzistojn\u00eb. <\/p>\n<p>N\u00eb k\u00ebto raste, na duhet t\u00eb b\u00ebjm\u00eb vazhdimisht ato q\u00eb quhen \"tunele t\u00eb kund\u00ebrt\" \u2014 lidhje nga rrjeti i brendsh\u00ebm n\u00eb nj\u00eb burim t\u00eb jasht\u00ebm ose n\u00eb nj\u00eb server t\u00eb kontrolluar nga ne. Brenda nj\u00eb tuneli t\u00eb till\u00eb, ne mund t\u00eb punojm\u00eb me burimet e brendshme t\u00eb Klient\u00ebve.<\/p>\n<p>Ekzistojn\u00eb disa lloje t\u00eb tilla tunelesh t\u00eb kund\u00ebrta. M\u00eb e njohura, natyrisht, \u00ebsht\u00eb Meterpreter. Po ashtu, tunelesh SSH me port\u00eb t\u00eb kthyer g\u00ebzojn\u00eb nj\u00eb k\u00ebrkes\u00eb t\u00eb madhe mes masave t\u00eb hacker\u00ebve. P\u00ebr t\u00eb realizuar tunnelingun e kund\u00ebrt ka shum\u00eb mjete dhe shum\u00eb prej tyre jan\u00eb studiuar mir\u00eb dhe p\u00ebrshkruar.<br \/>\nSigurisht, zhvilluesit e zgjidhjeve t\u00eb siguris\u00eb nuk q\u00ebndrojn\u00eb duar kryq dhe aktivisht detektojn\u00eb veprime t\u00eb tilla.<br \/>\nP\u00ebr shembull, seancat MSF identifikohen me sukses nga IPS moderne nga Cisco ose Positive Tech, nd\u00ebrsa tuneli SSH i kthyer mund t\u00eb identifikohet praktikisht nga \u00e7do firewall normal.<\/p>\n<p>Pra, p\u00ebr t\u00eb mbetur t\u00eb paduksh\u00ebm n\u00eb nj\u00eb fushat\u00eb t\u00eb mir\u00eb RedTeam \u2014 na nevojitet t\u00eb nd\u00ebrtojm\u00eb tunelin e kund\u00ebrt me mjete jo standarde dhe t\u00eb p\u00ebrshtatemi sa m\u00eb af\u00ebr me m\u00ebnyr\u00ebn reale t\u00eb pun\u00ebs s\u00eb rrjetit.<\/p>\n<p>Le t\u00eb provojm\u00eb t\u00eb gjejm\u00eb ose shpikim di\u00e7ka t\u00eb ngjashme.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPara se t\u00eb shpikim ndonj\u00eb gj\u00eb, duhet t\u00eb kuptojm\u00eb se cilin rezultat d\u00ebshirojm\u00eb t\u00eb arrijm\u00eb, cilat funksione duhet t\u00eb kryej\u00eb zhvillimi yn\u00eb. Cilat do t\u00eb jen\u00eb k\u00ebrkesat p\u00ebr tunelin, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb mund t\u00eb punojm\u00eb me nj\u00eb nivel maksimal fsheht\u00ebsie?<\/p>\n<p>Natyrisht, k\u00ebrkesat e tilla mund t\u00eb ndryshojn\u00eb shum\u00eb p\u00ebr \u00e7do rast, por sipas p\u00ebrvoj\u00ebs s\u00eb pun\u00ebs, mund t\u00eb dallojm\u00eb disa t\u00eb r\u00ebnd\u00ebsishme:<\/p>\n<ul>\n<li> punon n\u00eb sistemet operative Windows 7-10. Sepse n\u00eb shumic\u00ebn e rrjeteve korporative p\u00ebrdoret pik\u00ebrisht Windows;<\/li>\n<li> klienti lidhet me serverin p\u00ebrmes SSL p\u00ebr t\u00eb parandaluar d\u00ebgjimin e thjesht\u00eb nga mjetet ips;<\/li>\n<li> n\u00eb lidhjen klienti duhet t\u00eb mb\u00ebshtes\u00eb pun\u00ebn p\u00ebrmes nj\u00eb serveri proxy me autorizim, sepse n\u00eb shum\u00eb kompani dalja n\u00eb internet ndodh p\u00ebrmes proxy. N\u00eb t\u00eb v\u00ebrtet\u00eb, makina klientiale mund t\u00eb mos e dij\u00eb k\u00ebt\u00eb dhe proxy p\u00ebrdoret n\u00eb m\u00ebnyr\u00eb transparente. Por nj\u00eb funksionalitet t\u00eb till\u00eb duhet ta parashikojm\u00eb;<\/li>\n<li> pjesa klientale duhet t\u00eb jet\u00eb e lakonshme dhe e portueshme;<br \/>\nNatyrisht, p\u00ebr t\u00eb punuar brenda rrjetit t\u00eb Klientit, n\u00eb makin\u00ebn e klientit mund t\u00eb vendoset OpenVPN dhe t\u00eb krijohet nj\u00eb tunel i plot\u00eb deri n\u00eb serverin ton\u00eb (meq\u00eb klient\u00ebt openvpn din\u00eb t\u00eb punojn\u00eb p\u00ebrmes proxy). Por, nga ana tjet\u00ebr, kjo nuk do t\u00eb jet\u00eb gjithmon\u00eb e mundur, pasi mund t\u00eb mos jemi administratator\u00eb lokal\u00eb atje, dhe p\u00ebrve\u00e7 k\u00ebsaj, kjo do t\u00eb b\u00ebj\u00eb kaq shum\u00eb zhurm\u00eb saq\u00eb nj\u00eb SIEM ose HIPS t\u00eb rregullt menj\u00ebher\u00eb do t\u00eb na<\/li>\n<li> tuneli yn\u00eb duhet t\u00eb jet\u00eb shum\u00ebth\u00ebrrmues dhe t\u00eb mb\u00ebshtes\u00eb shum\u00eb lidhje nj\u00ebkoh\u00ebsisht;<\/li>\n<li> lidha klient-server duhet t\u00eb ket\u00eb ndonj\u00eb autorizim, n\u00eb m\u00ebnyr\u00eb q\u00eb tuneli t\u00eb vendoset vet\u00ebm p\u00ebr klientin ton\u00eb dhe jo p\u00ebr t\u00eb gjith\u00eb ata q\u00eb do t\u00eb vijn\u00eb te serveri yn\u00eb p\u00ebr adres\u00ebn dhe portin e caktuar. Idealisht, p\u00ebr \"p\u00ebrdoruesit e jasht\u00ebm\" duhet t\u00eb hapet nj\u00eb faqe pritjeje me mace ose me tematik\u00eb profesionale q\u00eb ka lidhje me domenin burimor.<br \/>\nP\u00ebr shembull, n\u00ebse Klienti \u00ebsht\u00eb nj\u00eb organizat\u00eb sh\u00ebndet\u00ebsore, p\u00ebr administratorin e siguris\u00eb informacionit, q\u00eb vendos t\u00eb kontrolloj\u00eb burimin, p\u00ebr t\u00eb cilin k\u00ebrkoi punonj\u00ebsi i klinik\u00ebs, duhet t\u00eb hapet nj\u00eb faqe me produkte farmaceutike, Wikipedia me p\u00ebrshkrimin e diagnoz\u00ebs ose blogu i doktorit Komarovskij, etj. <\/li>\n<\/ul>\n<p><\/p>\n<h3>Analiza e mjeteve ekzistuese<\/h3>\n<p>\nPara se t\u00eb shpikni bi\u00e7iklet\u00ebn tuaj \u2014 \u00ebsht\u00eb e nevojshme t\u00eb b\u00ebni nj\u00eb analiz\u00eb t\u00eb bi\u00e7ikletave ekzistuese dhe t\u00eb kuptoni n\u00ebse na nevojitet v\u00ebrtet dhe, ndoshta, nuk jemi vet\u00ebm ne q\u00eb mendojm\u00eb p\u00ebr nevoj\u00ebn e nj\u00eb bi\u00e7iklete funksionale t\u00eb till\u00eb.<\/p>\n<p>K\u00ebrkimi n\u00eb internet (nuk kemi b\u00ebr\u00eb shum\u00eb informacion), si dhe k\u00ebrkimi n\u00eb GitHub p\u00ebr fjal\u00ebt ky\u00e7e \u00abreverse socks\u00bb nuk dha shum\u00eb rezultate. N\u00eb thelb, gjith\u00e7ka p\u00ebrqendrohet n\u00eb nd\u00ebrtimin e tunel\u00ebve SSH me rikthim t\u00eb porteve dhe \u00e7do gj\u00eb q\u00eb lidhet me k\u00ebt\u00eb. P\u00ebrve\u00e7 tunel\u00ebve SSH, mund t\u00eb ve\u00e7ojm\u00eb disa zgjidhje:<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/klsecservices\/rpivot\">github.com\/klsecservices\/rpivot<\/a><\/noindex><\/b><br \/>\nNj\u00eb zgjidhje e vjet\u00ebr e tunelit t\u00eb rikthimit nga ekipi i Laboratoris\u00eb Kaspersky. Nga emri kuptohet p\u00ebr \u00e7far\u00eb p\u00ebrdoret ky skript. Realizuar n\u00eb Python 2.7, tuneli punon n\u00eb modalitetin cleartext (si\u00e7 \u00ebsht\u00eb b\u00ebr\u00eb tashm\u00eb e zakonshme \u2014 p\u00ebrsh\u00ebndetje RKN)<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/tonyseek\/rsocks\">github.com\/tonyseek\/rsocks<\/a><\/noindex><\/b><br \/>\nNj\u00eb implementim tjet\u00ebr n\u00eb Python, gjithashtu n\u00eb cleartext, por me m\u00eb shum\u00eb mund\u00ebsi. Shkruar si nj\u00eb modul dhe ka API p\u00ebr integrimin e zgjidhjes n\u00eb projektet tuaja.