{"id":53317,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3-chast-2"},"modified":"2020-02-18T14:01:12","modified_gmt":"2020-02-18T11:01:12","slug":"domen-fronting-na-baze-tls-1-3-chast-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","title":{"rendered":"Domen-fronting bazuar n\u00eb TLS 1.3. Pjesa 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hyrje<\/h3>\n

\nN\u00eb pjes\u00ebn e par\u00eb artikulli<\/a><\/noindex> ne dham\u00eb nj\u00eb p\u00ebrshkrim t\u00eb shkurt\u00ebr t\u00eb mekanizmit t\u00eb SNI t\u00eb enkriptuar (eSNI). T\u00eb treguam se si mbi t\u00eb mund t\u00eb shmangim zbulimin nga sistemet moderne t\u00eb DPI (me shembuj si DPI i Beeline dhe ruxhja e ndaluar RKN), si dhe k\u00ebrkuam nj\u00eb variant t\u00eb ri t\u00eb domen-fronit q\u00eb bazohet n\u00eb k\u00ebt\u00eb mekaniz\u00ebm.<\/p>\n

N\u00eb pjes\u00ebn e dyt\u00eb t\u00eb artikullit do t\u00eb kalojm\u00eb n\u00eb aspekte m\u00eb praktike, t\u00eb cilat do t\u00eb jen\u00eb t\u00eb dobishme p\u00ebr specialist\u00ebt e RedTeam n\u00eb pun\u00ebn e tyre t\u00eb nd\u00ebrlikuar. M\u00eb n\u00eb fund, q\u00ebllimi yn\u00eb nuk \u00ebsht\u00eb t\u00eb marrim akses n\u00eb burimet e bllokuara (p\u00ebr k\u00ebto gj\u00ebra ka VPN-in e mir\u00eb t\u00eb vjet\u00ebr). Ka shum\u00eb ofrues VPN, si\u00e7 thuhet, p\u00ebr \u00e7do shije, ngjyr\u00eb dhe buxhet.<\/p>\n

Ne do t\u00eb p\u00ebrpiqemi t\u00eb aplikojm\u00eb mekanizmin e domen-fronting p\u00ebr mjetet moderne t\u00eb RedTeam, si\u00e7 jan\u00eb Cobalt Strike, Empire etj., dhe t'u japim atyre mund\u00ebsi t\u00eb shtes\u00eb p\u00ebr mimikrim dhe shmangie nga sistemet moderne t\u00eb filtrimit t\u00eb p\u00ebrmbajtjes.
\n<\/a><\/noindex>
\nHer\u00ebn e fundit implementuam mekanizmin e eSNI n\u00eb bibliotek\u00ebn OpenSSL dhe e p\u00ebrdor\u00ebm me sukses n\u00eb utilitarin e njohur p\u00ebr t\u00eb gjith\u00eb curl. Por vet\u00ebm me curl, si\u00e7 thon\u00eb, nuk ngopesh. Sigurisht, do t\u00eb d\u00ebshironim t\u00eb realizonim di\u00e7ka t\u00eb ngjashme n\u00eb gjuh\u00ebt e nivelit t\u00eb lart\u00eb. Por, fatkeq\u00ebsisht, nj\u00eb k\u00ebrkim i shpejt\u00eb n\u00eb hap\u00ebsir\u00ebn e internetit na b\u00ebn t\u00eb zhg\u00ebnjehemi, sepse mb\u00ebshtetje t\u00eb plote p\u00ebr mekanizmin e eSNI \u00ebsht\u00eb realizuar vet\u00ebm n\u00eb GOLANG. K\u00ebshtu, zgjedhja jon\u00eb nuk \u00ebsht\u00eb shum\u00eb e madhe: ose shkruajm\u00eb n\u00eb C t\u00eb past\u00ebr ose C++ duke p\u00ebrdorur bibliotek\u00ebn e p\u00ebrmir\u00ebsuar OpenSSL, ose p\u00ebrdorim nj\u00eb fork t\u00eb ve\u00e7ant\u00eb t\u00eb GOLANG nga CloudFlare dhe p\u00ebrpiqemi ta portojm\u00eb mjetin ton\u00eb atje. N\u00eb parim, ka edhe nj\u00eb mund\u00ebsi tjet\u00ebr, m\u00eb klasike, por nj\u00ebkoh\u00ebsisht e lodhshme \u2013 t\u00eb implementojm\u00eb mb\u00ebshtetje p\u00ebr eSNI p\u00ebr Python. M\u00eb n\u00eb fund, Python gjithashtu p\u00ebrdor OpenSSL p\u00ebr t\u00eb punuar me https. Por k\u00ebt\u00eb mund\u00ebsi do ta l\u00ebm\u00eb p\u00ebr t'u zhvilluar nga dikush tjet\u00ebr, nd\u00ebrsa ne do t\u00eb jemi t\u00eb k\u00ebnaqur me realizimin n\u00eb GOLANG, sidomos q\u00eb Cobalt Strike yn\u00eb i preferuar e di mir\u00eb se si t\u00eb punoj\u00eb me nj\u00eb kanal komunikimi t\u00eb nd\u00ebrtuar nga mjete t\u00eb jashtme (kanali External C2) \u2013 p\u00ebr k\u00ebt\u00eb do t\u00eb flasim n\u00eb fund t\u00eb artikullit.<\/p>\n

