Firewall Evasion

From: Brian Aberle (5Loaves@UnitedBusinessTechnologies.com)
Date: 06/21/02 

From: "Brian Aberle" <5Loaves@UnitedBusinessTechnologies.com>
Date: Fri, 21 Jun 2002 09:15:02 GMT

If machine "A" behind a firewall runs software that imitates a browser,
that request may pass through the firewall just like any HTTP GET.

The HTTP GET from Machine "A" passes through (port 80) the
firewall to a junction/switchboard called machine "B".

Machine "B" operates like any HTTP server except that rather than
serving data from a file/script/cgi-bin, it serves data from another
connection.

This other connection comes from machine "C", now joined to "A"
in a pass-through proxy at machine "B"

So the flow is this: Machine "C" tells Machine "B" that it wants
to connect to a 'named connection', and specifies a unique name.
Machine "B" waits for another machine to come and request
a connection with the matching name, completing the proxy when found.

How about Remote Admin, File Transfer, or Telnet sessions through
this clever mechanism..........

The solutiuon works in Linux, UNIX, or Windows.

Full Description:
http://www.ub2b.com/FiveLoaves.html

Download Source and Windows/Linux Binaries:
http://www.ub2b.com/download/5LoavesSrcBin.zip

Relevant Pages

  • Re: RPC over HTTPs - newbie question part 2
    ... connection and connects normally without needing to use RPC over HTTPS. ... I'm wondering why it works when I'm behind the firewall and not when I'm ... The server must also be in the Global Catalog Role in order for RPC ... using RPC over HTTP. ...
    (microsoft.public.exchange.setup)
  • Re: downloading a single file using multiple threads
    ... See, for example, the "Range" field in HTTP. ... whether it was possible to request a file fragment via HTTP or FTP. ... "How do you indicate what chunk of the file you want when say using FTP? ... per connection makes no sense, having multiple threads requesting chunks over 2 connections makes little sense IMO either, unless you have measured the real benefits. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: check the presence of a reverse proxy
    ... | redirected by the proxy to the webserver. ... | firewall, from a subnet connected to internal ... You can try crafted HTTP Request. ... Connection closed by foreign host. ...
    (Pen-Test)
  • Re: HTTPhandlers
    ... When I try to have the> TcpListener listen on port 80 I get this error stating that port is already> in use or something. ... > Some request get redirected and others are left to any other process that> wants them like IIS or some other web server. ... >> The link you provided does not explain how to hold a connection open over HTTP - unless the answers to the query do, but this requires a subscription which I'm not prepared to pay. ... Is there any other way for me to be able to see the technique that keeps an HTTP based connection active over a long period? ...
    (microsoft.public.dotnet.framework)
  • Re: Firewall Evasion
    ... > that request may pass through the firewall just like any HTTP GET. ... > to connect to a 'named connection', ...
    (comp.security.firewalls)