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/llkat\/rsockstun\">github.com\/llkat\/rsockstun<\/a><\/noindex><\/b><br \/>\n<b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mis-team\/rsockstun\">github.com\/mis-team\/rsockstun<\/a><\/noindex><\/b><br \/>\nLidhja e par\u00eb \u2014 versioni fillestar i implementimit t\u00eb reverse socks n\u00eb Go (nuk mb\u00ebshtetet m\u00eb nga zhvilluesi).<br \/>\nLidhja e dyt\u00eb \u2014 tashm\u00eb \u00ebsht\u00eb p\u00ebrmir\u00ebsimi yn\u00eb me karakteristika shtes\u00eb, gjithashtu n\u00eb Go. N\u00eb versionin ton\u00eb ne realizuam SSL, funksionimin p\u00ebrmes proxy me autorizim NTLM, autorizimin n\u00eb klient, nj\u00eb faqe destinacioni n\u00eb rast se fjal\u00ebkalimi \u00ebsht\u00eb i gabuar (n\u00eb fakt \u2014 ridirektoni n\u00eb faqen e destinacionit), modalitet shum\u00eb-fijor (dmth. disa persona mund t\u00eb punojn\u00eb n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb me tunelin), nj\u00eb sistem ping p\u00ebr klientin p\u00ebr t\u00eb kontrolluar n\u00ebse \u00ebsht\u00eb aktiv apo jo.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jun7th\/tsocks\">github.com\/jun7th\/tsocks<\/a><\/noindex><\/b><br \/>\nImplementimi i reverse socks nga \u00abmiqt\u00eb tan\u00eb kinez\u00eb\u00bb n\u00eb Python. Po ashtu, p\u00ebr ata q\u00eb jan\u00eb dembel\u00eb dhe \u00abt\u00eb pavdeksh\u00ebm\u00bb, ka nj\u00eb binar t\u00eb gatsh\u00ebm (exe) t\u00eb p\u00ebrfunduar nga kinez\u00ebt dhe i gatsh\u00ebm p\u00ebr p\u00ebrdorim. K\u00ebtu vet\u00ebm nj\u00eb per\u00ebndi kineze e di se \u00e7far\u00eb tjet\u00ebr mund t\u00eb ket\u00eb n\u00eb k\u00ebt\u00eb binar, p\u00ebrve\u00e7 funksionalitetit t\u00eb tij kryesor, prandaj p\u00ebrdoreni n\u00eb rrezikun tuaj.<\/p>\n<p><b><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/securesocketfunneling\/ssf\">github.com\/securesocketfunneling\/ssf<\/a><\/noindex><\/b><br \/>\nNj\u00eb projekt mjaft interesant n\u00eb C++ p\u00ebr realizimin e reverse socks dhe jo vet\u00ebm. P\u00ebrve\u00e7 tunelit t\u00eb rikthimit, ai mund t\u00eb b\u00ebj\u00eb rikthimin e porteve, krijimin e nj\u00eb shell komandash, etj.<\/p>\n<p><b>MSF meterpreter<\/b><br \/>\nK\u00ebtu si\u00e7 thot\u00eb, pa koment. T\u00eb gjith\u00eb hacker\u00ebt me arsimim t\u00eb mir\u00eb jan\u00eb t\u00eb njohur me k\u00ebt\u00eb gj\u00eb dhe kuptojn\u00eb se sa leht\u00eb mund t\u00eb zbulohet nga mjetet mbrojt\u00ebse.<\/p>\n<p>T\u00eb gjitha mjetet e p\u00ebrmendura punojn\u00eb sipas nj\u00eb teknologjie t\u00eb ngjashme: nj\u00eb modul binar i p\u00ebrgatitur m\u00eb par\u00eb ekzekutohet n\u00eb makin\u00ebn brenda rrjetit, i cili vendos nj\u00eb lidhje me nj\u00eb server t\u00eb jasht\u00ebm. N\u00eb server, aktivizohet nj\u00eb server SOCKS4\/5 q\u00eb pranon lidhjet dhe i transmeton ato te klienti.