Try Harder\u2026<\/h3>\n

\nNj\u00eb nga mjetet e realizuara n\u00eb Go \u2013 zhvillimi yn\u00eb p\u00ebr pivoting brenda rrjetit \u2013 tuneluesi rsockstun<\/a><\/noindex>, i cili, p\u00ebr t'iu referuar, aktualisht detektohet nga mjetet e kompanive Microsoft dhe Symantec si nj\u00eb software shum\u00eb i d\u00ebmsh\u00ebm, i orientuar drejt shkeljes s\u00eb stabilitetit global\u2026<\/p>\n

\"Domen-fronting
\n
\nDo t\u00eb ishte e shk\u00eblqyer t\u00eb p\u00ebrdornim zhvillimin e m\u00ebparsh\u00ebm edhe n\u00eb k\u00ebt\u00eb rast. Por k\u00ebtu lind nj\u00eb problem i vog\u00ebl. Problemi \u00ebsht\u00eb se fillimisht rsockstun parashikon p\u00ebrdorimin e nj\u00eb kanali t\u00eb zakonsh\u00ebm SSL p\u00ebr lidhjen me serverin. Kjo do t\u00eb thot\u00eb se lidhja krijohet nj\u00eb her\u00eb dhe ekziston gjat\u00eb gjith\u00eb koh\u00ebs s\u00eb funksionimit t\u00eb tunelit. Dhe, si\u00e7 e kuptoni, protokolli https paksa nuk \u00ebsht\u00eb i dizajnuar p\u00ebr k\u00ebt\u00eb mod p\u00ebrdorimi \u2013 ai punon n\u00eb modin k\u00ebrkes\u00eb- p\u00ebrgjigje, ku \u00e7do k\u00ebrkes\u00eb e re http ekziston brenda kuadrit t\u00eb nj\u00eb lidhjeje t\u00eb re tcp.<\/p>\n

Defekti kryesor i k\u00ebtij skeme \u00ebsht\u00eb se serveri nuk mund t\u00eb transmetoj\u00eb t\u00eb dh\u00ebna klientit, derisa klienti t\u00eb d\u00ebrgoj\u00eb nj\u00eb k\u00ebrkes\u00eb t\u00eb re http. Megjithat\u00eb, p\u00ebr fat t\u00eb mir\u00eb, ekzistojn\u00eb shum\u00eb opsione p\u00ebr zgjidhjen e k\u00ebtij problemi \u2013 transmetimi i t\u00eb dh\u00ebnave n\u00ebp\u00ebrmjet protokollit http (mjer\u00eb q\u00eb arrijm\u00eb si\u00e7 e b\u00ebjm\u00eb t\u00eb shikojm\u00eb serialet tona t\u00eb preferuara dhe t\u00eb d\u00ebgjojm\u00eb muzik\u00eb nga portalet q\u00eb punojn\u00eb n\u00eb https, dhe transmetimi i videos dhe audios \u2013 nuk \u00ebsht\u00eb asgj\u00eb tjet\u00ebr p\u00ebrve\u00e7 transmetimit t\u00eb t\u00eb dh\u00ebnave). Nj\u00eb nga teknologjit\u00eb p\u00ebr t\u00eb emuluar funksionimin e nj\u00eb lidhjeje t\u00eb plot\u00eb tcp mbi protokollin http \u00ebsht\u00eb teknologjia e web-socket-\u00ebve (WebSockets), thelbi i s\u00eb cil\u00ebs \u00ebsht\u00eb organizimi i nj\u00eb lidhjeje t\u00eb plot\u00eb n\u00eb rrjet midis klientit dhe serverit web.<\/p>\n

