Client Configuration Guide

Linux/Mac v2.3

This document is designed to quickly get you up and running on Linux or Mac using a customized client configuration.

TELESPLOIT

November 28, 2017

Overview

The Telesploit solution consists of three distinct parts: the Telesploit server, the Telesploit relay, and an SSH capable client.

Telesploit Server

The server runs a customized version of Kali Linux and is deployed within the target environment. Once network connectivity and power have been applied to the device, it will automatically connect to the relay server and create TLS encapsulated reverse SSH tunnels in its default configuration. These connections provide access to a command line interface (SSH), remote desktop (VNC), web proxy (Squid), and many other applications on the Telesploit server.

Telesploit Relay

The relay runs in the cloud and provides secure access to the Telesploit server from Internet-connected clients using SSH key-based authentication. The relay includes pre-configured IRC and Mattermost servers for team-based communication and collaboration.

Client

The client connects to the Telesploit server via the relay. Penetration testing tools, such as Metasploit, can then be run directly from the server within the target environment or proxied through the established connections.

Client Setup

Telesploit will provide a URL to download the customized scripts for connecting to your dedicated relay and server.

Example: https://relay-d015.telesploit.com/8b85b0fbb32c0575bc3cb21cc1af7db4eb167eed0b0d2de101bc7572363415bc/telesploit-d015-client.tar.gz

Download and Extract Client

Download the archive file. In this example we are accessing the Telesploit relay/server with the designation d015. Change the commands to reflect your assigned environment.

curl https://relay-d015.telesploit.com/8b85b0fbb32c0575bc3cb21cc1af7db4eb167eed0b0d2de101bc7572363415bc/telesploit-d015-client.tar.gz -o telesploit-d015-client.tar.gz

The integrity may be validated by performing a sha256sum on the file. The value should match the subdirectory name in the URL.

sha256sum telesploit-d015-client.tar.gz

If the checksum matches then extract the archive file and change into the newly created directory.

tar -zxvf telesploit-d015-client.tar.gz && cd telesploit-client/telesploit-d015

You should see the following files and directories:

The readme.txt file contains the server, relay, and port assignments for your Telesploit deployment. These should be used to replace the examples given in the subsequent sections.

Configure Client

The first time you setup your client you will need to run the script setup_client.sh. If you are in an environment that allows outbound SSH then it is recommended that you select that option. If you will be tunneling the SSH connections through TLS then ncat (part of the nmap suite) will be required on your system. If your environment requires using a proxy for outbound TLS connections then both ncat and proxytunnels are required. The proxy information will also need to be either entered in the configuration file client-configs/client.cfg or interactively from within the setup script.

./setup_client.sh

Enter the path to the private key corresponding to the public key previously provided to Telesploit. Tab complete is enabled on this field.

Choose your connection type. SSH is recommended. Direct (TLS) requires ncat to be installed while all proxy connection types require both ncat and proxytunnels.

The script will then pull a file from the relay containing the SSH server's known fingerprint and compare it to a locally generated version. Matching files indicate that an active Man-in-the-Middle attack is not being performed against your connection.

Enter the password for the private key corresponding to the public key previously provided to Telesploit. If you are not prompted for your password then verify the location and permissions on your private key and that you have ncat installed if using TLS or proxy connections then re-run setup_client.sh.

You should then be returned to the command prompt.

Establish SSH Tunnels and Connect to the Server

Once the client has been configured for your environment, verify that you can create SSH tunnels to the relay by running the script create_tunnels.sh. You will once again be prompted for the password to your SSH private key.

./create_tunnels.sh

Once the tunnels have been established you can verify connectivity by connecting to the Telesploit server using the script console.sh. You will once again be prompted for the password to your SSH private key. If everything has been configured properly you should see a Kali Linux command prompt.

./console.sh

Disconnecting from Server and Closing Tunnels

Typing 'exit' at the server command prompt will return you to your local shell.

exit

When not performing testing, you may teardown the tunnels by running the script kill_tunnels.sh. You should immediately be returned to the command prompt.

./kill_tunnels.sh

The next time you wish to connect to the Telesploit server it is not necessary to re-run the setup_client.sh script, just use the create_tunnels.sh script to bring the tunnels back up.