<\/p>\n<p>Nj\u00eb disavantazh i t\u00eb gjith\u00eb mjeteve t\u00eb lartp\u00ebrmendura \u00ebsht\u00eb se ose n\u00eb makin\u00ebn e klientit \u00ebsht\u00eb e nevojshme t\u00eb jet\u00eb instaluar Python ose Golang (sa shpesh keni hasur Python t\u00eb instaluar n\u00eb makinat, p\u00ebr shembull, t\u00eb drejtor\u00ebve t\u00eb kompanive ose punonj\u00ebsve t\u00eb zyr\u00ebs?), ose duhet t\u00eb t\u00ebrheqim nj\u00eb binar t\u00eb p\u00ebrgatitur m\u00eb par\u00eb n\u00eb at\u00eb makin\u00eb (praktikisht python dhe skenari n\u00eb nj\u00eb paket\u00eb) dhe ta ekzekutojm\u00eb at\u00eb atje. Nd\u00ebrkoh\u00eb, shkarkimi i nj\u00eb exe dhe ekzekutimi i tij \u00ebsht\u00eb nj\u00eb firm\u00eb e till\u00eb p\u00ebr antivirusin ose HIPS-in lokal.<\/p>\n<p>N\u00eb p\u00ebrgjith\u00ebsi, p\u00ebrfundimi duket i qart\u00eb \u2014 na nevojitet nj\u00eb zgjidhje n\u00eb powershell. Tani do t\u00eb filloj\u00eb bombardimi me domate \u2014 se powershell \u00ebsht\u00eb tashm\u00eb i tejkaluar, ai monitorohet, bllokohet etj. N\u00eb t\u00eb v\u00ebrtet\u00eb \u2014 aspak kudo. E deklarojm\u00eb me p\u00ebrgjegj\u00ebsi. P\u00ebrve\u00e7 k\u00ebsaj, ekzistojn\u00eb nj\u00eb mori m\u00ebnyrash p\u00ebr t\u00eb anashkaluar bllokimet (k\u00ebtu p\u00ebrs\u00ebri problemi mod\u00ebs p\u00ebrsh\u00ebndetje RKN \ud83d\ude42), duke filluar nga ndryshimi i emrit t\u00eb powershell.exe n\u00eb cmdd.exe dhe deri te powerdll e k\u00ebshtu me radh\u00eb.<\/p>\n<h3>T\u00eb fillojm\u00eb t\u00eb shpikim<\/h3>\n<p>\n\u00cbsht\u00eb e qart\u00eb se s\u00eb pari do t\u00eb shikojm\u00eb n\u00eb Google dhe... nuk do t\u00eb gjejm\u00eb asgj\u00eb n\u00eb lidhje me k\u00ebt\u00eb tem\u00eb (n\u00ebse dikush ka gjetur \u2014 d\u00ebrgoni lidhjet n\u00eb komentet). Ka vet\u00ebm <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/p3nt4\/Invoke-SocksProxy\">implementim<\/a><\/noindex> Socks5 n\u00eb powershell, por kjo \u00ebsht\u00eb nj\u00eb socks \"e drejtp\u00ebrdrejt\u00eb\", q\u00eb ka disa disavantazhe t\u00eb veta (p\u00ebr to do t\u00eb flasim m\u00eb von\u00eb). Sigurisht, mund ta kthejm\u00eb n\u00eb nj\u00eb t\u00eb kund\u00ebrt me nj\u00eb l\u00ebvizje t\u00eb leht\u00eb, por kjo do t\u00eb ishte vet\u00ebm nj\u00eb socks me nj\u00eb tell, q\u00eb p\u00ebr ne nuk \u00ebsht\u00eb sakt\u00ebsisht ajo q\u00eb na nevojitet.<\/p>\n<p>Pra, nuk gjet\u00ebm asgj\u00eb t\u00eb gatshme, prandaj do t\u00eb duhet t\u00eb shpikim bi\u00e7iklet\u00ebn ton\u00eb. Si baz\u00eb p\u00ebr bi\u00e7iklet\u00ebn ton\u00eb do t\u00eb marrim <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mis-team\/rsockstun\">zhvillimin ton\u00eb<\/a><\/noindex> t\u00eb socks-it t\u00eb kund\u00ebrt n\u00eb golang, nd\u00ebrsa klienti p\u00ebr t\u00eb do t\u00eb realizohet n\u00eb powershell.<\/p>\n<p><b>RSocksTun<\/b><br \/>\nPra, si funksionon rsockstun?