Smuggling data – dodging firewalls with HTTPTunnel

Now, curl up with another cup of hot cocoa as Grandpa Phil tells you an RDP fairytale. We’re going to build a hypothetical situation in which we are lucky enough to have a foothold on a Linux server that’s behind a firewall. The firewall allows HTTP ports 80, 443, and 1433. You communicated with the server over its web service and discovered it is running a vulnerable Apache server. We compromised it with a PHP payload and got a shell through the firewall. Here’s your extra credit assignment – look at the following screenshot of the payload being delivered and figure out the nature of the vulnerability:

Figure 5.25 – Exploit extra credit – how we compromised our target

It’s an oldie but a goldie vulnerability. Despite its age, it’s not unusual to see it on internal networks in large organizations. But I digress – back to our compromised Linux...