Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add port reuse functionality #236

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add port reuse functionality #236

wants to merge 2 commits into from

Conversation

c3c
Copy link

@c3c c3c commented Jan 17, 2021

This pull request allows chisel to reuse ports, based on the functionality implemented in Venom. This will allow chisel to "hijack" an already bound port and start receiving chisel requests on it, forwarding legitimate requests to the hijacked service. Useful for firewall pinholes.

If port reuse is enabled, the chisel server should be bound to the external interface you would like to reuse (with the --host and --port options), while redirecting non-chisel requests to the --backend set by the user.

To explain the changes I made:

  • Added new boolean flag to chisel's server component
  • Modified the reverseProxy Director to inherit the Host header of the request in case the server we're hijacking looks at hostnames.
  • Modified the socket server handler to only look at the Sec-WebSocket-Protocol header and forcibly add the Connection/Upgrade headers. I did this to make chisel work when behind reverse proxies that are not explicitly configured for websockets (in which case the hop-by-hop headers needed for websockets are removed according to RFC 7230, section 6.1). Now that I think of it - I'm not sure if adding these headers also removes the possibly already existing header(?)
  • Use go-reuseport for the listener.

There's a few things at play to determine whether or not this will work: socket security, how sockets are implemented by the target server, which OS you're on, etc. See also the following resources that go in-depth on some of the common cases:

Example invocation (in which e.g. Apache is listening on 0.0.0.0 and has the IP address 1.2.3.4):
chisel.exe server --reuseport --backend http://127.0.0.1 --host 1.2.3.4 --port 80
This should now allow chisel clients to connect to http://1.2.3.4 as well as allow browser visits.

See also @chvancooten's tweet about this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant