> For the complete documentation index, see [llms.txt](https://johnermac.gitbook.io/johnermac/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://johnermac.gitbook.io/johnermac/tunneling/tools/tunna.md).

# Tunna

Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments.

Source: <https://github.com/SECFORCE/Tunna>

### Prerequisites

* ```
  A vulnerable web server to upload the web shell
  ```
* ```
  Tunna now Supports Python3
  ```

## How to use

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FlcD5QIrJgzRV36I4dFih%2Fimage.png?alt=media&amp;token=85a48a8b-7d71-4185-8d97-25f14764f370" alt=""><figcaption><p>Open the webserver.py on the Target</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FUciWtYO3Y1R0q4PQTTsa%2Fimage.png?alt=media&amp;token=28175707-56af-441f-9989-869deede4761" alt=""><figcaption><p>Creating a webserver on target port 5555</p></figcaption></figure>

* **-l** = (local) - it opens a local SOCKS proxy server
* **-r** = (remote) - it redirects a port of the target to the tunnel port
* In this case I'm using the .jsp, but there is also a .php and .aspx that works the same

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FWtStZkymbDGGmxTOUKBU%2Fimage.png?alt=media&amp;token=eb921ec0-c837-479e-9352-b097571ff9b4" alt=""><figcaption><p>Accessing the webshell</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FW0KkvcM5L0iLlmyTZiFu%2Fimage.png?alt=media&amp;token=e31c3983-eb30-48b4-b0e8-74892db01f29" alt=""><figcaption><p>Show the content of the webserver via tunnel</p></figcaption></figure>

When we access the file with Curl, we can see the confirmation of the access on TunnaWebServer and in our python webserver as a demonstration

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FJzWLgFSOezCtFrma9HUk%2Fimage.png?alt=media&amp;token=eb471df7-aab9-44e5-825c-c82f77fd8d35" alt=""><figcaption><p>poc 1 </p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FGCZJUfVSFPQDox4SMpex%2Fimage.png?alt=media&amp;token=ce2a33da-353b-45b9-abd2-22d063b47472" alt=""><figcaption><p>poc 2</p></figcaption></figure>

##

## Transfer Files

We can extract files using the same method

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2F87NqVZXAzk46PIJuk3rs%2Fimage.png?alt=media&amp;token=77d6c419-7041-4924-b14f-d100438efb36" alt=""><figcaption><p>set a netcat </p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FyjJ8C9wxs2lbUOxPuZod%2Fimage.png?alt=media&amp;token=3ffec8fb-e398-4762-a157-2818cefe13b2" alt=""><figcaption><p>grab the file through the tunnel</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FcCt6ZTRlhQJAJGtVKv7V%2Fimage.png?alt=media&amp;token=a1361de6-66f6-4da8-a808-1373762c3d5a" alt=""><figcaption><p>wireshark results</p></figcaption></figure>

### The web shell is not very reliable, and we have to open ports individually