P\u00ebr fatin ton\u00eb (hurra-hurra!!!), kjo teknologji \u00ebsht\u00eb e p\u00ebrfshir\u00eb si\u00e7 duhet n\u00eb t\u00eb gjitha planet tarifore t\u00eb CloudFlare dhe funksionon shk\u00eblqyer s\u00eb bashku me eSNI. Pik\u00ebrisht k\u00ebt\u00eb do ta p\u00ebrdorim p\u00ebr t\u00eb m\u00ebsuar tuneluesin ton\u00eb t\u00eb p\u00ebrdor\u00eb domenin e p\u00ebrparsh\u00ebm dhe t\u00eb fshihet nga DPI-t\u00eb moderne. <\/p>\n

Pak p\u00ebr WebSockets<\/h3>\n

\nS\u00eb pari, do t\u00eb flasim shkurtimisht dhe me fjal\u00eb t\u00eb thjeshta p\u00ebr web-socket-et, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb gjith\u00eb t\u00eb ken\u00eb nj\u00eb ide p\u00ebr at\u00eb me \u00e7far\u00eb do t\u00eb punojm\u00eb. <\/p>\n

Teknologjia e web-socket-\u00ebve lejon kalimin p\u00ebrkoh\u00ebsisht nga lidhja http n\u00eb transmetim standard t\u00eb t\u00eb dh\u00ebnave p\u00ebrmes nj\u00eb socket-i rrjeti, pa ndar\u00eb lidhjen tcp t\u00eb krijuar. Kur klienti d\u00ebshiron t\u00eb kaloj\u00eb n\u00eb web-socket, ai n\u00eb k\u00ebrkes\u00ebn e tij http vendos disa headers http. Dy headers t\u00eb detyruesh\u00ebm jan\u00eb Connection: Upgrade<\/b><\/i> dhe Upgrade: websocket<\/b><\/i>. Ai gjithashtu mund t\u00eb tregoj\u00eb me forc\u00eb versionin e protokollit websocket (Sec-Websockset-Version: 13<\/b><\/i>) dhe di\u00e7ka si identifikuesi base64 i web-socket (Sec-WebSocket-Key: DAGDJSiREI3+KjDfwxm1FA==<\/b><\/i>). Serveri p\u00ebrgjigjet me kodi http 101 Switching Protocols dhe gjithashtu vendos header\u00ebt Connection, Upgrade<\/b><\/i> dhe Sec-WebSocket-Accept<\/b><\/i>. Procesi i kalimit \u00ebsht\u00eb ilustruar n\u00eb screenshotin m\u00eb posht\u00eb:<\/p>\n

\"Domen-fronting
\n
\nPas k\u00ebsaj, vendosja e lidhjes WebSocket mund t\u00eb konsiderohet e p\u00ebrfunduar. \u00c7do t\u00eb dh\u00ebn\u00eb, si nga klienti ashtu edhe nga serveri, tani do t\u00eb d\u00ebrgohet me header\u00eb t\u00eb WebSocket (fillojn\u00eb me bajtin 0x82). Tani serveri nuk ka nevoj\u00eb t\u00eb pres\u00eb nj\u00eb k\u00ebrkes\u00eb nga klienti p\u00ebr t\u00eb d\u00ebrguar t\u00eb dh\u00ebna, pasi lidhja tcp nuk nd\u00ebrpritet.<\/p>\n

N\u00eb Golang, ka disa biblioteka p\u00ebr pun\u00ebn me web-sockets. M\u00eb t\u00eb njohurat jan\u00eb Gorilla WebSocket<\/a><\/noindex> dhe standardi WebSocket<\/a><\/noindex>. Ne do t\u00eb p\u00ebrdorim t\u00eb fundit, pasi \u00ebsht\u00eb m\u00eb e thjesht\u00eb, m\u00eb e vog\u00ebl dhe funksionon, si\u00e7 thuhet, pak m\u00eb shpejt.<\/p>\n

N\u00eb kodin e klientit rsockstun, ne duhet t\u00eb z\u00ebvend\u00ebsojm\u00eb thirrjet net.dial ose tls.dial me thirrjet p\u00ebrkat\u00ebse t\u00eb WebSocket:<\/p>\n

