# Port Forwarding va Firewall Bypass ## Bu darsda nima qilamiz? Pentest paytida ko'pincha maqsad to'g'ridan-to'g'ri emas, balki boshqa server orqali yetib boriladi. Bu darsda port forwarding nima ekanini, TCP proxy qanday yozilishini, va SOCKS5 qanday ishlashini ko'ramiz. Barcha kod Go'da — real pentest stsenariylariga asoslangan. ## Port forwarding nima? **Port forwarding** — bir xostning portidagi trafikni boshqa xost va portga yo'naltirish. Klassik pentest stsenariysi: ```mermaid flowchart LR A["Pentest kompyuter\n203.0.113.10"] -->|"Firewall bloklaydi"| C A -->|"SSH kirish mumkin"| B["Web server\n192.168.1.100\nKompromiss qilingan"] B -->|"Ichki tarmoqqa kirishi bor"| C["Database\n10.0.0.50:3306"] ``` Firewall pentesterni database'ga to'g'ridan-to'g'ri ulanishdan to'sadi. Lekin web server (kompromiss qilingan) o'sha database'ga kira oladi. Yechim: web serverda port forwarding o'rnatib, pentest kompyuteridan `192.168.1.100:8080` ga ulanganda trafik `10.0.0.50:3306` ga yo'naladi. **Port forwarding turlari:** - **Local forwarding** — local portdan remote xizmatlarga (`ssh -L`) - **Remote forwarding** — remote serverda port ochib, local xizmatga yo'naltirish (`ssh -R`) — reverse shell uchun - **Dynamic forwarding (SOCKS)** — istalgan manzilga yo'naltiruvchi proxy (`ssh -D`) ## Basic TCP proxy TCP proxy — client va server o'rtasida "tarjimon" bo'lib, trafikni ikki tomonlama uzatadi. ```go package main import ( "fmt" "io" "log" "net" ) // startProxy — local portda tinglaydi va trafikni remote'ga uzatadi func startProxy(localAddr, remoteAddr string) { listener, err := net.Listen("tcp", localAddr) if err != nil { log.Fatal("Listener yaratib bo'lmadi:", err) } defer listener.Close() fmt.Printf("TCP Proxy: %s → %s\n", localAddr, remoteAddr) for { // Yangi client ulanishini qabul qilamiz clientConn, err := listener.Accept() if err != nil { log.Println("Ulanish qabul qilishda xatolik:", err) continue } // Har bir ulanishni alohida goroutine'da boshqaramiz go handleConnection(clientConn, remoteAddr) } } func handleConnection(clientConn net.Conn, remoteAddr string) { defer clientConn.Close() // Remote manzilga ulanamiz remoteConn, err := net.Dial("tcp", remoteAddr) if err != nil { log.Println("Remote serverga ulanib bo'lmadi:", err) return } defer remoteConn.Close() fmt.Printf("Ulanish: %s → %s\n", clientConn.RemoteAddr(), remoteAddr) // Ikki tomonlama ma'lumot uzatish done := make(chan struct{}, 2) go func() { io.Copy(remoteConn, clientConn) // Client → Remote done <- struct{}{} }() go func() { io.Copy(clientConn, remoteConn) // Remote → Client done <- struct{}{} }() <-done // Bitta yo'nalish yopilganda tugatamiz } func main() { // Localhost:8080 ga kelgan trafik → 10.0.0.50:3306 startProxy("0.0.0.0:8080", "10.0.0.50:3306") } ``` `io.Copy` — bu funksiya bir yozuvchi (`io.Writer`) ga boshqa o'quvchidan (`io.Reader`) ma'lumotni oqim sifatida uzatadi. 32 KB bufer bilan optimallashtirilgan. Ikki goroutine parallel ishlaydi: biri client → remote, ikkinchisi remote → client. ## Trafik kuzatuvchi proxy Pentest paytida trafikni ko'rish kerak bo'ladi. Quyidagi proxy har bir o'tgan baytni loglaydi: ```go package main import ( "bytes" "fmt" "io" "log" "net" "time" ) type LoggingProxy struct { LocalAddr string RemoteAddr string } func (p *LoggingProxy) Start() { listener, err := net.Listen("tcp", p.LocalAddr) if err != nil { log.Fatal(err) } defer listener.Close() log.Printf("Logging proxy: %s → %s\n", p.LocalAddr, p.RemoteAddr) for { conn, err := listener.Accept() if err != nil { continue } go p.handle(conn) } } func (p *LoggingProxy) handle(clientConn net.Conn) { defer clientConn.Close() remoteConn, err := net.Dial("tcp", p.RemoteAddr) if err != nil { return } defer remoteConn.Close() done := make(chan struct{}, 2) go func() { p.copyWithLog(remoteConn, clientConn, "C→R") done <- struct{}{} }() go func() { p.copyWithLog(clientConn, remoteConn, "R→C") done <- struct{}{} }() <-done } func (p *LoggingProxy) copyWithLog(dst io.Writer, src io.Reader, dir string) { buf := make([]byte, 32*1024) for { n, err := src.Read(buf) if err != nil { return } data := buf[:n] // Chop etiladigan belgilarni ko'rsatamiz, qolganlarini '.' bilan printable := bytes.Map(func(r rune) rune { if r >= 32 && r <= 126 { return r } return '.' }, data) log.Printf("[%s] [%s] %d bayt: %s", time.Now().Format("15:04:05"), dir, n, string(printable[:min(80, len(printable))])) dst.Write(data) } } func min(a, b int) int { if a < b { return a } return b } ``` ## SSH tunnel orqali port