<\/p>\n<p>N\u00eb thelb, funksionimi i RsocksTun (m\u00eb pas n\u00eb tekst \u2014 rs) bazohet n\u00eb dy komponent\u00eb softuerik\u00eb \u2014 Yamux dhe serverin Socks5. Serveri Socks5 \u00ebsht\u00eb nj\u00eb socks5 lokal i zakonsh\u00ebm, ai aktivizohet n\u00eb klient. Dhe shum\u00ebfishimi i lidhjeve me t\u00eb (mos harroni p\u00ebr multithreading?) sigurohet p\u00ebrmes yamux (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hashicorp\/yamux\/\">n\u00eb multiplexerin tjet\u00ebr<\/a><\/noindex>). Kjo skem\u00eb lejon t\u00eb niset disa server\u00eb klient\u00ebsh socks5 dhe t\u00eb shp\u00ebrndaj\u00eb lidhjet e jashtme p\u00ebr ta, duke i kaluar ato p\u00ebrmes nj\u00eb lidhjeje TCP t\u00eb vetme (gati si n\u00eb meterpreter) nga klienti n\u00eb server, duke realizuar k\u00ebshtu nj\u00eb modalitet t\u00eb shum\u00ebfisht\u00eb, pa t\u00eb cilin nuk mund t\u00eb funksionojm\u00eb plot\u00ebsisht n\u00eb rrjetin e brendsh\u00ebm.<\/p>\n<p>Thelbi i pun\u00ebs s\u00eb yamux \u00ebsht\u00eb q\u00eb ai fut nj\u00eb nivel t\u00eb ri rrjetesh t\u00eb rrjedhave, duke e realizuar at\u00eb si nj\u00eb krye 12-byte p\u00ebr secil\u00ebn paket\u00eb. (K\u00ebtu ne q\u00ebllimisht p\u00ebrdorim fjal\u00ebn \"rrjedh\u00eb\", dhe jo \"stream\", p\u00ebr t\u00eb mos ngat\u00ebrruar lexuesin me \"thread\" \u2014 k\u00ebt\u00eb koncept do ta p\u00ebrdorim gjithashtu n\u00eb k\u00ebt\u00eb artikull). Brenda krye t\u00eb yamux ndodhen numri i rrjedh\u00ebs, flamuj p\u00ebr vendosjen\/p\u00ebrfundimin e rrjedh\u00ebs, numri i byte-ve t\u00eb transmetuara, madh\u00ebsia e dritares s\u00eb transmetimit.<\/p>\n<p><img decoding=\"async\" alt=\"Shkruajm\u00eb Reverse socks5 proxy n\u00eb PowerShell. Pjesa 1\" src=\"\/wp-content\/uploads\/2019\/05\/3a1bc23bdc90176f7cd37f112a8a1a6c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebrve\u00e7 vendosjes\/p\u00ebrfundimit t\u00eb rrjedh\u00ebs, n\u00eb yamux \u00ebsht\u00eb realizuar mekanizmi i keepalive-it, i cili lejon t\u00eb monitorohet funksionimi i kanalit t\u00eb vendosur t\u00eb komunikimit. Funksionimi i mekanizmit t\u00eb mesazheve keepalive konfigurohet gjat\u00eb krijimit t\u00eb sesionit Yamux. N\u00eb fakt, nga konfigurimet atje ndodhen vet\u00ebm \u2014 dy parametra: aktivizimi\/\u00e7aktivizimi dhe periodiciteti i d\u00ebrgimit t\u00eb paketave n\u00eb sekonda. Mesazhet keepalive mund t\u00eb d\u00ebrgohen nga serveri yamux, si dhe nga klienti yamux. Kur merr nj\u00eb mesazh keepalive, pala e larg\u00ebt \u00ebsht\u00eb e detyruar t\u00eb p\u00ebrgjigjet me nj\u00eb d\u00ebrges\u00eb me t\u00eb nj\u00ebjtin identifikator mesazhi (n\u00eb fakt \u2014 numri), t\u00eb cilin ajo e pranoi. N\u00eb p\u00ebrgjith\u00ebsi, keepalive \u00ebsht\u00eb si nj\u00eb ping, vet\u00ebm p\u00ebr yamux.