Skip to content

ICMP Tunneling

  • encapsulates your traffic within ICMP packets containing echo requests and responses.
  • Use - https://github.com/utoni/ptunnel-ng

Workflow

  • Download from github
  • sudo ./autogen.sh

Another way to build the binary 

sudo apt install automake autoconf -y
cd ptunnel-ng/
sed -i '$s/.*/LDFLAGS=-static "${NEW_WD}\/configure" --enable-static $@ \&\& make clean \&\& make -j${BUILDJOBS:-4} all/' autogen.sh
./autogen.sh

Transfer ptunnel to the pivot - scp -r ptunnel-ng ubuntu@10.129.202.64:~/

Start ptunnel on the pivot - sudo ./ptunnel-ng -r10.129.202.64 -R22 - -r - accept connections on

Connect to ptunnel server from pwnbox - sudo ./ptunnel-ng -p10.129.202.64 -l2222 -r10.129.202.64 -R22 - use -l2222 for ICMP

Tunneling an SSH connection through an ICMP Tunnel - PWNBOX - ssh -p2222 -lubuntu 127.0.0.1 - If configured correctly, we will be able to enter credentials and have an SSH session all through the ICMP tunnel.

Using /usr/sbin/ptunnel

  • Transfer it to the pivot
  • On Pivot
    • sudo ./ptunnel
  • On PWNBox
    • sudo ./ptunnel -p 10.129.231.140 -lp 2222 -da 10.129.231.140 -dp 22

Dynamic Port FWDing through this tunnel

  • ssh -D 9050 -p2222 -lubuntu 127.0.0.1