[Linux] Bind Connection & Reverse Connetcion

실습> bind connection 이해하기

bind connection 은 Victim에서 포트를 열고 
Attacker가 Victim으로 접속하는 연결 방식이다.

Attacker(Kali) : 192.168.50.200
Victim(CentOS) : 192.168.50.100

  Attacker               Victim
+----------+          +----------+
|          |          |          |
|          |          |          |
|  33024 ----------------> 8000  |
|          |          |          |
|          |          |          |
+----------+          +----------+
192.168.50.200       192.168.50.100
                       iptables -F

bind connection 의 조건 : 
- Victim에 방화벽이 없어야 한다.

(방화벽이 있다면 Victim에서 포트를 열었지만 Attacker가 접속할 수 없는 상황이 된다.)

1. Victim 방화벽 해제
Victim# iptables -F

2. Victim 포트 오픈
Victim# nc -lvp 8000

3. Attacker 에서 접속
Attakcer# nc 192.168.50.100 8000

4. 포트 확인
Victim# netstat -natp | grep 8000
tcp        0      0 192.168.50.100:8000    192.168.50.200:33024   ESTABLISHED 6910/nc   

Attacker# netstat -natp | grep 8000
tcp        0      0 192.168.50.200:33024   192.168.50.100:8000    ESTABLISHED

5. data 전송/확인
Victim# nc -lvp 8000
aaa
bbb
ccc
ddd

Attacker# nc 192.168.108.108 8000
aaa
bbb
ccc
ddd
^C

6. 방화벽 활성화
victim# iptables -A INPUT -m state --state INVALID -j DROP
          iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
          iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
          iptables -A INPUT -m state --state NEW -p tcp --sport 22 -j ACCEPT
          iptables -A INPUT -i lo -j ACCEPT
          iptables -A INPUT -j DROP

victim# iptables -nL INPUT
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            0.0.0.0/0            state INVALID
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp spt:22
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0

7. Victim 포트 오픈
방화벽을 활성화된 상태에서 포트를 오픈한다.
Victim# nc -lvp 8000


다른 터미널을 열어서 아래 명령어로 확인한다.
Victim# netstat -natp | grep 8000
tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN      6953/nc   
Victim# iptables -nvL
  :
  :(생략)

8. Attacker 에서 접속
방화벽이 설정되어 있으므로 Victim으로 접속할 수 없다.
Attakcer# nc 192.168.50.100 8000
^C

---

실습> reverse connection 이해하기

reverse connection 은 Attacker에서 포트를 열고 Victime이 Attacker로 접속하는 연결 방식이다.

Attacker(Kali) : 192.168.50.200
Victim(CentOS) : 192.168.50.100

  Attacker               Victim
+----------+        | +----------+
|          |        | |          |
|          |        | |          |
|  8000  <----------|---- 46606  |
|          |        | |          |
|          |        | |          |
+----------+        | +----------+
192.168.50.200       192.168.50.100
                       iptables 활성화

reverese connection 의 조건 : 
- Victim에 방화벽이 활성화되어 있어야 한다.
(방화벽이 있다면 Victim에서 포트를 열었지만 Attacker가 접속할 수 없는 상황이 된다. 그러므로 Victim에서 Attacker쪽으로 나와야 하는 상황이다.)

1. Victim 방화벽 활성화
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -j DROP

victim# iptables -nL INPUT
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            0.0.0.0/0            state INVALID
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp spt:22
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0


2. Attacker 포트 오픈
Attacker# nc -lvp 8000

3. Victim 에서 접속
Victime# nc 192.168.50.200 8000

4. 포트 확인
Victim# netstat -natp | grep 8000
tcp        0      0 192.168.50.100:46606   192.168.50.200:8000    ESTABLISHED 7020/nc

Attacker# netstat -natp | grep 8000
tcp        0      0 192.168.50.200:8000    192.168.50.100:46606   ESTABLISHED


5. data 전송/확인
Victim# nc -lvp 8000
aaa
bbb
ccc
ddd

Attacker# nc 192.168.108.108 8000
aaa
bbb
ccc
ddd
^C