SocialNets! let's connect networks

Have you ever found yourself in a situation where you can't connect to your company VPN and want to do some quick tests on hosts lying inside the VPN? Or want to connect to machines in VPN via your mobile phone while travelling?

Let's think what is hurdle here?

• We can't reach these hosts from outside even if they are listening

 

Solution

• These hosts can connect to internet
  
• Create a mediator to which these hosts connect and listen for commands.

 

Sub-problems in this solution

• Create a mediator in the internet? 
• Should we buy a public IP?
• What about authentication of the users?
  

 

Solution

• We don't need to buy a IP when messaging services exist in the internet. Let's consider such a system, "Facebook"
• Facebook allows developers to create test user accounts which are disposable.
  
• Facebook also messaging service which allows exchange of messages between these users and no real facebook user can send messages to these users.
• What about Authentication?
• Let facebook do it for you. 
• We can run some custom Facebook client on the hosts inside the VPN and let them execute the tasks sent to it as a text message.
  

 

Enough, show me a demo

• For this example's purpose we need two Facebook test users, let's call them F1 and F2. You have to login to facebook using these user credentials and make them friends.
  
• To create a custom Facebook client, we will use the fbchat python library. To install it using pip run the below command   

pip install fbchat

• Here is the python code which will execute the messages sent to it as a command, create a file called novpn.py and add the below content. Replace the user, passwd, recvFrom values in this file.
  

• Run the code in a host which is accessible in VPN

 python novpn.py

• Login to facebook using the credentials of user F2 and send messages to F1. They will be run as bash commands and output will be sent right back to you.

 

Demo

 

Limitations

1. Large messages are not supported (I haven't tested the max limit, comment it if you get to know about it) 
2. There will be a delay between message transfers
3. Interactive applications are not supported (vim, nano, more, less etc)
   

 

Improvements

1. We can write a custom client, to address the above mentioned limitations using the same fbchat APIs.

 

-madhusoodan

VPN fishing

Recently I encountered an interesting scenario where a link I clicked on a link in an email local to our VPN opened a public website. Link was similar to

        swarm/changes/674362

Now, I was expecting some diff of files described in the mail but I found completely different stuff and I checked whether I am connected to the VPN or not. As you might expect, I was not. Some time later I thought we can use this to trick people to get their credentials for swarm. If you got the credentials, and if they are same as the NT credentials, (... think of the bad things you can do on your own)

A simpler explanation with Alice and Bob

1. Alice (A bad girl) has set up a public website with DNS name "xyz" which mimicks a site in VPN which both Alice and Bob can access (It's not mandatory that, Alice should have access to it)

2. Alice sends an email to Bob which contains a protected url as below

            xyz/foo/bar

3. Here it is assumed that, xyz is a site available in VPN as well as on the internet.

4. If Bob is connected to VPN and opens the URL, he will hit the local (present in the VPN) site and things will go well

5. If Bob is not connected to VPN he will connect to the public website (URL in the address bar will still be same) and he will enters his credentials to access /foo/bar and will be compromised.

How can one protect themselves?

   - Orgs can WARN their employees when they visit public sites (or block these sites) whose DNS names match the local site DNS names.