forwarding Real pentest'da SSH orqali tunnel ochish eng qulay usul. Go'da `golang.org/x/crypto/ssh` paketi bilan: ```go import "golang.org/x/crypto/ssh" func sshLocalForward(sshHost, user, password string, localPort int, remoteTarget string) error { config := &ssh.ClientConfig{ User: user, Auth: []ssh.AuthMethod{ssh.Password(password)}, // Lab muhiti uchun — production'da server kalitini tekshiring! HostKeyCallback: ssh.InsecureIgnoreHostKey(), } sshConn, err := ssh.Dial("tcp", sshHost, config) if err != nil { return fmt.Errorf("SSH ulana olmadi: %w", err) } defer sshConn.Close() listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", localPort)) if err != nil { return err } defer listener.Close() log.Printf("SSH tunnel: localhost:%d → %s\n", localPort, remoteTarget) for { local, err := listener.Accept() if err != nil { continue } go func(c net.Conn) { defer c.Close() // SSH tunnel orqali remote target'ga ulanamiz remote, err := sshConn.Dial("tcp", remoteTarget) if err != nil { return } defer remote.Close() done := make(chan struct{}, 2) go func() { io.Copy(remote, c); done <- struct{}{} }() go func() { io.Copy(c, remote); done <- struct{}{} }() <-done }(local) } } ``` ## SOCKS5 proxy **SOCKS5** — standart proxy protokoli. Oddiy TCP proxy'dan farqi: manzil hardcode emas, har ulanish uchun dinamik ravishda ko'rsatiladi. Brauzer, `curl`, `nmap` shu proxy orqali istalgan manzilga borib, yo'naltirishi mumkin. SOCKS5 protokol jarayoni qisqacha: 1. Client versiyanı va auth methodlarini yuboradi 2. Server auth methodini tanlaydi (biz autentifikatsiyasiz ishlaymiz) 3. Client manzilni ko'rsatadi (IP yoki domen) 4. Server ulanadi va muvaffaqiyat javobini qaytaradi 5. Ma'lumot oqimi boshlanadi ```go package main import ( "encoding/binary" "fmt" "io" "log" "net" ) const ( socks5Version = 0x05 noAuth = 0x00 connectCmd = 0x01 ipv4Type = 0x01 domainType = 0x03 ) func startSOCKS5(addr string) { listener, err := net.Listen("tcp", addr) if err != nil { log.Fatal(err) } log.Printf("SOCKS5 proxy: %s\n", addr) for { conn, err := listener.Accept() if err != nil { continue } go handleSOCKS5(conn) } } func handleSOCKS5(conn net.Conn) { defer conn.Close() // 1. Handshake — versiyanı va auth methodini kelishib olamiz buf := make([]byte, 257) n, _ := conn.Read(buf) if n < 2 || buf[0] != socks5Version { return } conn.Write([]byte{socks5Version, noAuth}) // 2. Manzilni o'qiymiz header := make([]byte, 4) io.ReadFull(conn, header) if header[1] != connectCmd { return } var targetAddr string switch header[3] { case ipv4Type: ip := make([]byte, 4) io.ReadFull(conn, ip) targetAddr = net.IP(ip).String() case domainType: lenBuf := make([]byte, 1) io.ReadFull(conn, lenBuf) domain := make([]byte, lenBuf[0]) io.ReadFull(conn, domain) targetAddr = string(domain) default: return } portBuf := make([]byte, 2) io.ReadFull(conn, portBuf) port := binary.BigEndian.Uint16(portBuf) target := fmt.Sprintf("%s:%d", targetAddr, port) // 3. Target'ga ulanamiz remote, err := net.Dial("tcp", target) if err != nil { conn.Write([]byte{socks5Version, 0x05, 0x00, 0x01, 0, 0, 0, 0, 0, 0}) return } defer remote.Close() // 4. Muvaffaqiyat javobini yuboramiz conn.Write([]byte{socks5Version, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0}) log.Printf("SOCKS5: %s → %s\n", conn.RemoteAddr(), target) // 5. Trafik uzatish done := make(chan struct{}, 2) go func() { io.Copy(remote, conn); done <- struct{}{} }() go func() { io.Copy(conn, remote); done <- struct{}{} }() <-done } func main() { startSOCKS5("0.0.0.0:1080") } ``` Ishlatish: ```bash # curl SOCKS5 orqali curl --socks5 127.0.0.1:1080 http://internal-site.local # nmap SOCKS5 orqali nmap --proxies socks5://127.0.0.1:1080 10.0.0.50 ``` ## DNS tunneling haqida Ba'zi firewall'lar DNS so'rovlarini bloklashni unutadi. **DNS tunneling** — ma'lumotni DNS query nomiga kodlab yuborish texnikasi. Query: `ZGF0YQ==.attacker.com` → server decode qilib javob qaytaradi. Real vositalar: `dnscat2`, `iodine`. Bu darsda implementatsiya yo'q — konseptsiya bilan tanishish uchun. ## Qisqacha 1. **Port forwarding** — compromised host orqali ichki tarmoq xizmatlariga yetish. 2. **TCP proxy** — `io.Copy` bilan ikki tomonlama trafik uzatish, ikkita goroutine parallel. 3. **SSH tunnel** — shifrlangan, ishonchli port forwarding. 4. **SOCKS5** — universal dinamik proxy, manzil ulanish paytida ko'rsatiladi. ## Keyingi qadam Keyingi darsda port forwarding asosida **professional TCP port skaner** yozamiz — goroutine'lar bilan parallel skanerlash va banner grabbing.