\"Domen-fronting
\n
\n\"Domen-fronting
\n
\nNe duam t\u00eb b\u00ebjm\u00eb pjes\u00ebn klient t\u00eb tunelit ton\u00eb universale dhe t\u00eb aft\u00eb t\u00eb funksionoj\u00eb si p\u00ebrmes nj\u00eb lidhjeje t\u00eb drejtp\u00ebrdrejt\u00eb ssl, ashtu edhe p\u00ebrmes protokollit WebSocket. P\u00ebr k\u00ebt\u00eb, ne do t\u00eb krijojm\u00eb nj\u00eb funksion t\u00eb ve\u00e7ant\u00eb func connectForWsSocks(address string, proxy string) error {\u2026}<\/b><\/i> me analogji me connectForSocks()<\/b><\/i> dhe do ta p\u00ebrdorim at\u00eb p\u00ebr t\u00eb punuar me web-sockets n\u00eb rast se adresa e serverit, e cila \u00ebsht\u00eb caktuar gjat\u00eb fillimit t\u00eb klientit, fillon me ws: ose wss: (n\u00eb rastin e WebSocket-it t\u00eb Sigurt).<\/p>\n

P\u00ebr pjes\u00ebn server t\u00eb tunelit, ne gjithashtu do t\u00eb krijojm\u00eb nj\u00eb funksion t\u00eb ve\u00e7ant\u00eb p\u00ebr pun\u00ebn me web-sockets. N\u00eb t\u00eb, do t\u00eb krijohet nj\u00eb instanc\u00eb e klas\u00ebs http dhe do t'i caktohet nj\u00eb trajtues i lidhjes http (funksioni wsHandler): <\/p>\n

\"Domen-fronting
\n
\nDhe t\u00eb gjitha logjikat e trajtimit t\u00eb lidhjes (autorizimi i klientit me fjal\u00ebkalim, vendosja dhe p\u00ebrfundimi i sesionit yamux) do t'i vendosim te trajtuesi i lidhjes WebSocket:<\/p>\n

\"Domen-fronting
\n
\nKompilojm\u00eb projektin, fillojm\u00eb pjes\u00ebn server:<\/p>\n

