In this demonstration,
we're going to go through how to install ProxyChains4
and Tor tools that we'll use in combination
to hide our IP address
to evade detection when we're performing penetration tests.
Now, a ProxyChain is a tool that allows you
to route your Internet traffic
through multiple different proxy servers,
effectively masking your original IP address
and making it much harder for someone
to trace your online activity back to you.
Kind of like a VPN.
Tor, short for "The Onion Router," is a network
that anonymizes your Internet traffic by routing it
through multiple nodes, providing an extra layer
of privacy and security.
This is what they use on the dark web.
Now, in this demonstration, we'll start by installing
and configuring ProxyChains4 and Tor.
Once we have everything set up,
we'll show the difference in IP addresses when using
the curl command with
and without ProxyChains4, highlighting
how your traffic appears when routed through
the Tor network.
And then finally, we'll discuss how you can leverage
the setup or lateral movement within a network,
a common technique used in pen test to move stealthily
between compromised systems.
Okay, let's get started.
First thing we need to do is install ProxyChains4.
So, that's the latest version of the ProxyChains tool.
I'm going to start by using sudo apt -get install
ProxyChains4.
All right, perfect.
So, I already had mine installed,
so it ran a little quickly.
It's just mostly just update and see if they have
the latest version X, Y, and Z.
But once you run this command,
it should install fairly easily for you.
Alright, so next thing I'm going to do, we're going
to change the configuration file, right?
So this is how we're going to get all the different settings
for our ProxyChain.
So we're going to go to sudo
nano
/etc/proxychains4.config
And this is going to be standard
pretty much across all tools.
Pretty much, every tool's going to have a configuration file
in the /etc folder. Okay?
You can either have a dynamic chain or a strict chain.
Now, by default it's set to strict chain.
So we're just going to change this.
We're going to send you from strict chain to dynamic chain.
And now the difference is at the bottom you'll see a list
and it's going to be an order of proxy servers to use.
So the tool is going to let the system know, "Hey,
we're about to use a proxy server with one of these type
of tunneling protocols," right?
We're going to focus on SOCKS5 tunneling protocol.
We can configure multiple proxies to route out traffic.
For example, we can direct it to go from IP address
192.168.2.12
to another, let's say
192.168.2.13
And then have it jump
to another additional server after that.
So that's strict chain. That means it will go in that order.
And if it's not able to accomplish that particular order,
just say, one of the servers are down, or slow to respond,
or timeout, it's going to fail the whole proxy, right?
So it's a little bit more stringent, could be more secure.
Dynamic means we're going to go down the list.
If one fails, we're going to skip over
and go to the next. Okay?
You're going to see this list down here
at the bottom. Alright?
I have a local net input in my configuration file,
that's only if you're trying to connect to a device
that's on your local area network,
because if not, it's not going to be able
to connect using ProxyChains
'cause it's trying to escape first
and then hit your local area network.
So if you're trying to connect to a local host
on your network using proxy4 chains,
it's kind of irrelevant because it's not going to actually
anonymize your IP address.
It's going to do a direct connection.
All right.
Now here at the bottom, this what I was talking about
as far as the strict chain and the proxy list.
So it's going to go through
and try all these different type of proxies.
If you want it to be in strict order. If dynamic,
just say the HTP proxy fails, it's going to skip over this
and go to SOCKS4.
But if it's strict, if it fails, it's going
to completely stop.
So it's going to let you know, "hey, we're not able
to perform the ProxyChain option."
All right, so here we need to input this information here.
Yours is probably going to say SOCKS4, right?
But mine's going to say SOCKS5.
So we need is to say SOCKS5, that's the latest protocol.
And then we're going to input
127.0.0.1 9050
Okay? So that's going to be for our device.
That's what this loop back IP address is for.
And it's going to be on port 9050.
So again, make sure you have this input into your
configuration list at the bottom
SOCKS5 127.0.0.1
port 9050
So then we're going to exit this.
So control + X, push yes.
Alright, great.
So now we have our ProxyChains4 configured properly.
Next we need to install Tor.
Now Tor is going to be something
that we use on the dark web, right?
The onion network, that's how they anonymize their self.
Pretty much you're bouncing from server to server.
So we need to have that server running.
If you don't have it, do sudo apt
Alright.
Okay. Same thing.
Fairly simple, similar to the ProxyChain install,
apt get is used
for pretty much all these different software packages.
All right, so once it's installed, we're going to do sudo,
system control start tor.
Alright, so then we can use that same command
or similar command.
Let me just do the status of it,
make sure it's up and running.
Okay, so we see it's active,
so we see it's up and running.
So it has a little log here,
let us know that it's properly started.
Alright, so next let's see
what our IP address is currently without using proxy4chains
in the Tor network.
Okay? So we're going to use curl.
It's going to be a simple curl command,
and ifconfig.me,
this is going to let us know what our IP address is.
Perfect. So our public IP address
is 104.53.93.169
So this is what the Internet sees us as.
Now let's use the proxiys4chain tool
and then we're going to run this command, right?
So ProxyChains4 curl
ifconfig.me
Alright, bam.
So we see now that our public IP has changed,
so 77.48.28.193
So it's not just changing the actual IP address.
That's going to be the outer layer of the IPs that any type
of router or logging tool sees.
Our real IP address is here, but it's going to be hidden
and it's going to be going through loop after loop,
bouncing at the server after the server
that's already pre-configured with the Tor network.
So it might be hundreds, maybe even thousands
of IP addresses that we're bouncing through.
And this is going to be the final one that someone sees.
So if someone needs to identify our actual public
IP address, it's going to take them a long time
'cause they need to reverse engineer all the different
servers that we went through.
To sum things up, we discussed what a ProxyChain is
and how to use the ProxyChain4 tool in combination
with Tor to anonymize our IP address,
making it more difficult for blue teams
and security monitoring tools
to trace our original point of origin.
Now this method is often used in conjunction
and with SSH to add a layer of encryption when communicating
with our compromised device,
further reducing the chances of detection.
I hope you enjoyed this demonstration
and I'll see you in the next one.