<\/p>\n<p>P\u00ebr detaje, e gjith\u00eb teknika e pun\u00ebs s\u00eb shum\u00ebfisht\u00eb: llojet e paketave, flamujt e vendosjes dhe p\u00ebrfundimit t\u00eb lidhjeve, mekanizmi i transmetimit t\u00eb t\u00eb dh\u00ebnave p\u00ebrshkruhet n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hashicorp\/yamux\/blob\/master\/spec.md\">specifikimet<\/a><\/noindex> n\u00eb yamux. <\/p>\n<h3>P\u00ebrfundimi i pjes\u00ebs s\u00eb par\u00eb<\/h3>\n<p>\nTani, n\u00eb pjes\u00ebn e par\u00eb t\u00eb artikullit ne u njoh\u00ebm me disa mjete p\u00ebr organizimin e tunelave t\u00eb kund\u00ebr, shikuam p\u00ebrpar\u00ebsit\u00eb dhe disavantazhet e tyre, studiuam mekanizmin e pun\u00ebs s\u00eb shum\u00ebfisht\u00eb yamux dhe p\u00ebrshkruam k\u00ebrkesat kryesore p\u00ebr modulin powershell q\u00eb po krijohet. N\u00eb pjes\u00ebn tjet\u00ebr ne do t\u00eb merremi me zhvillimin e modulit t\u00eb vet, n\u00eb m\u00ebnyr\u00eb praktikisht, nga fillimi. Vazhdimi ndodhet n\u00eb vijim. Mos u shk\u00ebputni \ud83d\ude42<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/453870\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445. \u0427\u0430\u0441\u0442\u044c 1 \u2014 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f. \u0411\u0443\u043a\u043e\u0432 \u043c\u043d\u043e\u0433\u043e \u2014 \u043f\u043e\u043b\u044c\u0437\u044b \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435. \u041f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0437\u0430\u0434\u0430\u0447\u0438 \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u043e\u0432 \u0438 RedTeam \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0448\u0442\u0430\u0442\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0417\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a VPN, RDP, Citrix \u0438 \u0442.\u0434. \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u043e\u0434\u0430 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0413\u0434\u0435-\u0442\u043e \u0448\u0442\u0430\u0442\u043d\u044b\u0439 VPN \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e MFA [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0438\u0448\u0435\u043c Reverse socks5 proxy \u043d\u0430 powershell.\u0427\u0430\u0441\u0442\u044c 1 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Shkruajm\u00eb Reverse socks5 proxy n\u00eb powershell. Pjesa 1 | ProHoster","description":"Historia e hulumtimit dhe zhvillimit n\u00eb 3 pjes\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0438\u0448\u0435\u043c Reverse socks5 proxy \u043d\u0430 powershell.\u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0431 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 3-\u0445 \u0447\u0430\u0441\u0442\u044f\u0445.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pishem-reverse-socks5-proxy-na-powershell-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:00+00:00","article:modified_time":"2019-10-31T19:00:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:23:33","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:16:32","updated":"2026-01-21 20:23:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/34725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=34725"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/34725\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/26164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=34725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=34725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=34725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}