.\\\/rsockstun \u2013listen ws:127.0.0.1:8080 \u2013pass P@ssw0rd<\/code><\/pre>\n
\nDhe pastaj pjes\u00ebn klient:<\/p>\n
.\\\/rsockstun -connect ws:127.0.0.1:8080 \u2013pass P@ssw0rd<\/code><\/pre>\n
\nDhe verifikojm\u00eb funksionimin n\u00eb hostin lokal:<\/p>\n
\"Domen-fronting
\n
\n\"Domen-fronting
\n<\/p>\n
Kalo n\u00eb domain-fronting<\/h3>\n
\nMe web-sockets duket se e kemi kuptuar situat\u00ebn. Tani le t\u00eb kalojm\u00eb drejtp\u00ebrdrejt n\u00eb eSNI dhe domain-fronting. Si\u00e7 u tha m\u00eb par\u00eb, p\u00ebr t\u00eb punuar me DoH dhe eSNI, na nevojitet nj\u00eb deg\u00eb speciale golang nga kompania CloudFlare<\/a><\/noindex>. Na nevojitet nj\u00eb deg\u00eb me mb\u00ebshtetje eSNI (pwu\/esni).<\/p>\n
Klonojm\u00eb at\u00eb lokalisht ose e shkarkojm\u00eb dhe e \u00e7zipojm\u00eb zip-in p\u00ebrkat\u00ebs:<\/p>\n
git clone -b pwu\/esni https:\/\/github.com\/cloudflare\/tls-tris.git<\/code><\/pre>\n
\nPastaj duhet t\u00eb kopjojm\u00eb katalogun GOROOT, t\u00eb z\u00ebvend\u00ebsojm\u00eb skedar\u00ebt p\u00ebrkat\u00ebs nga dega e klonuar dhe ta vendosim at\u00eb si kryesor. P\u00ebr t\u00eb shp\u00ebtuar zhvilluesin nga kjo dhimbje koke, ekipi n\u00eb CloudFlare ka p\u00ebrgatitur nj\u00eb skenar t\u00eb ve\u00e7ant\u00eb \u2013 _dev\/go.sh. Thjesht e aktivizojm\u00eb at\u00eb. Skripti, s\u00eb bashku me makefile, do t\u00eb b\u00ebj\u00eb gjith\u00e7ka vet\u00eb. P\u00ebr kuriozitet, mund t\u00eb shikoni brenda makefile p\u00ebr detaje.<\/p>\n
Pas p\u00ebrfundimit t\u00eb skriptit, gjat\u00eb kompilimit t\u00eb projektit, na nevojitet t\u00eb specifikojm\u00eb katalogun lokal si GOROOT, i p\u00ebrgatitur nga skripti. N\u00eb rastin ton\u00eb, kjo duket k\u00ebshtu:<\/p>\n
GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" go build ....<\/code><\/pre>\n
\nM\u00eb pas, na nevojitet t\u00eb zbatojm\u00eb n\u00eb tunelimin e funksionalitetit p\u00ebr k\u00ebrkimin dhe analizimin e \u00e7el\u00ebsave publik\u00eb eSNI p\u00ebr domenin e nevojsh\u00ebm. N\u00eb rastin ton\u00eb, k\u00ebta do t\u00eb jen\u00eb \u00e7el\u00ebsat publik\u00eb eSNI nga server\u00ebt frontend t\u00eb CloudFlare. P\u00ebr k\u00ebt\u00eb, do t\u00eb krijojm\u00eb tre funksione:<\/p>\n
func makeDoTQuery(dnsName string) ([]byte, error)\nfunc parseTXTResponse(buf []byte, wantName string) (string, error)\nfunc QueryESNIKeysForHost(hostname string) ([]byte, error)<\/code><\/pre>\n
\nEmrat e funksioneve, n\u00eb parim, e thon\u00eb vet\u00eb. P\u00ebrmbajtja do ta marrim nga skedari esni_query.go, q\u00eb \u00ebsht\u00eb pjes\u00eb e tls-tris. Funksioni i par\u00eb krijon nj\u00eb paket\u00eb rrjeti me nj\u00eb k\u00ebrkes\u00eb p\u00ebr serverin DNS t\u00eb CloudFlare, duke p\u00ebrdorur protokollin DoH (DNS-over-HTTPS), i dyti \u2013 analizojn\u00eb rezultatet e k\u00ebrkes\u00ebs dhe marrin vlerat e \u00e7el\u00ebsave publik\u00eb t\u00eb domenit, nd\u00ebrsa i treti \u00ebsht\u00eb nj\u00eb kontejner p\u00ebr t\u00eb par\u00ebt dy.<\/p>\n
M\u00eb pas, ne e shtojm\u00eb n\u00eb funksionin ton\u00eb t\u00eb sapo krijuar lidhjen e web-socket-it connectForWsSocks<\/b><\/i> funksionalitetin p\u00ebr k\u00ebrkimin e \u00e7el\u00ebsave eSNI p\u00ebr domenin. Atje ku funksionon pjesa server, vendosim parametrat TLS, si dhe caktuam emrin e domenit t\u00eb rrem\u00eb:<\/p>\n
\"Domen-fronting
\n
