---
description: >-
  Secure Socket Funneling - Network tool and toolkit - TCP and UDP port
  forwarding, SOCKS proxy, remote shell, standalone and cross platform.
---

# SSF

Source 1: [https://github.com/securesocketfunneling/ssf](https://github.com/securesocketfunneling/ssf)

Source 2: [https://securesocketfunneling.github.io/ssf/#home](https://securesocketfunneling.github.io/ssf/#home)



## How to extract files

Opening a server on the Attacker machine.&#x20;

* The (**-l**) is the IP of the attacker - without this flag it will listen on 0.0.0.0
* The default port (**-p**) is 8011

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FG7vx4WXrp9LFDINFP7hJ%2Fimage.png?alt=media&#x26;token=18b1d161-7512-4e77-a693-6d1827733432" alt=""><figcaption><p>Opening the server on attacker</p></figcaption></figure>

* **-D:** the _attacker (server)_ will act as the SOCKS server
* **-F:** the _target (client)_ will act as the SOCKS server

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2Fa4i4uGoxwhMz9jtppBBm%2Fimage.png?alt=media&#x26;token=772048a5-13c2-46eb-9420-c93eed0297f4" alt=""><figcaption><p>opening the client on the target</p></figcaption></figure>

* ./ssfcp can copy files through the tunnel

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FkkLu2weORJ50IQAURhsF%2Fimage.png?alt=media&#x26;token=2cf05494-7804-4e51-8f96-426f87a7f672" alt=""><figcaption><p>Copying the /etc/shadow file to the attacker</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FMWJMwfPkADecAb5S3mYL%2Fimage.png?alt=media&#x26;token=4a01d2fc-d5ac-4480-b32b-ed195c368ac0" alt=""><figcaption><p>Wireshark Results</p></figcaption></figure>

##

## Opening a shell with SSF

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FJ4c17Kunm8f6wFwDbsvH%2Fimage.png?alt=media&#x26;token=4c7311b9-8b1a-4ec3-a948-2c0912e59156" alt=""><figcaption><p>Opening a Server on attacker</p></figcaption></figure>

* **-X**: client opens a listening socket on the given port (10000)
* **-Y**: client orders the server to open a listening socket on the given port (11000)

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2F8bVV1kN1QVr1bpX3gbjI%2Fimage.png?alt=media&#x26;token=99e642cf-69b7-4279-85db-5820202a8f70" alt=""><figcaption><p>Testing the option SHELL</p></figcaption></figure>

We can use just one of the options if we want:

* The **-X** let us open a shell of the _<mark style="color:red;">attacker</mark> on the <mark style="color:blue;">target</mark>_ machine
* The **-Y** let us open a shell of the _<mark style="color:blue;">target</mark>_ on our _<mark style="color:red;">attacker</mark>_ machine



Use this options for Linux, Windows respectively to disable local echo:

```
stty -echo -icanon -isig min 1; nc 127.0.0.1 10000; stty echo icanon isig;
```

```
stty -isig; nc 127.0.0.1 10000; stty isig;
```

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FOTfrE6T7YHxLkFsPe0jd%2Fimage.png?alt=media&#x26;token=99a8b397-fae0-41a5-8bc0-87ebbf8e8e8f" alt=""><figcaption><p>because of the option -X</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FKz0G0YczVc7IBSaKEvf2%2Fimage.png?alt=media&#x26;token=1c1f251f-d917-4563-a7bb-1332e1ff124c" alt=""><figcaption><p>because of the option -Y</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FfJZHZPlSaCXR33PkAjUj%2Fimage.png?alt=media&#x26;token=c0b9b2e1-702e-4a4d-8d9e-3f6bacd513e7" alt=""><figcaption><p>All the traffic goes through the tunneling</p></figcaption></figure>

To use copy and shell options, you need to specify the config.json accordingly:

```json
{
  "ssf": {
    "arguments": "",
    "circuit": [],
    "http_proxy": {
      "host": "",
      "port": "",
      "user_agent": "",
      "credentials": {
        "username": "",
        "password": "",
        "domain": "",
        "reuse_ntlm": true,
        "reuse_nego": true
      }
    },
    "socks_proxy": {
      "version": 5,
      "host": "",
      "port": "1080"
    },
    "tls" : {
      "ca_cert_path": "./certs/trusted/ca.crt",
      "cert_path": "./certs/certificate.crt",
      "key_path": "./certs/private.key",
      "key_password": "",
      "dh_path": "./certs/dh4096.pem",
      "cipher_alg": "DHE-RSA-AES256-GCM-SHA384"
    },
    "services": {
      "datagram_forwarder": { "enable": true },
      "datagram_listener": {
        "enable": true,
        "gateway_ports": false
      },
      "stream_forwarder": { "enable": true },
      "stream_listener": {
        "enable": true,
        "gateway_ports": false
      },
      "copy": { "enable": true },
      "shell": {
        "enable": true,
        "path": "/bin/bash",
        "args": ""
      },
      "socks": { "enable": true }
    }
  }
```