Common Tool Configurations

Please note that the SSH, VNC, Squid, and PostgreSQL services provided on the Telesploit server have been configured to only listen on localhost. If you install any additional services, such as Nessus, and do not want them to be exposed to the testing environment then restrict their access as well.

The following sections assume that you have configured the Telesploit client and established the required SSH tunnels.

Command Line Interface

Your SSH client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment.

Example SSH Configuration

  • Host: localhost (127.0.0.1)
  • Username: root
  • Password: N/A
  • Private Key: Your SSH private key
  • Port: 13015

Note: As with any remote console, Telesploit recommends using a detachable session, such as screen, for long running processes.

This example uses the script console.sh included with the Telesploit client.

./console.sh

Remote Desktop

Your VNC client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment.

Example VNC Configuration

  • Host: localhost (127.0.0.1)
  • Username:
  • Password: telesploit
  • Port: 23015

The following example uses the Remmina Remote Desktop Client. You will be prompted to enter the VNC password. As the VNC server is only listening on localhost, and connectivity requires SSH key authentication, this password is superfluous and has thus been set to ‘telesploit’ for all deployments.

Web Proxy

Your browser and web application assessment tools of choice (e.g. Chrome, Edge, Burp Suite, Zap) may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment.

Example Web Proxy Configuration

  • Host: localhost (127.0.0.1)
  • Username:
  • Password:
  • Port: 33015

In Firefox these settings can be found under Options -> Network Proxy -> Settings.

File Transfer

In addition to command line utilities, such as scp, file transfer tools like FileZilla may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment.

Example File Transfer Configuration

  • Host: localhost (127.0.0.1)
  • Username: root
  • Password: N/A
  • Private Key: Your SSH private key
  • Port: 13015

The following example uses FileZilla. To configure the application to use your SSH private key select Edit -> Preferences -> SFTP -> Add key file.

Internet Relay Chat

The Telesploit relay has an IRC server built in and both the client and server create SSH tunnels to communicate with it. Your IRC client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment.

Example IRC Configuration

  • Host: localhost (127.0.0.1)
  • Username:
  • Password:
  • Port: 53015

Client Configuration Guide | 11/28/2017

Collaboration

The Telesploit relay has a Mattermost instance installed and both the client and server create SSH tunnels to communicate with it. A web browser or Mattermost client may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment.

Example Mattermost Configuration

  • Host: localhost (127.0.0.1)
  • Username:
  • Password:
  • Port: 63015

The first configured user will become the Mattermost admin. The following example uses a standard browser to access the collaboration platform.

Troubleshooting

If you are unable to connect to the Telesploit server, then verify that you are able to directly connect to the relay. If your client is configured to use an SSH connection, then try directly accessing the SSH server on the relay. You will not be able to successfully login with the following command, but it will validate that nothing is blocking your access and that the relay is up.

ssh test@relay-d014.telesploit.com

If you are using TLS or proxy connections, then try accessing the SSH server through the HA Proxy running on the relay using ncat. You should see output similar to the following if nothing is blocking your access and the HA Proxy and SSH server are up.

ncat -v --ssl relay-d015.telesploit.com 443

If either of the above tests result in timeouts or no connections then verify that your outbound connections are not being blocked by a firewall or Intrusion Prevention System. Contact Telesploit support for additional assistance. If the tests are successful then verify that the tunnels have been created by running netstat and reviewing the output. If the tunnels have not been created then the output should look similar to the following depending on what services you have running.

netstat -plnt

If the tunnels have been established then the output should look similar to the following, again depending on what services you have running.

netstat -plnt | sort -k7

If the tunnels have not been established then re-run the script create_tunnels.sh. If the tunnels have been established run the script kill_tunnels.sh followed by create_tunnels.sh to clear any hung connections.

If you receive an error similar to the following after running create_tunnels.sh then the tunnels have already been established.

If you receive an error similar to the following after running kill_tunnels.sh then there are no active tunnels to teardown.

If you are still unable to create SSH tunnels to the relay then run the script kill_tunnels.sh followed by setup_client.sh before once again executing create_tunnels.sh. If this still fails then please contact Telesploit support.