\nK\u00ebtu duhet t\u00eb theksohet se fillimisht, dega tls-tris nuk \u00ebsht\u00eb projektuar p\u00ebr p\u00ebrdorimin e domenit t\u00eb maskuar. Prandaj, nuk i \u00ebsht\u00eb kushtuar v\u00ebmendje emrit t\u00eb rrem\u00eb t\u00eb serverit (n\u00eb paket\u00ebn client-hello, transmetohet nj\u00eb fush\u00eb e zbraz\u00ebt serverName). P\u00ebr ta korrigjuar k\u00ebt\u00eb, na nevojitet t\u00eb shtojm\u00eb n\u00eb struktur\u00ebn TlsConfig fush\u00ebn e duhur FakeServerName. Nuk mund ta p\u00ebrdorim fush\u00ebn standarde ServerName t\u00eb struktur\u00ebs, pasi e p\u00ebrdorin mekanizmat e brendsh\u00ebm tls dhe n\u00ebse ajo ndryshon nga origjinali, at\u00ebher\u00eb tls-handshake do t\u00eb p\u00ebrfundoj\u00eb me nj\u00eb gabim. P\u00ebrshkrimi i struktur\u00ebs TlsConfig ndodhet n\u00eb skedarin tls\/common.go<\/b> \u2013 dhe at\u00eb do ta kemi p\u00ebr t\u00eb korrigjuar:<\/p>\n
\"Domen-fronting
\n
\n\"Domen-fronting
\n
\nShtes\u00eb, na nevojitet t\u00eb b\u00ebjm\u00eb ndryshime n\u00eb skedarin tls\/handshake_client.go<\/b>, p\u00ebr t\u00eb p\u00ebrdorur fush\u00ebn ton\u00eb FakeServerName gjat\u00eb formimit t\u00eb TLS handshakes:<\/p>\n
\"Domen-fronting
\n
\nK\u00ebtu p\u00ebrfundon! Tani mund t\u00eb kompilohet projekti dhe t\u00eb kontrollohet funksionaliteti. Por para se t\u00eb filloni kontrollet, \u00ebsht\u00eb e nevojshme t\u00eb konfiguroni llogarin\u00eb CloudFlare. Si t\u00eb thuash ta konfiguroni \u2013 vet\u00ebm krijoni nj\u00eb llogari n\u00eb CloudFlare dhe lidheni domenin tuaj me t\u00eb. T\u00eb gjitha ve\u00e7orit\u00eb lidhur me DoH, WebSocket dhe ESNI jan\u00eb t\u00eb aktivizuara n\u00eb CloudFlare si parazgjedhje. Pas p\u00ebrdit\u00ebsimit t\u00eb rekordeve DNS \u2013 mund t\u00eb kontrolloni funksionimin e domenit duke b\u00ebr\u00eb nj\u00eb k\u00ebrkes\u00eb p\u00ebr \u00e7el\u00ebsat e eSNI:<\/p>\n
dig +short txt _esni.df13tester.info <\/code><\/pre>\n
\n\"Domen-fronting
\n
\nN\u00ebse shihni di\u00e7ka t\u00eb ngjashme p\u00ebr domenin tuaj \u2013 at\u00ebher\u00eb gjith\u00e7ka funksionon dhe mund t\u00eb kaloni n\u00eb testim.<\/p>\n
Nisim nj\u00eb Ubuntu VPS, p\u00ebr shembull, n\u00eb DigitalOcean. P.S. N\u00eb rastin ton\u00eb, adresa IP e ofruar nga provider-i p\u00ebr VPS ishte n\u00eb listat e zeza t\u00eb RKN. Pra, mos u habitni n\u00ebse ndodh di\u00e7ka e ngjashme me ju. Duhej t\u00eb p\u00ebrdorim nj\u00eb VPN p\u00ebr t\u00eb aksesuar VPS-n\u00eb ton\u00eb.<\/p>\n
Kopjojm\u00eb n\u00eb VPS rsockstun t\u00eb kompiliuar m\u00eb par\u00eb (n\u00eb k\u00ebt\u00eb, ndonj\u00ebher\u00eb, \u00ebsht\u00eb nj\u00eb tjet\u00ebr k\u00ebnaq\u00ebsi e Golang \u2013 mund t\u00eb kompilohet projekti tuaj dhe ta ekzekutoni n\u00eb \u00e7do Linux, p\u00ebr sa koh\u00eb q\u00eb p\u00ebrmbushni vet\u00ebm arkitektur\u00ebn e sistemit) dhe nisim pjes\u00ebn server:<\/p>\n
\"Domen-fronting
\n
\nDhe pastaj pjes\u00ebn klient:<\/p>\n
\"Domen-fronting
\n
\nSi\u00e7 e shohim, klienti u lidh me sukses me serverin p\u00ebrmes serverit frontend t\u00eb CloudFlare duke p\u00ebrdorur websockets. P\u00ebr t\u00eb kontrolluar n\u00ebse tuneli funksionon si nj\u00eb tunel, mund t\u00eb b\u00ebni nj\u00eb k\u00ebrkes\u00eb curl p\u00ebrmes socks5 lokal, t\u00eb hapur n\u00eb server:<\/p>\n
\"Domen-fronting
\n
\nTani le t\u00eb shohim se \u00e7far\u00eb sheh DPI n\u00eb kanal:<\/p>\n
\"Domen-fronting
\n
\nS\u00eb pari, tuneluesi, duke p\u00ebrdorur mekanizmin DoH, i drejtohet serverit DNS t\u00eb Cloudflare p\u00ebr \u00e7el\u00ebsat e eSNI p\u00ebr domenin e destinacionit (paketat #1-19), dhe pastaj i drejtohet serverit frontend dhe krijon nj\u00eb lidhje TLS, duke u mbuluar me domenin www.google.com<\/a><\/noindex> (kjo \u00ebsht\u00eb vlera parazgjedhje, kur klienti niset pa p\u00ebrcaktuar nj\u00eb domen fals). P\u00ebr t\u00eb caktuar domenin tuaj fals, duhen p\u00ebrdorur parametra -fronfDomain:<\/p>\n
\"Domen-fronting
\n
\n\"Domen-fronting
\n
\nTani nj\u00eb pik\u00eb tjet\u00ebr. Sipas parazgjedhjes, n\u00eb cil\u00ebsimet e llogaris\u00eb n\u00eb CloudFlare \u00ebsht\u00eb vendosur regjimi Flexible SSL. Kjo do t\u00eb thot\u00eb se k\u00ebrkesat https nga klient\u00ebt ndaj server\u00ebve frontend t\u00eb Cloudflare do t\u00eb redirektohen n\u00eb m\u00ebnyr\u00eb t\u00eb pa enkriptuar (http) tek serveri yn\u00eb. Pik\u00ebrisht p\u00ebr k\u00ebt\u00eb shkak, ne e nis\u00ebm pjes\u00ebn server t\u00eb tuneluesit n\u00eb modin non-ssl (-listen ws:0.0.0.0), dhe jo (-listen wss:0.0.0.0).<\/p>\n
\"Domen-fronting
\n
\nP\u00ebr t\u00eb kaluar n\u00eb regjimin e enkriptimit t\u00eb plot\u00eb, \u00ebsht\u00eb e nevojshme t\u00eb zgjidhni Full<\/b>, ose Full (strict)<\/b> n\u00eb rast se ka nj\u00eb certifikat\u00eb t\u00eb v\u00ebrtet\u00eb n\u00eb server. Pasi t\u00eb kalojm\u00eb n\u00eb modalitet tjet\u00ebr, do t\u00eb jemi n\u00eb gjendje t\u00eb pranojm\u00eb lidhje nga CloudFlare p\u00ebrmes protokollit https. Mos harroni t\u00eb gjeneroni nj\u00eb certifikat\u00eb self-signed p\u00ebr pjes\u00ebn server t\u00eb tunelit.<\/p>\n
\"Domen-fronting
\n
\nNj\u00eb lexues i kujdessh\u00ebm do t\u00eb pyes\u00eb: \"Si q\u00ebndron puna me klientin p\u00ebr Windows? Sigurisht, aplikimi kryesor i tunelit \u00ebsht\u00eb ngushtimi i nj\u00eb lidhjeje mbrapa nga makinat dhe server\u00ebt korporat\u00eb, dhe aty zakonisht \u00ebsht\u00eb gjithmon\u00eb Windows. Si ta kompiloje tunelin p\u00ebr Windows, duke e pasur parasysh struktur\u00ebn specifike t\u00eb TLS?\" Tani do t\u00eb paraqesim nj\u00eb tjet\u00ebr ve\u00e7ori q\u00eb tregon sa e leht\u00eb \u00ebsht\u00eb Go. Kompilohet p\u00ebr Windows direkt nga Kali, thjesht duke shtuar parametrin GOOS=windows:<\/p>\n
GOARCH=amd64 GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" GOOS=windows  go build -ldflags=\"-s -w\"<\/code><\/pre>\n
\nOse varianti 32-bit:<\/p>\n
GOARCH=386 GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" GOOS=windows  go build -ldflags=\"-s -w\"<\/code><\/pre>\n
\nKaq! Dhe asnj\u00eb problem tjet\u00ebr nuk nevojitet. Kjo do t\u00eb thot\u00eb se funksionon! <\/p>\n
\"Domen-fronting
\n
\nFlamujt e kompilatorit \u2013w dhe \u2013s jan\u00eb t\u00eb nevojshme p\u00ebr t\u00eb hequr mbetje t\u00eb panevojshme nga skedari ekzekutiv, duke e b\u00ebr\u00eb at\u00eb m\u00eb t\u00eb vog\u00ebl p\u00ebr disa megabajt. S\u00eb fundi, mund t\u00eb paketoni gjithashtu me ndihm\u00ebn e UPX p\u00ebr t\u00eb zvog\u00ebluar akoma m\u00eb shum\u00eb madh\u00ebsin\u00eb.<\/p>\n
N\u00eb p\u00ebrfundim<\/h3>\n
\nN\u00eb k\u00ebt\u00eb artikull, ne, p\u00ebrmes shembullit t\u00eb tunelit t\u00eb shkruar n\u00eb Go, demonstruam aplikimin e teknologjis\u00eb s\u00eb re t\u00eb domain-fronting, e realizuar n\u00eb nj\u00eb ve\u00e7ori mjaft interesante t\u00eb protokollit TLS 1.3. N\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme, mund t\u00eb adaptohet mjetet ekzistues t\u00eb shkruara n\u00eb Go p\u00ebr t\u00eb punuar p\u00ebrmes server\u00ebve CloudFlare, p\u00ebr shembull, Merlin<\/a><\/noindex> \u2014 nj\u00eb C2 i njohur, ose t\u00eb detyroj\u00eb CobaltStrike Beacon t\u00eb p\u00ebrdor\u00eb domain-fronting eSNI kur punon me Teamserver p\u00ebrmes Kanali C2 t\u00eb Jasht\u00ebm<\/a><\/noindex>, i realizuar n\u00eb Go, ose n\u00eb standardin C++ duke p\u00ebrdorur versionin e patchuar t\u00eb OpenSSL, p\u00ebr t\u00eb cilin fol\u00ebm n\u00eb pjes\u00ebn e kaluar t\u00eb artikullit. N\u00eb p\u00ebrgjith\u00ebsi, imagjinata nuk ka limite.<\/p>\n
Shembulli me tunelin dhe CloudFlare \u00ebsht\u00eb i paraqitur si nj\u00eb koncept dhe deri tani \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb flasim p\u00ebr perspektivat e tilla n\u00eb t\u00eb ardhmen. N\u00eb k\u00ebt\u00eb moment, mb\u00ebshtetja e eSNI \u00ebsht\u00eb realizuar vet\u00ebm nga CloudFlare dhe, n\u00eb parim, asgj\u00eb nuk i pengon ata t\u00eb \u00e7aktivizojn\u00eb k\u00ebt\u00eb lloj fronti dhe, p\u00ebr shembull, t\u00eb nd\u00ebrpresin lidhjet tls n\u00eb rast t\u00eb mos p\u00ebrputhjes midis SNI dhe eSNI. N\u00eb p\u00ebrgjith\u00ebsi, e ardhmja do ta tregoj\u00eb. Por p\u00ebr momentin, perspektiva e pun\u00ebs n\u00ebn \"mbrojtjen e kremlin.ru\" duket mjaft josh\u00ebse. A nuk \u00ebsht\u00eb k\u00ebshtu?<\/p>\n
Kodi i azhurnuar i tunnelerit, si dhe skedar\u00ebt ekzekutiv\u00eb exe t\u00eb kompiluara jan\u00eb vendosur n\u00eb nj\u00eb deg\u00eb t\u00eb ve\u00e7ant\u00eb t\u00eb projektit n\u00eb github<\/a><\/noindex>. P\u00ebr \u00e7do problem t\u00eb mundsh\u00ebm me tunnelerin, m\u00eb mir\u00eb t\u00eb shkruani nj\u00eb problem n\u00eb faqen e projektit n\u00eb GitHub.
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043c\u044b \u0434\u0430\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 encrypted SNI (eSNI). \u041f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043d\u0430 \u0435\u0433\u043e \u043e\u0441\u043d\u043e\u0432\u0435 \u043c\u043e\u0436\u043d\u043e \u0443\u043a\u043b\u043e\u043d\u044f\u0442\u044c\u0441\u044f \u043e\u0442 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438 DPI-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 (\u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0431\u0438\u043b\u0430\u0439\u043d\u043e\u0432\u0441\u043a\u043e\u0433\u043e DPI \u0438 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0420\u041a\u041d \u0440\u0443\u0442\u0440\u0435\u043a\u0435\u0440\u0430), \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0434\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430. \u0412\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0432\u0435\u0449\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53317","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Frontimi i domenit mbi baz\u00ebn e TLS 1.3. Pjesa 2 | ProHoster","description":"Hyrje N\u00eb pjes\u00ebn e par\u00eb t\u00eb artikullit kemi dh\u00ebn\u00eb nj\u00eb p\u00ebrshkrim t\u00eb shkurt\u00ebr t\u00eb mekanizmit t\u00eb encrypted SNI (eSNI).","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3. \u0427\u0430\u0441\u0442\u044c 2 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043c\u044b \u0434\u0430\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 encrypted SNI (eSNI).","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53317","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=53317"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53317\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=53317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=53317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=53317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}